MG V 18.1

Merchant Guidelines

2

Table of Contents Introduction....................................................................................................................................................... 4

POS ................................................................................................................................................................... 4

ACCEPTED POS DEVICES FOR NEW LOCATIONS .............................................................................................. 4

PIN PAD ENCRYPTION .................................................................................................................................... 4

STANDALONE POS ......................................................................................................................................... 4

VIRTUAL TERMINAL .......................................................................................................................................... 4

NOT ABLE TO PROCESS ................................................................................................................................... 5

HELPDESK INFO ............................................................................................................................................... 5

HELPDESK PHONE NUMBERS ............................................................................................................................ 5

Valid Card Types ............................................................................................................................................. 5

ELECTRONIC FOOD BENEFIT CARDS (EBT) ........................................................................................................ 6

FUELMAN ........................................................................................................................................................ 6

Credit Card Rules ............................................................................................................................................. 6

Authorization and Merchant ID Numbers and Request for Copy Fax Numbers ........................................ 7

Authorization for Fraud Suspicious Transactions .......................................................................................... 7

Authorized Products That May Be Charged on A Credit Card .................................................................... 7

Fleet Cards ....................................................................................................................................................... 7

Chargebacks .................................................................................................................................................... 7

CHARGEBACK– PAY AT THE PUMP .................................................................................................................... 8

CARD BRAND RULES AND REGULATIONS ......................................................................................................... 8

SAMPLE CHARGEBACK REPORT ........................................................................................................................ 8

REQUEST FOR COPY PROCEDURES ................................................................................................................... 8

SAMPLE REQUEST FOR COPY REPOR ................................................................................................................ 9

Security and Fraud ........................................................................................................................................ 10

SHUT OFF/COMPLETION LIMITS ..................................................................................................................... 10

HOST VELOCITY ............................................................................................................................................ 10

ADDRESS/ZIP CODE VERIFICATION (AVS) .................................................................................................... 10

SECURITY LABELS ........................................................................................................................................... 10

Managed Firewall .......................................................................................................................................... 11

HOW TO ORDER ........................................................................................................................................... 11

PAYSAFE UTM MANAGED FIREWALL CONTACT INFORMATION ..................................................................... 11

3

PCI Standards and ControlScan ................................................................................................................... 12

PCI ............................................................................................................................................................... 12

CONTROLSCAN OVERVIEW .......................................................................................................................... 12

CONTROLSCAN PCI SUPPORT CONTACT INFORMATION ................................................................................ 13

CONTROLSCAN REQUIREMENTS .................................................................................................................... 13

EUROPAY MASTERCARD VISA – EMV ....................................................................................................... 13

FRAUD LIABILITY SHIFT ................................................................................................................................... 14

Branded Programs ......................................................................................................................................... 14

CLARK CROWN MASTERCARD ....................................................................................................................... 14

CLARK CROWN FLEET CARD .......................................................................................................................... 14

COMDATA DISCOUNT ................................................................................................................................... 14

CLARK CROWN GIFT CARD ........................................................................................................................... 15

CLARK CROWN MOBILE APP ......................................................................................................................... 15

Merchant Terms and Conditions for Gift Cards ........................................................................................... 15

4

Introduction The Clark Payment Methods Manual contains the policies and procedures governing credit and debit card purchases made by retail and commercial customers presenting credit or debit cards at all locations. All credit and debit card charges are to be made on Clark Brands certified electronic Point of Sale (POS) Equipment. Keep all credit and debit card sales receipts for one year. If a customer disputes a sale made at your location, you will need these copies. If you are unable to provide them upon request, the sale is subject to chargeback.

The contents of this manual are subject to change by Clark Brands.

POS The following POS terminals are approved to process on the Clark Network:

ACCEPTED POS DEVICES FOR NEW LOCATIONS Comdata Smart Solutions Gilbarco Passport NCR Radiant Syn-Tech Fuelmaster Verifone Commander Verifone Ruby Ci Verifone Ruby Sapphire/Topaz Verifone Ruby Supersystem Wayne Nucleus

PIN PAD ENCRYPTION

Wells TDES Key 351

STANDALONE POS

Standalone POS are available for rent through Clark Brands. Rental includes free hardware repair and replacement including shipping should the need arise. It also includes free software upgrades and help desk support services. Amounts do not include applicable sales tax. Rates are subject to change.

VIRTUAL TERMINAL

Clark’s Office Store Program allows for the processing and acceptance of virtually all common credit card types* in an office environment. Our enhanced Office Store Program allows you to transact credit cards in your office or bulk plant. All you need is Clark’s Office Store Program and a computer with an internet connection. For more information visit www.clarkbrands.com/programs/clark-crown-virtual-terminal

5

NOT ABLE TO PROCESS

If your location is not able to process complete the following steps: • Processing Internet

o Checking your internet connection If there is no internet connection call your internet service provider If there is a connection reboot your internet router and the firewall

o If your credit cards still do not work, contact Client Services or ControlScan Managed Firewall Technical Support

• Processing Dial o Check your phone line

If there is no dial tone call your phone provider If there is a dial tone and you still cannot process call:

• Client Services • Your POS Helpdesk • If processing on a standalone terminal call the First Data

Buypass Helpdesk

HELPDESK INFO

HELPDESK PHONE NUMBERS

Clark Brands Client Services Mon. – Fri. 8am – 5pm CST 877.462.5275 ext. 9 Comdata 24/7 800.833.8680 ControlScan Managed Firewall Technical Support 24/7 800.393.3246 ext. 1 First Data Buypass Helpdesk 24/7 800.347.8224 Gilbarco 24/7 800.743.7501 Verifone 24/7 800.519.7225 Wayne Nucleus 24/7 800.7289.2963

Valid Card Types The cards that are accepted by Clark Brands are subject to change. All cards expire on the last day of the month shown on the card.

6

ELECTRONIC FOOD BENEFIT CARDS (EBT)

EBT cards can also be accepted on certain POS and with additional setup. The following POS can accept EBT:

Verifone Commander Verifone Ruby Ci

Radiant FD130 For locations with a POS that cannot accept EBT the standalone FD130 can be rented to process only EBT cards at a monthly fee.

To have EBT setup at the location a copy of the Supplemental Nutrition Assistance Program Permit issued by the U.S. Department of Agriculture needs to be submitted to clientsevices@clarkbrands.com. If a copy of the certificate cannot be found, please call 1.877.823.4369 to obtain a copy.

FUELMAN

Fuelman fleet cards can be processed through the POS on the Clark network. However, the card is settled directly by Fuelman, it is not settled by Clark. A Fuelman account needs to be setup directly with Fuelman. They can be reached at 1-877-826-9282 or visit their site www.fuelman.com/fuelman-merchant-program. Once the account is setup and the ID is received please notify Client Services to have it added to the location’s profile.

Credit Card Rules A card must be presented to complete a transaction, either through card swipe on a credit card reader or a manual imprint.

Merchants may require minimum purchase amounts on credit card transactions. The minimum purchase amount must not exceed $10 (or other amount as set by law), does not apply to transactions made with debit cards and cannot differentiate on the basis of the issuer or payment card network. No maximum amount can be applied to any credit or debit card transactions.

For a complete list of rules and guidelines please visit the links below:

Visa Rules Mastercard Rules American Express Rules General Guidelines

7

Authorization and Merchant ID Numbers and Request for Copy Fax Numbers

Authorization for Fraud Suspicious Transactions If you are suspicious of a card or cardholder, call the appropriate Voice Authorization Center and ask for a “code 10”. A specially trained operator will lead you through a series of questions designed to minimize discomfort to both you and your customer. A Code 10 authorization request is most often performed when fraud is suspected. The authorization request allows merchants to obtain further information about a customer or the card in question before releasing merchandise. A merchant will call the authorization center, requesting guidance on how to proceed.

Authorized Products That May Be Charged on A Credit Card All items sold at Clark stores except for Money Orders and Lottery Tickets may be charged on a credit or debit card.

Fleet Cards The Clark Fleet Services Card, Voyager and Wright Express Fleet Fueling Cards may have purchase restrictions embossed on the card. The card will be either Fuel Only or Restricted.

In either situation, when a manual imprint is necessary for Fleet Cards, the gallons purchased, price per gallon, vehicle ID and odometer reading will be required.

Chargebacks A chargeback is the reversal of a previous sales transaction by the card issuer due to the transaction being non-compliant with the association rules and regulations or because it was disputed by a Cardholder. When this occurs, the amount is passed on to the merchant/dealer and deducted from their credit card settlement. Clark will notify the

8

Licensee of a chargeback by sending a “Chargeback Report” with details of the transaction. (See sample Chargeback Report)

CHARGEBACK– PAY AT THE PUMP

Merchant regulations provide no remedy for pay at the pump transactions that are deemed to be fraudulent. Clark reserves the right to chargeback transactions that are not in compliance with the Payment Methods Guidelines and the rules and regulations of Visa, MasterCard, Discover, American Express, all Debit Networks and all Fleet Card issuers.

CARD BRAND RULES AND REGULATIONS

VISA Mastercard American Express General Guidelines

SAMPLE CHARGEBACK REPORT

When a chargeback report is received please follow the directions that are provided to attempt to reverse the chargeback with the card issuer.

REQUEST FOR COPY PROCEDURES

Because of occasional billing questions, there may be instances when a copy of a sales draft (Ticket) is required by the cardholder’s issuing institution. These requests are formally known as a Request for Copy (RFCO), and informally known as retrieval requests. Below are the steps to follow when a Merchant receives a Request for Copy. Failure to respond to a Request for Copy will result in a chargeback.

9

1. Clark receives Requests for Copies (RFCO) daily from card companies and will send via email Request for Copy reports to the Licensee (see Sample Request for Copy Report).

2. The Merchant should find the store copy of the ticket that has been requested and send or fax it to the credit card company requesting the ticket.

3. Please make sure that your ticket copy is legible before sending via fax or mail. IMPORTANT! Please respond to all retrieval requests by the reply date. Responding by this date does not ensure that transactions will not be charged back.

SAMPLE REQUEST FOR COPY REPOR

10

Security and Fraud Merchants processing on the Clark network benefit from tools that can help reduce and identify fraud events.

SHUT OFF/COMPLETION LIMITS

The following Shut Off/Completion limits need to be programmed into the POS so that no purchase at the pump exceeds these limits:

Card Type Shut Off Visa $100 MasterCard $100 American Express $100 Discover $100 Debit $50 Wright Express $150 Voyager $100 Visa Fleet $150 MasterCard Fleet $150 Fuelman $150

For transaction amounts that exceeds the amounts provided by Clark issuers may chargeback the difference between the transaction amount and the limit for select chargeback reason codes.

HOST VELOCITY

Clark can limit the number of times a credit card is swiped at a location’s dispensers per day. This control makes it more difficult for a stolen credit card to be used numerous times at the dispenser, potentially preventing fewer “Pay at the Pump” chargebacks. The velocity setting can be changed at any time at Clark’s discretion.

ADDRESS/ZIP CODE VERIFICATION (AVS)

AVS is a system that helps reduce pay-at-the-pump fraud by verifying the personal address and billing information provided by a customer at the time of an online credit card transaction against the information the credit card company has on file. Clark may choose to place a location on AVS. If a dealer chooses not to utilize the AVS function per Clark’s request, all chargebacks will be the responsibility of the dealer.

SECURITY LABELS

Over the past few years, there has been a dramatic increase in gas station credit card skimming. Criminals have been opening and inserting skimming devices in unattended PIN-entry devices at gas stations nationwide. The criminals can then download personal

11

information from credit/debit cards leading to identity theft. In order to combat this problem Clark Brands can provide security labels.

These stickers provide an anti-tamper seal for your pumps and have pressure-sensitive adhesive-just peel and stick. After applying a security label in the proper location around the dispenser door, the label will remain a solid color. If any attempts to lift, peel or remove the label the words VOID will appear.

Managed Firewall Clark Brands has partnered with ControlScan (formerly EchoSat) to offer the PaySafe™ UTM managed firewall system. The PaySafe system next generation network security provides the highest level of protection to help secure your credit card transactions and network. These systems are continually monitoring for unauthorized intrusion, hacker, logging internet activity and testing security to help protect you and your customer’s information. Click this link for a short video providing further explanation https://youtu.be/O0vLY0czD-4.

It also includes cellular failover to keep you up and running when the internet is not. It is a faster alternative to traditional analog dial backup.

The monthly firewall rental fee is billed directly by Echosat and includes: • Continuous monitoring of your firewall by ControlScan’s systems • Notifications of changes in your systems • Ability to log internet activity • Monitors for intrusions and hackers • 24/7/365 support center

HOW TO ORDER

Managed firewall systems are mandated by the PCI DSS standards and is therefore required for all locations processing over the internet. To order a Paysafe please create an account by visiting www.echosat.com/clarkbrands.

PAYSAFE UTM MANAGED FIREWALL CONTACT INFORMATION

1.800.393.3246 24/7

12

PCI Standards and ControlScan

PCI

The Payment Card Industry Data Security Standards (PCI DSS) are a set of mandated guidelines that provide merchants with rules for physical, application, and network security, as well as security policy management, which is required of all merchants.

In 2004, the PCI Council was formed by the five major card brands: Visa, MasterCard, American Express, Discover and Japan Card. Their aim was to establish a standard set of guidelines around the handling of card holder data by merchants. To demonstrate compliance with these guidelines, merchants are required to submit an attestation of compliance annually.

It is your responsibility—as a merchant accepting credit and debit card payments—to safeguard customer card data by becoming PCI compliant and maintaining compliance with PCI standards. In order to comply with the card brands and avoid potentially hefty fines, Clark Brands requires all merchants meet PCI DSS requirements as soon as possible. For more information about your PCI compliance, visit www.pcisecuritystandards.org.

CONTROLSCAN OVERVIEW

Clark Crown has partnered with ControlScan to assist you in understanding and meeting the requirements needed to validate and maintain PCI compliance. ControlScan’s easy-to-use solution and detailed level of support make achieving compliance less complicated. ControlScan's PCI 1-2-3 compliance program will provide you with access to:

SmartSAQ (PCI Self-Assessment Questionnaire) Policy Builder (PCI policy development tool) Security Awareness Training SmartScan (network scanning tool) Knowledgeable support staff

13

ControlScan was chosen because of its ability to provide hands-on assistance to all merchants for completion of the Self-Assessment Questionnaire (SAQ), its scanning engine reliability and service for identifying and remediating vulnerabilities - all required to maintain PCI compliance.

Recognizing that PCI compliance can seem complex, ControlScan offers unlimited, highly personalized support and help desk, which includes:

• Access to one-on-one telephone consultation. • Knowledgeable representatives trained on compliance and security. • Ability to walk through the entire required SAQ process with you. • Access to certified security analysts for more advanced questions. • Assistance in any remediation that may be required.

CONTROLSCAN PCI SUPPORT CONTACT INFORMATION

1.800.825.3301 ext 1 8:30 AM – 8:00 PM Monday – Friday, EST https://www.controlscan.com/

CONTROLSCAN REQUIREMENTS

Within the first week a location begins processing on the Clark network they will be enrolled in ControlScan and will receive an email with login instructions to the email provided by the location at time of setup. The location will have 90-days to complete and pass the questionnaire (SAQ) and if processing over the internet complete and pass the quarterly vulnerability scan.

If merchants do not become PCI compliant within the 90-day period, non-compliance fees will be assessed on a monthly basis, one fee for an incomplete or failed SAQ and another if applicable for an incomplete or failed vulnerability scan. The PCI non-compliance fees will be assessed until the merchant has completed and passed the SAQ and if processing over the internet has completed a passing quarterly vulnerability scan.

In the event a merchant chooses to utilize another certified QSA and ASV or has already achieved compliance, the merchant must submit a completed SAQ reflecting compliant status, a completed and signed Attestation of Compliance, and as passing scan report to PCI@clarkbrands.com for review. In that event, an administrative fee will be assessed.

EUROPAY MASTERCARD VISA – EMV EMV cards contain both a traditional magnetic strip, as well as a chip that is used to transmit data. EMV cards help deter fraud by using unique transaction codes, which can only be use at one time, making fraud more difficult and less likely to occur.

14

FRAUD LIABILITY SHIFT

Beginning in October 2015 for indoor transactions and upcoming in October 2020 for outdoor pump transactions, when a fraudulent transaction occurs, whichever party (Merchant, Processor, Card Issuer) has the lesser technology will be held financially liable for any resulting card present counterfeit losses. Merchants need to have an EMV compliant terminal and pumps to help protect against the liability shift.

Branded Programs All Clark and Crown locations are required to participate in all Clark Crown Programs

CLARK CROWN MASTERCARD

All Clark and Crown locations need to actively promote the Mastercard.

Benefits for the location: • Increased sales at the pump, customers visit more frequently

and spend more than third party credit cardholders • Brand loyalty

To order additional POP items visit https://shopclarkcrown.com or call 888.400.5438 8AM – 6PM EST, Monday – Friday.

Consumer Benefits: • Cash Back benefits • No annual fee

To apply and for full programs details as well as Terms and Conditions visit http://www.clarkbrands.com/programs/clark-crown-mastercard/

CLARK CROWN FLEET CARD

Clark and Crown offer a comprehensive fleet sales program to help you tie fleet customers to your store and improve your gallons and inside business. Good fleet customers are already buying some or all of their fuel from you and introducing these commercial customers to the Clark Crown Fleet Card makes good business sense. A Clark Crown Fleet cardholder remains loyal to your store, increasing your sales.

For additional information and to apply visit: www.clarkbrands.com/programs/clark-crown-fleet-card

COMDATA DISCOUNT

Comdata MasterCard® Corporate Fleet Card customers will earn an automatic $0.02 price-per-gallon discount at all Clark and Crown locations! For more information visit: www.clarkbrands.com/programs/comdata-discount/

15

CLARK CROWN GIFT CARD

Clark Crown Gift Cards are accepted at all Clark and Crown locations and all locations must adhere to the Merchant Terms and Conditions. Gift cards help build consumer loyalty and increase total spend.

To order cards to be sold at your store please visit https://shopclarkcrown.com or call 888.400.5438 8AM – 6PM EST, Monday – Friday.

CLARK CROWN MOBILE APP

The Clark Crown Mobile Application is available for download through both the Apple Store and the Play Store for Android and iPhones. The app allows for customers to search for locations as well as purchase digital gift cards. The digital gift card works at all Clark and Crown locations processing on a Ruby Ci/Commander and Gilbarco Passport. To process the digital gift cards the cashier needs to look at the customer’s mobile phone and manually enter the gift card number and PIN. Any questions please contact Clark Client Services 877.462.5275 ext. 9.

Merchant Terms and Conditions for Gift Cards As a condition to your being a Designated Station, you represent that you have read these Merchant Terms and Conditions for Gift Cards, agree to be bound by them and they may be changed at any time, with or without notice to you, as per the terms of the Payment Transaction Contract with Clark.

1. You agree to actively sell gift cards to consumers as a product designed to stimulate customer loyalty and recurring purchases at your Designated Station.

2. You agree to prominently display approved point of purchase materials at all times as per the planogram, which may be updated from time to time.

3. You agree that you may elect not to sell gift cards to consumers, but that you will accept authorized gift cards from consumers for purchases made at your Designated Station.

4. You agree to display at two dispenser faces approved point of sale materials marketing gift cards to consumers.

5. You agree to maintain an adequate inventory of gift cards, and carriers or envelopes, in approved gift card holders.

6. You agree not to display any unapproved gift card point of purchase materials. 7. You agree to comply with all Federal, state, and local rules, regulations, laws,

ordinances and the like relating to the proper sale of gift cards, which are subject to change from time to time.

8. You accept responsibility to pay any taxes imposed by any governmental entity related to any products or services sold by acceptance of gift cards.

16

9. You agree to promptly notify us at 877-462-5275 of any notices, orders, or communications you receive from third parties relating to gift cards.

10. You agree to provide reports, receipts, information, and the like promptly when requested.

11. You agree to promptly communicate to consumers, in the event you cease being a Designated Station or the gift card program is discontinued for any reason, the approved process for redeeming their unused balance on their card.

12. You agree that in the event you cease acceptance of gift cards due to no longer being a Designated Station, you will promptly remove all gift card point of purchase materials and will promptly notify us.

13. You agree that all reports provided to you for gift card transactions reflect transactions that occur at your Designated Station and are prepared using information provided by third parties. Any failure to properly or accurately convey data will result in errors in reports.

14. You agree to authorize gift card transactions using the card network. Your failure to obtain authorization in advance of issuance or redemption of gift cards will be your responsibility.

15. You agree that we reserve the right to deactivate any and all gift cards for any reason or no reason, at any time, with or without notice.

16. You agree that we may continue to require acceptance of gift cards for purchases but cease activation and reloading of previously issued gift cards.

17. You agree to convert your existing gift card inventory to new gift card inventory at our instruction.

18. You agree to process purchases, activations, and reloads of gift cards using only approved point of sale terminals.

19. You agree not to establish expiration dates or require consumers to provide name, address, phone numbers, or email addresses at time of activation, purchase, or reload unless required by law.

20. You agree not to assess any fees for processing purchases, activations, or reloads of gift cards to consumers.

21. You agree to accept digital gift cards as presented by consumers via the Mobile Application.

22. You agree to validate the gift card number for all gift card transactions, regardless of acceptance method (i.e. swiped, keyed or scanned).

23. You agree to configure your point of sale device in a manner that supports card acceptance as instructed by us.