Does anyone know if VISA issued any suggested wording to be used to communicate this to cardholders. Are you disclosing it by updating your Reg. E disclosures. Do I need to send the disclosure to all customers w/ a debit card.
Is it correct that Visa is requiring annual communications with cardholders to alert them that a PIN may not be required to authenticate such transactions?

Jerseygirl - I am wondering the same thing. I just found out about this yesterday and I'm trying to figure out what to do. The thought that we have to annually inform cardholders seems crazy to me. Plus, I don't even think my customers would understand this anyway. Anyone else have any thoughts on this?

I was just asked to see if BOL had any info. on this. I'll be interested in reading what others have to say.

This is news to me. So will PINless debits apply to zero liability? Is this a convenience item and is there no PIN, no signature, no authentication at all?

Transactions under certain dollar limits that occur at certified terminals do not require a PIN. An example would be when you buy movie tickets at a self-dispensing machine or use the card at McDonalds to buy lunch.

As for required disclosure of these types of transactions - I know the recent court ruling against Visa regarding Interchange rates for using PINs is the impetus. But I am not familiar with the exact requirements since I am no longer in that area.

I sent an inquiry about this to another Compliance Helpdesk and they said it was a Visa issue and they would not need to address it. I responded that I believe they are wrong as it appears it would be covered under Reg. E, change notification, initial disclosures and an annual disclosure. I already have information from Visa, but its nothing in detail about what needs to be disclosed.

I'm thinking we'll see more on this soon.

Basically, it's not the no sig required floor limit transactions that some merchant types are allowed to process, it's actually a PIN transaction without the PIN, they've been allowed for certain merchants for bill payments (PG&E and ATT&T have been doing this for awhile). But they were still processed with all Visa protections even though they weren't signature based. But now they aren't going to necessarily go though the Visa network, they'll be processed as any other PIN based transaction (even without the PIN) for all merchants if they participate though whatever PIN network (Accell/Exchange, Star, etc). So Visa is stating that because these transactions will no longer be protected under Visa protections, we have to notify all cardholders initially and annually. I'm just having a hard time with this notification process and can't imagine having to send the disclosure now and then every year. Customers aren't even going to understand it.

At least for Star, if a pin-less transction is performed through the Star network you have full chargeback rights as the merchants are required to accept full responsibility for these transactions. I would assume the other networks have similar provisions to allow these types of transactions to be processed. We do a few chargebacks a day, particularly the bill pays.

I would think it would need to be the merchant that has to disclose their transaction will not be processed through Visa, but a PIN network that may have less protection.

Per VISA - issuers are responsible to disclose. I believe that we have until January 1 to provide the disclosure to existing customers.

So these PIN-less transactions, not through the Visa network, will have zero liability or Reg E liability?

Reg E liability as the transactions will not be going through the Visa system and do not qualify for Visa Zero liability, which is what we will need to disclose.

From the Visa Zero Liability Policy for consumer cards (bold added)
http://usa.visa.com/personal/security/visa_security_program/zero_liability.html

Covers U.S.-issued cards only. Does not apply to ATM transactions, PIN transactions not processed by Visa, or certain commercial card transactions. Individual provisional credit amounts are provided on a provisional basis and may be withheld, delayed, limited, or rescinded by your issuer based on factors such as gross negligence or fraud, delay in reporting unauthorized use, investigation and verification of claim and account standing and history. You must notify your financial institution immediately of any unauthorized use. Transaction at issue must be posted to your account before provisional credit may be issued. For specific restrictions, limitations and other details, please consult your issuer.

Here is an outline of Visa's Final Rule from the Visa website. We, too, are looking for sample language. Since we already have the disclosures in place and just need to add language, we really don't want to have to purchase a new disclosure product from a vendor. This final rule tells you what to include but not how to say it (i.e. you have to give examples to the customer but VISA does not provide those examples).

Here's an article on this from the Compliance Headquarters Website: Visa issues Non-Visa Transaction Rules.

Here is some information I just recieved by fax from our processor: (Our processor said they will not enable PINless non-Visa transactions. However, since we are also members of other networks, our cards have the capability. Our customers with Visa-branded debit cards can use their cards to make bill payments to companies patricipating in these programs with these other networks.)

Issure Requirements
"Visa requires your financial institution to take the following actions to comply with the new rules:

1. Communicate to cardholders that you have enabled non-Visa debit transactions and do not require all such transactions to be authenticated by a PIN. This must be communicated at the time of enablement and at least annually thereafter.

2. Provide cardholders with a list of the debit networks for which such transactions are enabled.

3. Give cardholders examples of the types of actions they must be required to take to initiate a Visa transaction on such cards.

4. Tell cardholders that the provisions of the financial instituiton's cardholder agreement relating to Visa transactions are not applicable for the non-Visa debit transactions. This must be disclosed at the time of enablement and at least annually thereafter."

I forgot to mention that there is a #5.

5. "Notify Visa of implementation no later than January 1, 2009. To receive a copy of Visa's registration form, contact your account executive."

I'm still wondering how others are handling the notification. Statement stuffers? Separate mailing? Has anyone decided how they're going to do the initial notification and the annual thereafter?

Bumping this because even after reading this thread I am still not sure if Reg E disclosures need to be amended. Anyone?

Also- there is no way a regular consumer is going to understand what the VISA disclosure means. I don't even understand it! What I do get is before a customer had zero liability with a VISA debit card and now if they don't sign for it, they don't. I think that is an increase of liability to the consumer that would trigger a Reg E notice - right????

But can it increase a customer's liability beyond Reg E? I don't think so.

Maybe I am thinking this through too much. Right now we have amended our debit card application and purchased an annual notice (which is the document I don't think any normal person will understand), if that is all we need to do -that would be great!!

So just so I am sure I am following the pack - no one is amending their Reg E disclosure because the Reg E liability has not increased, correct?

Does any of this apply to MasterCard branded debit cards?

This is all Visa. I am not aware of similar or other MC change requirements.

Visa states their Zero Liability Rules do not apply to ATM transactions, PIN transactions not processed by Visa, or certain commercial card transactions. What exactly does "PIN transactions not processed by Visa" mean? Are any PIN based transactions processed by Visa?

I always thought signature based Visa debit card transactions received Visa protections, but PIN based did not. Are there exceptions to this?

Thank you.

Visa operates their own PIN Network - Interlink for PIN Debit transactions and Visa/Plus for ATM transactions. If the PIN transaction is flowed through Interlink, the PIN Debit transaction is protected under Visa's Zero Liability. If the transaction is processed through Star, NYCE, Pulse or any of the other Debit Networks it is not covered.

Well, that is what I was starting to think, but I received the following in an email from Visa's Account Support Center today (we use the Interlink Network):

"PIN based transactions would be going through the Interlink Network, not Visa's. Therefore, may not receive the Visa-associated protections and benefits such as Zero Liability and dispute resolution. Signature based transactions would be protected under Visa's consumer protections and benefits."

Now I'm really confused. In searching Visa's website and cannot find anything that clears this up.