Blog

  • Website Compliance: The Secret To Getting Approved For Payments

    Website Compliance: The Secret To Getting Approved For Payments

    Merchants, just how familiar are you with website compliance? From PCI compliance to privacy and shipping policies to terms and conditions to pricing disclosures. These are a few enforcements that come to mind when setting up an online business.

    A lack of knowledge about website compliance can cost you a lot of money. It can also be time consuming and confusing to adhere to these types of policies. Worse, your merchant application could be declined, because your website is not compliant or secure.

    Payment processors conduct periodic reviews of merchant websites. Thus, merchants can face penalties for not adhering to the latest standards. For example, a processor may freeze your account or terminate your agreement.

    In this blog post, we’ll review full-proof ways to ensure your website is compliant. We will also help you avoid common mistakes that can cost you dearly. Website compliance should be top of mind to ensure you’re operating legally and within the norms expected by your payment provider. It doesn’t matter if you’re a start-up or a seasoned online seller.

     

    PCI Compliance

    PCI DSS compliance is a big deal! Of utmost importance is ensuring you’re protecting customer data. And, coupled with an SSL certificate for your finished website. Data leaks occur during a breach or ignoring crucial security patches in your software or WordPress platform. You are responsible for customers data leaks. This is regardless of your intention.

    Thus, take every measure to ensure your network infrastructure. Additionally, update all software to prevent vulnerabilities. Encrypt hosted checkout pages with a minimum 256-bit encryption standard. Also, check that your checkout page is using TLS 1.2 or higher, particularly to guard any data sent to your gateway.

    Does this all sound Greek to you? Contact your payment or gateway service provider for requirements on your checkout page. If you prefer not to deal with this, you can decide to use a hosted page provided by your payment processor.

    Most merchants avoid this. It tends to lead to lower conversions, because buyers get redirected to another page to enter payment info. Building a secure order page will serve you well. It will also ensure access to your customers’ data for future marketing purposes.

    ASV scans and SAQ questionnaires

    While building your website, you can use an approved ASV scanner. This will scan your website. I can list all potential vulnerabilities you can fix before going live. A quarterly scan will ensure you are doing your best to stop data breach threats. The PCI council has a list of approved vendors.

    Scans are inexpensive and fast. Performing one shouldn’t be an issue for your business. The PCI council offers self-assessment questionnaires based on a merchant’s exact business case. They can serve as a guide for what’s needed to ensure your website is secure and compliant according to most recent data standards. At first, each questionnaire asks a few simple questions to learn which PCI self-assessment questionnaire is right for you.  In our experience, most merchants providing goods or services online use the SAQ-A or SAQ-A-EP questionnaires. A full list of questionnaires are available here.

    website compliance checklist

    Website Compliance Cheat Sheet

    So, you apply for a merchant account. But, as you’re ready to start trading and gearing to go live, your application is declined. Payment providers often reject applications due to website compliance issues without further explanation. Most of the larger third-party providers like Stripe and PayPal decline applicants with little information.

    Ensure your website is fully compliant. Acquirers or payment facilitators like Stripe go through a rigorous compliance checklist to ensure your website is secure. Use the following as a reference before applying for your next merchant account.

     

    Page footer

    Your page footer should remain static through the customer experience to ensure customers can navigate to legal and regulatory facts about your website and business at any time. As such, ensure to have the following five elements in your website’s footer.

    1. Terms and conditions

    Gone are the days of copying another website’s terms and making them your own. Underwriters review and read these to ensure they make sense and are applicable to your website and business model. This doesn’t have to cost you thousands. Many legal websites can provide a quick and personalized terms sheet for your business. It’s important to include product pricing, company name and address as well as legal jurisdiction within your terms and conditions.

    2. Privacy policy

    Your customers’ data is valuable and important. Ensuring its security and not sharing it with external parties should be imperative for you. Shared information should be limited to parties fulfilling customer orders. Outline steps you take to ensure your customers’ privacy is protected and explain the laws you are following depending on your jurisdiction. Remember, if you have European customers, the laws are stricter than North American ones and you will need to abide by GDPR for all your European customers even if your company is not within the EU. Here’s a quick guide to GDPR standards

    3. Customer support

    Having a link that can easily allow your customers to reach out to you will build loyalty and lower your risk of chargebacks. A win-win! Make sure your customers can find how to reach out to you easily and through various communication methods such as phone, email, chat, Skype or even what’s app!

    4. Shipping policy and returns

    Give consumers confidence in knowing that buying from you is safe and their satisfaction is important to you. Providing a minimum of 30 days to return a product should be standard practice. Customers need time to receive, try out and return your product. In fact, longer return periods help in increasing consumer loyalty and sales. This is because customers feel less pressured to make a decision and may eventually forget to return the item. It’s important to include the standard delays your customers should expect to receive their package, whether you’re shipping locally or internationally. Test your fulfillment channel to avoid surprises that trigger chargebacks should customers not receive their products in the delays you quote.

    5. Company name and mailing address

    In every website footer always display your company name and mailing address at the bottom of your page. This information should match your company’s registration information.

     

    Checkout Page

    Your checkout page should include the following elements:

    • Clear and descriptive pricing above the buy now button.
    • Ensure you detail all terms of purchase. And, if you have any recurring charges be very clear on when and how much the customer will be charged. Visa is updating its policies for free or discounted trial subscription merchants. So, read more from our previous post on how to prepare.
    • State the currency for international sales. Chargebacks can occur because of a misunderstanding as simple as a specific dollar amount. The $ sign is commonly used in the US, Australia and Canada. But, $60 in USD is not the same CAD.
    • A checkbox, as customers must click to accept the terms and conditions, and price of your product.
    • A descriptor that states what customers will expect to see on their credit card statement. Make sure there is no confusion upon seeing a charge.
    • Credit card network logos, security badges and other trust symbols.

     

    After-sales support

    Once your customer buys your product, you’re done with the sale process, right? Nope! After-sales support and communication is part of your compliance requirements. This includes the following:

    • Provide customers with a transaction receipt by email. Include all important details they need including tracking numbers, shipping delays and, of course, a link to your contact information. As of April 2020, Visa will enforce merchants with a subscription product or service to provide customers a link where they can easily cancel. A merchant must communicate to their customer at least seven days prior to charging the subscription fee. This is regardless of whether you’re selling supplements, a digital info product or a dating membership, for example.
    • Ensure your customers can call and talk to a support agent most hours of the day. If you’re located in the US, but most of your customers are European, adjust your hours of operation. Also, offer email and chat support with reasonable delays for responses.

    No matter how big or small your business is, data breaches can be costly, because of potential fines and loss of customer trust. Follow the tips above and work with a reputable merchant account provider such as DirectPayNet.

    As experts, we help ensure you’re adhering to website compliance standards. You will receive invaluable advice to keep your business safe. Contact us today to discuss PCI and website compliance.

  • 5 Must-Haves For A New (And Not So New) Online Subscription Business

    5 Must-Haves For A New (And Not So New) Online Subscription Business

    The future is bright for subscription business merchants in any vertical. In turn, more entrepreneurs need reliable payment processing solutions. And, demand for independent merchant accounts keep increasing.

    According to US-focused research by Clutch.co “More than half of online shoppers (54%) say they subscribe to a subscription box service.” This reflects how lucrative the subscription box e-commerce market is in North America. But it’s not only subscription boxes. Global entrepreneurs are finding great opportunities from all types of subscribers. The market includes subscriptions for info products, and goods in health and wellness. Plus, let’s not forget services like software licensing and gaming.

    Have you run an online business before? If so, you will know about the challenges finding a payment solution. For one, securing a merchant account isn’t as easy as it appears. It’s harder if your business model is high-risk. And, it’s doubly difficult if you’re a foreign merchant applying for a solution beyond your borders. As many discover, targeting customers in a different country or region is not as easy as it sounds.

    Subscription ventures anywhere in the world need a robust payment solution. The reason for this is because payments occur on a recurring basis. Recurring transactions are higher risk. And, they are more complex compared to your run-of-the-mill, low-risk online offer. Thus, if you’re a subscription merchant reading this blog, you need more reinforcements for your company.

    You must have at least one of the following in place before you get approved for merchant processing. It doesn’t matter if it’s your first, second or third merchant account application.

    1. proper legal structure
    2. proper financials
    3. excellent website compliance (relevant licenses and agreements signed and in place)
    4. diverse marketing campaign
    5. fraud prevention plan

    With the above in mind, here’s our recommendations for subscription merchants. The advice below will make sure your next merchant account application is approved. Plus you can quickly start scaling.

     

    Must-have #1 for a subscription business: a proper legal structure

    This must-have is aimed at readers in two specific categories. The first are those who have yet to even create their subscription company. The second are those who are applying for offshore processing for their subscription company. If neither applies to you, feel free to skip to must-have #2.

    Some startups come to us registered as a sole proprietor or general partners. There is nothing inherently wrong with this type of legal structure. But most payment providers won’t accept it.

    Acquiring banks and payment providers want little liability. So, establish a more favorable setup like a limited liability company or a corporation for your business. In both cases, the liability is further removed from you, the owner.

    For foreign merchants targeting buyers offshore, do your homework. For example, a subscription merchant (or any vertical for that matter) based in Australia or Hong Kong, cannot get a US merchant account remotely by simply registering a business only. The following is required:

    • A legally registered corporation in the US.
    • A local director or shareholder who is a resident of the US. They must serve as the authorized signer for your registered business in the US and submit their social security number on the merchant account application.
    • A business (not a personal) checking account in the name of the company you created. Yes, your local director or shareholder must be the authorized signer.

    Your domestic or offshore merchant account has a higher chance of approval with a rock solid legal corporate structure. There must be a clear way to identify the ultimate beneficial owner (UBO). A structure with multiple layers may help with tax planning, but makes obtaining a merchant account more strenuous. Ultimately, acquirers want the name of a person who owns the company.

     

    Must-have #2 for a subscription business: proper financials

    A solid banking and processing history for your subscription business enhances your chances of getting a “Yes” for your next merchant account application. If you’re a seasoned online entrepreneur, you know what this means.

    Banking history

    Your company’s designated director will also be the authorized signer on the merchant account application. The beneficiary and company name for the bank account must reflect the same information found in a legal business entity and on your tax forms. Without this, it’s a nightmare for acquiring banks. Servicing you without this information means they are violating AML (anti-money laundering) laws.

    Sometimes entrepreneurs from foreign countries are desperate for merchant processing. In their efforts, they set up a business online abroad without a bank account. Then they’re disappointed to learn they need a local director and a bank account that must be based in the region where they want processing. And, don’t get us started on payment aggregators. As we have previously advised on the DirectPayNet blog, this is not a good solution.

    For example, if you are based in Malaysia, it may be tempting to just find a payment aggregator for your US traffic. But, don’t do it! There are several reasons why. Mainly, it’s a fast way to getting your processing channel terminated.

    There are good reasons you need a bank and an independent merchant account in your target region or country:

    • It will increase your chance of being approved by the payment provider.
    • You will have a higher transaction approval rate on domestic traffic. These orders will be recognized by a local financial institution and it will cost less per transaction.
    • When applying for an offshore merchant account, displaying a positive processing history – even if it is from a different region – can be helpful in getting an approval.

    Getting a bank account in North America remotely is nearly impossible. A business and bank account must be registered in the same country. The business information as well as the director of the company must match also. Often, non-US business owners like to use e-wallets. This is a big no-no, especially in North America.

    During the approval process a bank does a credit check on the owner or the director. They will be looking at your credit and financial history to ensure you are a reliable business owner and pay your bills on time. What exactly will they be looking for? Normal business transactions. For example, a payment to a fulfillment company. Commission payout to an affiliate or marketing agency.

    And, the bank will feel a lot better if they see some money in your account. Your balance should not be below $5000 if you are asking for the ability to process monthly sales of $25,000 or more. Also, the lead time to getting paid by your payment provider won’t happen overnight. So, it’s best to shore up some working capital. This way your operations won’t stall.

    Processing history

    Many subscription box business start-ups don’t have much money. They operate with a “sell first, order later” philosophy. This makes getting a merchant account approval challenging, especially a new business. All the more reason why you need processing history to complement your bank history.

    Processing history in the majority of cases is a must for getting a merchant account. We know that startups find this frustrating. How do you get processing if you need to show processing history?

    If you happen to have some, great. Always have your last three calendar months of statements ready to show. It’s what will help get you approved to process that sales volume of $100,000 per month you’re requesting.

    If you don’t have processing history for your subscription business, this is where having good credit will help. Your credit history is always reviewed as part of your application. And if the numbers look right, that can help get you approved.

    payment advice for subscription merchants

    Must-have #3 for a subscription business: excellent website compliance

    Customer subscriptions are serious business. Users trust you when they are entering confidential information into your system. These details is very attractive to hackers. Especially credit card numbers, personal emails and security questions. Don’t let information like this be compromised. Or, your company will be slapped with fines or a lawsuit. Thus, the level of security (or lack thereof) in your business matters.

    For this reason, always ensure your website is secure and meets PCI DSS compliance standards. Does your website have an SSL or TLS certificate? Have you retired all test login credentials? Do only select authorized individuals in-house have access to customer data?

    PCI DSS compliance is a must for any online subscription business. This is especially true if you collect and store credit card data or use third-party tools to do this.

    Be transparent about what you’re selling

    Besides having a secure website where potential customers won’t doubt buying your product or service, you need to be transparent. Particularly about fees you will charge them.

    For example, let’s say you launch a coaching business offering relationship advice. Imagine you’re selling six-month courses or workshops at $19.99, $69.95 and $129.99 per month. The monthly subscriptions include a 14-day trial. With it comes two-week access to a member’s area. Naturally, a potential client might think the trial is free. But you must tell buyers about any upfront fees they must pay as well as any future monthly charges.

    Do not be deceptive. Like charging a user’s card for a small fee of $9.99 and then charging an extra $10 on day 15 if they don’t cancel. Tell potential clients about rates and fees before they checkout. Besides, credit card networks have unique rules all merchants must follow. If you offer trials, you must adhere to those regulations.

    In April 2020, Visa will enforce new rules for subscription merchants. Read more about the changes that will affect your business here.

    Terms and conditions, and licenses

    Subscription merchants should have relevant licenses and agreements on hand. For example, if your product is a US-based software licensing service, be ready to show licensing agreements and similar supporting documents to your provider.

    Additionally, website compliance is next to godliness. A rock-solid terms and conditions page, plus detailed user and/or cancellation policies are crucial.

    In a nutshell, pay attention to security and compliance. Ensure you’re not violating any laws enacted by the FTC or similar government agencies.

     

    Must-have #4 for a subscription business: diverse marketing campaign

    Some online merchants put the carriage before the horse. They sign up for a payment solution before having a marketing plan in place. Merchant account providers expect to see approved merchants generate revenue within 30 days of going live. So, you should be reaching close to $20,000 in your first or second month of operation if your requested monthly limit is $50,000.

    Get the traffic to your site before you get a merchant account. You need to get traction quickly, because dormant activity can get you penalized or shut down. You should be launching your first test for a new Facebook campaign before you get approved.

    Another mistake some merchants make is only using one marketing channel to drive traffic. Have you read the news lately? Google has plans to phase out third-party cookies. Also, as we’ve mentioned before on our blog, Facebook Ad compliance is growing more complex.

    Essentially, don’t put all your eggs in one basket. Don’t solely rely on an affiliate program. Or, strictly sticking to Facebook ad campaigns. Always diversify your marketing campaigns.

     

    Must-have #5 for a subscription business: a fraud prevention plan

    Successful subscription merchants have a fraud prevention plan to guard against risk. If you haven’t done this, put one in place today.

    Merchant account providers dislike high chargeback ratios. Specifically, anything above the latest thresholds set by credit card networks (e.g. Visa reduced ratios from 1% to 0.9%). If you’re already processing orders online, you may know about this. And, if this type of fraud is affecting your merchant account, act now. Avoid getting suspended or terminated processing. It is detrimental if you’re in the middle of scaling.

    Anti-fraud tools are at your fingertips. Features are in your gateway, CRM and shopping cart. With a few rules you can block high-risk countries from purchasing your product. You can install software to detect unusual activity. For example, when a user changes their IP. Or, their real-time location does not match their billing address.

    Worried about chargeback fraud? Make a signature upon delivery a rule. And, if chargeback volumes worsen use 3D-secure to authenticate orders at your checkout. Furthermore, add reactive fraud tools like Ethoca and Verifi. They can detect if a customer will issue a chargeback.

    Additionally, always keep an eye on affiliates. If the return on your affiliate marketing isn’t profitable, then perform an audit on your program. Remove dormant affiliate accounts. You shouldn’t work with questionable partners referring sales with low conversion or high refund rates.

    If you’re not sure about how to prevent affiliate, chargeback or any type of fraud, reach us for a consultation.

     

    A final word for startup subscription merchants

    Be realistic about your payment needs when launching an online offer. In our experience, a lot of newcomers have a lot of misconceptions. This leads to unrealistic demands for processing, when nothing has been delivered.

    Here are a few unrealistic requests we’ve heard of from time to time:

    • I want pricing at 2% or less
    • Can I get next day payout?
    • Can they remove the reserve?
    • I need an account to process $100,000 per month

    An acquiring bank won’t entertain the above. The only exception is if you have business or personal financials to back up the request. Here’s the reality. You’re a new business. So, you’re at the mercy of merchant account providers, especially ones who deal with high risk. There’s no room for negotiation until you show them the money.

    It’s hard to negotiate without any proof of your business’s ability to scale. So, try not to demand things like a high monthly volume (e.g. $50,000), a lower reserve, and don’t try to negotiate unrealistic fees. With DirectPayNet on your side, we will show you the right strategy to eventually getting your wish list.

     

    Make your next move a profitable one

    We hope the above information was helpful to you as the owner of a subscription business. These are key items whether you’re applying for your first merchant account or diversifying your banking. So, make sure you have the right mindset and strategy in place before you apply for your next merchant account.

    Are you or someone you know running a subscription business in need of a payment solution? Email the DirectPayNet team with your questions and we’ll answer in 24 business hours or less.