News

New requirements cause information overload for some ISOs

Some ISOs are finding it a challenge to provide extensive documentation on the financial backgrounds of those they do business with, including representatives who sell ATMs and merchants who own them. The information is being sought by Visa for its Plus network, and other networks are expected to follow suit.

September 4, 2002

Under Visa's enhanced ISO risk standards, introduced in January of 2001, it's likely that most ISOs will get to know their sponsor banks a lot better.

Visais asking the financial institutions that sponsor ISOs into its Plus ATM network to obtain more extensive documentation from the ISOs on the financial backgrounds of the people they do business with, including the representatives who sell ATMs and the merchants who own them.

"Agent banks that underwrite, monitor and control agent relationships must determine an agent is financially responsible," said Martin Elliott, Visa U.S.A.'s director of corporate risk management, in a presentation at last February's ATMIA show in Hollywood, Fla. (See related story Visa: New ISO risk standards will help prevent fraud)

Palm Desert National Bank, a Palm Desert, Calif.-based financial institution that sponsors about 30 ISOs into networks like Plus and Star Systems, distributed requests for this information in late December, followed by additional letters mailed in January and March.

"The networks are asking banks to take a more active role in who they sponsor," said Angelia Ekholm, Palm Desert's director of marketing.

The greater good

It's for the protection of all those involved in the payment chain, including the sponsor bank, the transaction processor, the network and ultimately the consumer, Ekholm said.

"Like any acquiring bank or processor, we realized that we needed to know more about our ISOs, how they are doing business and who they are doing business with," she said. "When we give our sponsorship information to the networks, we have to be able to assure them that those ATMs are in compliance."

Ekholm said she expects other ATM networks to follow Visa's lead and issue similar requirements. Susan Zawodniak, executive director of the Woodcliff, N.J.-based NYCEnetwork, said that NYCE is in discussions with several other networks in an effort to create a set of "best practices" guidelines for sponsor banks to follow in their relationships with ISOs.

"I can't speak for the other networks, but we are reassessing our requirements," Zawodniak said, noting that she doesn't expect any formal change in NYCE rules to be adopted before the fourth quarter of this year.

Zawodniak said there is a "greater sensitivity" to security issues in the wake of a high-profile fraud case in which a crime ring used ATMs managed by ISOs in New York and California to illegally obtain PINs and withdraw more than $4 million from cardholders' bank accounts.

According to Gregg James, a special agent with the Secret Service's Financial Crimes Division, the agency believes up to 1,400 financial institutions may have suffered losses, although fewer than 100 have reported losses. (See related story Skim skam man)

"We need to keep better tabs on all of the parties in the payment food chain, any party that owns, operates, drives or sponsors ATMs," Zawodniak said, noting that financial institutions that own ATMs are regulated not only by networks like NYCE but also by state banking departments and in some cases by federal authorities.

Getting it together

John Steely, president of Automated Systems America, Inc. (ASAI), said his La Canada, Calif.-based ISO is doing its best to meet the mid-September guideline for the information requested by Palm Desert. Getting the added information on new locations is not a problem, he said, as ASAI implemented procedures to do so when it received its first notification from the bank.

ASAI's 1,000 existing locations are another matter, Steely said. "I've got a full-time person in the office working on compliance now. We started at the beginning of summer, and I'd say we're only half done."

In May Palm Desert organized the information it had received after its earlier requests for information and sent letters to ISOs that were still not in compliance.

"The information and documentation requested and the response deadlines set were not arbitrary, but were required by the networks as part of our ongoing membership," said Palm Desert's Ekholm. "To ignore or refuse would jeopardize connectivity of our own ATMs as well as those of our sponsored ISOs."

Part of the problem, Steely acknowledged, is that he gave short shrift to the task at first. "(Palm Desert) never sat down and told us how serious they really were about this," he said.

Kind of personal

Some merchants are balking at providing more detailed personal and financial histories, said Alik Perakh, president of San Diego, Calif.-based Cashflow ATM, a sales agent for ASAI.

"Some of what they are asking for is fairly intrusive," Perakh said. "You could maybe make the case that a less financially stable company is more likely to commit fraud, but that's a real stretch. It seems as if (the networks) are trying to cover their butts in every direction. They don't care if what they are asking for is reasonable or not."

While Steely believes his business will ultimately benefit from compliance, he is concerned that competitors who are not collecting the more extensive information from merchants will gain a short-term advantage. "What will happen if I'm competing on the street, and I'm asking my locations to do something that no one else is?" he said.

The director of marketing for an ISO with a network in excess of 2,000 ATMs, who prefers to remain unidentified, said he believes his company will have more trouble getting information from its sales agents than from merchants.

"We're in a better position than some because our financials are audited regularly and we've done due diligence on the larger dealers under our umbrella," he said. "But some of our dealers probably don't have financials, and if they did, they wouldn't give them to us."

It's not realistic to expect dealers to cough up that kind of information when, he said, "Sometimes they are customers, sometimes competitors, sometimes vendors; sometimes they're all three at once."

Steely is concerned that some banks may cut back on the number of ISOs they sponsor or exit the sponsorship game all together. "We've seen it happen in the leasing industry," he said, referring to the large number of leasing companies that stopped originating loans for ATMs in the wake of the Credit Card Center bankruptcy. (See related story Pushing paper)

Carrie Nakanishi, manager of ATM Sales Support for Atlanta-based transaction processor Lynk Systems, said she wishes that Visa and other networks would provide more guidance to sponsor banks, transaction processors and ISOs.

Nakanishi said that Visa clarified in a letter to Lynk dated June  4  that "ISO's must fill out either a W2 or 1099 tax form for all of their agents, and that the agents must use business cards and stationery that bear only the name of the registered ISO and the member the ISO represents."

This is contrary to what was conveyed during the presentation by Visa's Elliot at the ATMIA show last February, Nakanishi said.

"There's a lot of misinformation out there," Nakanishi said. "(The networks) want us to do it right, and we want to do it right, but it's frustrating because there is still some ambiguity. For those of us who are trying to comply with all of the rules and regulations, we believe this lack of consistent information is putting us and our customers at a disadvantage."

Palm Desert's Ekholm said that the bank's sponsorship department received some calls from concerned ISOs, which led to further discussions and a better understanding of the need for accumulating this information.

"I believe that this has and will lead to stronger relationships between sponsor banks and ISOs as well as better business practices for both," she said. "We're all in this business together, and we are all in it to be successful. We want to keep everyone in business and in business the right way."

It's important to remember what is at stake, said NYCE's Zawodniak. "We have to maintain consumer confidence in the payment system. If we're raising the bar on security, then we're doing a good thing."

Included In This Story

---

ATM Industry Association (ATMIA)

The ATM Industry Association, founded in 1997, is a global non-profit trade association with over 10,500 members in 65 countries. The membership base covers the full range of this worldwide industry comprising over 2.2 million installed ATMs.

Request Info

Learn More