Princeton University Merchant Accounts
All University merchant accounts must be authorized and established by the Treasury Planning and Operations department, and must transmit credit card receipts to Princeton University’s main bank account. 

The department must demonstrate a valid business need for a merchant account and demonstrate certain business operation and financial management criteria. Please see the Merchant Accounts page for more information about requirements and the procedure for securing approval for a new merchant account.

PCI Service Providers
Departments must notify Finance Technology, and conduct required due diligence, including an ASR (Architecture and Security Review) by the Office of Information Technology, prior to engaging a service provider that handles cardholder data on behalf of the University. Service providers must contractually guarantee the security of cardholder data that they store, process, or transmit. All such PCI Service Providers and associated contracts must be reviewed and approved by the Office of Finance and Treasury. 

Public-Facing Web Applications
Any public-facing web application, including Princeton University websites, that accept online payment by credit or debit card must be reviewed and approved by Finance Technology, and must use a PCI compliant gateway provider to capture and transmit cardholder data to the University's payment processor. Princeton University web servers must be located in a PCI Compliant environment approved by the Office of Information Technology (OIT).

Use of the University Network to Process Credit or Debit Card Transactions
Even though an organization may be authorized separately to use the University network for other activities per the Acceptable Use Policy For Princeton University Information Technology And Digital Resources, only departments of the University are permitted to use the University’s network to process credit or debit card transactions

Payment Card Industry (PCI) Compliance
There are five main areas of PCI compliance:

1. Mandatory Compliance for Departments that Accept Credit and Debit Card Payments 
Any department that accepts credit and debit card payments is a merchant location and must comply with the PCI-DSS requirements and other University requirements set out in this policy and its procedures. Compliance with PCI-DSS is required even if the department or a service provider engaged by the department, doesn’t directly store any credit card data.
 
2. Required Procedures and Internal Controls for Credit and Debit Card Handling 
Each department that accepts, captures, stores, transmits, or processes credit or debit card payments through automated systems or manual process must exercise the following internal controls and follow the required procedures listed below: 

     1. How to Accept and Process Credit and Debit Card Transactions - Credit and debit card payments may be accepted using only approved terminals and devices. Terminals must be kept in a secure location and inspected periodically for tampering or substitution. In addition, the segregation of processing and reconciling duties is required in departments. 
     2. How to Securely Handle Cardholder Information - Departments that handle credit and debit card information must do so securely, and according to a documented procedure that is approved by Finance Technology. 

Credit and debit card information may NOT be stored on the hard drive of any personal computer, laptop, tablet or smartphone, on the hard drive of any computer server or network storage device, or any removable storage medium, such as DVDs, CDs, thumb drives, USB keys, etc.

Each person who has access to credit or debit card information is responsible for protecting the information and destroying it as soon as it is no longer necessary in compliance with the University’s Information Security Policy.

3. Required Training in PCI Compliance and General Information Security
Only authorized individuals who have successfully completed approved University training in PCI Compliance and General Information Security may process credit and debit card transactions or handle cardholder information on behalf of the University. 

 Students and employees of the University with access to cardholder data must complete the University’s PCI compliance training program annually, available online through the Employee Learn Center. Other individuals, including contractors and volunteers who accept or process credit or debit cards on behalf of Princeton University, must also be trained annually, but may receive training specifically designed for their role by Finance Technology. Individuals who are new to the role must be trained prior to taking on their credit or debit card handling duties.

 Academic and administrative managers, deans, and directors are responsible for ensuring that all individuals who handle cardholder data for their Merchant Location, including volunteers, receive appropriate training. A record of individuals who are authorized to accept and process credit or debit cards at each location, and the date that each authorized individual was trained, must be maintained by the Department and submitted as part of the annual attestation to Finance Technology.

4. Required Departmental Attestation of PCI Compliance
In order for the University to attest to compliance with PCI-DSS requirements, senior academic and administrative department managers responsible for the University’s merchant locations must understand how their location processes credit card transactions, and must complete and submit an annual Departmental Attestation of PCI Compliance to Finance Technology.

5. Collecting Sales Tax and Providing Receipts

Departments accept these key responsibilities, which are required components of credit and debit card transactions:
• To collect and record tax on any applicable sales transactions. Please refer to the New Jersey Sales Tax Guide for a list of items for which the University must collect and withhold tax.
• Reconcile credit and debit card transactions promptly

Suspected Illegal Activity
If a breach of credit or debit card information is suspected or has occurred, the person suspecting the breach must notify the Department Manager immediately. The Department Manager should contact the OIT Service Desk at 258-HELP and indicate that a credit card data breach may have occurred. If the Department Manager is unavailable at the time, the person suspecting the breach should call the OIT Service Desk directly.

Compliance with this Policy
If a department or individual fails to comply with this policy, it may result in the revocation of the ability to process credit and debit card transactions and could lead to disciplinary action, up to and including involuntary termination. Possible subsequent penalties to the University include increased credit and debit card transaction fees, a suspension of credit and debit card services for the entire University, annual audits, and fines.