e-Commerce

Program Overview and Policy Requirements

Northwestern University provides several approved payment card (credit or debit card) solutions for the merchants on campus to accept payment cards in-person, online, and over the phone. For network-connected payment card acceptance devices, the University requires the use of PCI SSC validated point-to-point encrypted (P2PE) payment solutions.

All merchants that accept payment cards must adhere to the details of the University Payment Card Program, including maintaining the requirements of PCI DSS compliance to prevent data breaches. The Payment Card Industry Data Security Standard (PCI DSS) is a set of standards developed to ensure the proper use and protection of cardholders’ personal information to reduce fraud. For Northwestern University merchants to accept payment cards as a form of payment, these standards must be followed and attested to annually. These standards include use of hardware and software with PCI validated P2PE, written policies and procedures for managing devices and annual training around the PCI DSS standards.

Departments must obtain approval from Treasury Services prior to initiating or engaging in any activity where payment cards are used in connection with accepting revenue. Only University approved equipment, payment gateways, processes, technologies, and supplier/vendors may be used.

Getting Started with Merchant Card Processing

If your department would like to accept payment cards, please first review the University Payment Card Program to understand your responsibilities, then reach out to support@arrowpayments.com to start the process.

Download Form: Merchant Card Processing Request Form (EDITABLE – with Processing Procedures and SoD Matrix) 

Application Review and Approval Criteria

To apply, download the Merchant Card Processing Request Form from the Quick Links section below. Approvals are granted based on a department's ability to demonstrate:

Business Case Strength

Robustness of the business processes and procedures to ensure duty segregation, accuracy in daily balancing and reconciling transactions and timely creation of deposits (CRTs), monthly tie out of transactions against budget statements.

Presence of Security Policies Geared Towards the Protection of Cardholder Data

If all the above have been met and vetted satisfactorily, and revisions are not needed, the timeline for approval still varies widely based upon many factors; especially significant would be the PCI Compliance/Validation and specific PCI contract readiness of any primary and nested TPSPs (Third Party Service Providers) selected to be involved in the Merchant's card processing solution. Typically, any process involving a TPSP may take many months, and may extend over a period of years. As TPSPs make greater efforts to be at the ready with PCI complaint, validated and scope-reducing solutions, this timeline may shrink. Thus, properly evaluating and then engaging with TPSPs that already have well developed PCI Compliance and validation efforts behind their solutions is always the first, and best, measure. Please visit the Credit Card Security (PCI DSS Compliance) page for more information.

Please contact us at treasury_operations@northwestern.edu as you first begin the TPSP evaluation process and if you need assistance completing an application.