Treatment of Captured Payment Cards in Automated Teller Machines (ATMs) Directive

BANK OF GHANA Treatment of Captured Payment Cards in Automated Teller Machines (ATMs) Directive for Banks and Specialised Deposit-Taking Institutions (SDIs) 29 JUNE 2021 BANK OF GHANA E S T. 1 9 5 7

1 Contents Title ...........................................................................................................................................................2 Application............................................................................................................................................2 Interpretation........................................................................................................................................2 Objectives..............................................................................................................................................3 Conditions for Payment Card Capture on Automated Teller Machines.............................3 Lodging a Card Capture Complaint.............................................................................................5 Retrieving Captured Cards...............................................................................................................5 Conditions for Releasing Captured Cards – Acquirer...............................................................6 Conditions for Releasing Captured Cards – Issuer.....................................................................8 Conditions for Destroying Captured Cards..................................................................................8 Conditions for Transferring Captured Cards to Issuer................................................................9 Replacement or Enabling of Captured Cards..........................................................................10 Internal Policies and Procedures on Card Capture ................................................................10 Penalties for non-compliance........................................................................................................11

2 Title

1. This Directive may be cited as Treatment of Captured Payment Cards in Automated Teller Machines (ATMs) Directive. Application
2. This Directive is issued pursuant to Section 92 of the Banks and Specialised Deposit-Taking Institutions Act, 2016 (Act 930) and shall apply to Regulated Financial Institutions:
3. This Directive, shall apply to all Payment Cards used on an Automated Teller Machine located within the country. Interpretation
4. In this Directive, unless the context otherwise requires: “Acquirer” means an entity that provides an Automated Teller Machine and signs on a merchant or disburses currency to a Card Holder or customer in cash disbursement and directly or indirectly enters the resulting transaction receipt into interchange. “Automated Teller Machine” means an unmanned electronic device or equipment that enables an individual to undertake remote financial transactions with a payment card. “Card Reader” means a component of a payment device that reads data from a payment card. “Card Holder” means an individual or company issued with a payment card that is linked to an account at a licensed financial institution. “Issuer” means an authorised financial institution or licensed entity that makes payment cards available to Card Holders.

3 “Regulated Financial Institution” means an institution licensed by the Bank of Ghana that operates an Automated Teller Machine and or issues Payment Cards. “Session Timed Out” means the event or break in transaction that occurs as a result of a Card Holder exceeding a time interval allowed to undertake an Automated Teller Machine Card transaction. “Payment Card” means a device or card that can be used by its holder to pay for goods and services or to withdraw money from an Automated Teller Machine. Objectives 5. The Bank of Ghana seeks to address the perennial complaints that emanate from the capture of Payment Cards at Automated Teller Machines of Regulated Financial Institutions. The objectives of this Directive are therefore to: (a) Provide for standard procedures in retrieving Payment Cards captured by Automated Teller Machines and (b) Prescribe conditions for releasing, transporting or destroying Payment Cards captured by Automated Teller Machines. Conditions for Payment Card Capture on Automated Teller Machines 6. An Automated Teller Machine may capture a Payment Card where: (a) A wrong Personal Identification Number (PIN) is entered more than the permitted number of times by a customer during an Automated Teller Machine transaction;

4 (b) There is a technical issue including but not limited to power outage, network challenge and malfunction of the Automated Teller Machine; (c) A Payment Card is forgotten in an Automated Teller Machine card reader after an Automated Teller Machine transaction; (d)A session has been timed out during an Automated Teller Machine transaction; (e)A Payment Card has been flagged as “Card Capture”, “Stolen Card”, “Lost Card” or any other status that has been parameterised by an issuer for which a Payment Card may be captured; (f) An expired or damaged card is used on an Automated Teller Machine; and. (g)A card that appears to be fraudulent including plain cards, cardboard cards etc. 7. All Payment Cards captured for reasons provided in Paragraph 6 (a) and (e) above and shown on the Issuer’s Host shall be blocked or disabled by the issuer. In the Case of Payment Cards captured for reasons provided in Paragraph 6 (g), an acquirer or issuer may report and release the Payment Card to law enforcement agencies. 8. An issuer may notify a Card Holder whose card has been captured by an Automated Teller Machine through a Short Messaging Services (SMS).

5 Lodging a Card Capture Complaint 9. An issuer shall provide reliable avenues for Card Holders to report issues of card capture and card blockage request. 10. A Card Holder whose card has been captured by an Automated Teller Machine may lodge a complaint with the acquirer or the issuer and provide all relevant information to assist in identifying the Card Holder. 11. The information to be presented by the Card Holder for the purposes of identification may take the form of one or more of the following; (a) valid national identification card; (b) valid driver’s licence; (c) Valid Passport (d) valid SSNIT ID or; (e) valid voter identification card. 12. An acquirer or issuer shall inform a Card Holder of the timelines and procedures for reclaiming a captured card. 13. Where an acquirer is unable to release a captured card to a Card Holder due to the acquirer’s inability to authenticate the Card Holder, the acquirer shall notify the Card Holder of its decision to transmit the card to the issuer. Retrieving Captured Cards 14. Onsite Automated Teller Machines (ie. ATMs sited at the premises of regulated financial institutions) shall be checked for captured cards at least once every working day. Offsite Automated Teller Machines (ie. ATMs not sited at the premises of regulated financial institutions) shall be checked for

6 captured cards on regular basis. This activity shall also be carried out during regular Automated Teller Machine cash replenishment or maintenance. 15. An acquirer or issuer shall retrieve a captured card from an offsite Automated Teller Machine within forty-eight (48) hours after a complaint of the capture has been reported by the Card Holder. 16. An acquirer or issuer shall employ adequate security measures to protect the card information including adopting dual control mechanisms to retrieve and log captured cards from the Automated Teller Machine. 17. An acquirer or issuer shall train staff responsible for retrieving captured cards from Automated Teller Machines. 18. A Captured card retrieved from an Automated Teller Machine shall be adequately secured pending action to be taken over the captured card. Conditions for Releasing Captured Cards – Acquirer 19. An acquirer’s decision to release a captured card to a Card Holder shall be based on the following minimum conditions: (a)The Automated Teller Machine that captured the card is located onsite or offsite of the banking premises of the acquirer. (b)The Card Holder made a complaint to the acquirer within two (2) working days, after the card was captured by the Automated Teller Machine. (c) The Card Holder is able to provide required documents requested by the acquirer to authenticate the Card Holder. This shall include any of the means of identification provided in paragraph 11.

7 20. A Card Holder shall be made to sign a receipt of collection whenever a decision is made by the acquirer to return a captured card to a Card Holder. 21. Where in doubt or upon advice of an issuer, an acquirer shall withhold the card from the Card Holder. The acquirer shall notify the Card Holder of its decision to transmit the card to the issuer. 22. An Acquirer shall retain all relevant documentation on the captured card including the delivery of the captured card to the Card Holder for a period not less than six (6) years from the date the captured card was retrieved. 23. Notwithstanding the conditions in Paragraph 19, an acquirer shall not release a captured card to a Card Holder if the reason for the capture was the provision of wrong Personal Identification Number (PIN) more than the permitted number of times or for cards flagged as “Card Capture” or on suspicion of a fraudulent card. 24. An acquirer shall ensure that it maintains adequate protocols to safeguard the captured card information prior to delivery to the Card Holder. The acquirer shall take note and document all persons that come in contact with the captured card prior to delivery to the Card Holder. 25. Provided that an acquirer follows due process in releasing a card to a Card Holder, an Acquirer shall not be liable for any loss resulting from fraudulent or unauthorised transactions initiated with a card after the captured card has been released to the Card Holder.

8 Conditions for Releasing Captured Cards – Issuer 26. An issuer shall, within twenty-four (24) hours after a Card Holder has made a complaint to that issuer (or the following working day in the case of a holiday or weekend); take adequate steps to identify a Card Holder whose card has been captured by an Automated Teller Machine belonging to the issuer. 27. An issuer shall release to a Card Holder, a captured card transferred to the issuer by an acquirer, if the issuer believes without a reasonable doubt that the security of the captured card has not been compromised. 28. An issuer shall ensure that it maintains the necessary protocols to safeguard a captured card information prior to delivery to the Card Holder. 29. An issuer shall take note and document all persons that come into contact with the captured card prior to delivery to the Card Holder. 30. An issuer in releasing a captured card to a Card Holder shall take into consideration the location or branch the Card Holder may prefer to collect a captured card. 31. Provided that an issuer follows due process in releasing a card to a Card Holder, an Issuer shall not be liable for any loss resulting from fraudulent or unauthorised transactions initiated with a card after the captured card has been released to the Card Holder. Conditions for Destroying Captured Cards 32. An issuer shall block/deactivate and destroy a captured card if a Card Holder does not request or collect the captured card within two (2) working days after the date of capture by the Issuer’s Automated Teller Machine or when the captured card was received from the acquirer.

9 33. An acquirer shall destroy a captured card if it reasonably suspects that the captured card may have been compromised. 34. An acquirer shall destroy a captured card where it receives documented instructions from the issuer to do so. 35. An acquirer shall notify the issuer upon destruction of a captured card. The minimum information to be provided shall include the date of card recovery and destruction, location of card recovery, Bank Identification Number (BIN) and last four (4) digits of the Primary Account Number (PAN), name of the Card Holder and reason for the destruction. 36. An acquirer or issuer shall maintain records of destroyed cards for a period of not less than six (6) years. 37. For the purpose of this Directive, the process for destroying the cards shall include shredding or cutting through cards along the chip and magnetic strip area such that cards cannot be reconstructed. Conditions for Transferring Captured Cards to Issuer 38. Where a card has been captured by an Automated Teller Machine, for the reasons specified in Paragraph 6 (b), (c), (d), (f) and the acquirer is unable to authenticate ownership of the captured card, the acquirer shall transfer the card to the issuer. 39. An acquirer shall use secured means such as tamper evident bags to securely transfer a captured card to the issuer.

10 40. A captured card shall be transmitted to the issuer within two (2) working days after the captured card has been retrieved from an Automated Teller Machine. 41. An acquirer in transmitting a captured card to an issuer shall in addition to the card include a copy of the Automated Teller Machine journal indicating the reason for the capture. Replacement or Enabling of Captured Cards 42. An issuer shall not charge a fee for the replacement of cards captured by an Automated Teller Machine for reasons specified in Paragraph 6 (b), (c) and (d). 43. An issuer shall not charge a fee for enabling a disabled or blocked captured card. 44. An issuer shall enable a captured card within two (2) working days after a request has been made by the Card Holder. Internal Policies and Procedures on Card Capture 45. An acquirer or issuer shall establish and implement internal control policies and procedures in managing captured cards including procedures for ensuring the protection of captured cards, releasing of cards to Card Holders, transfer and destruction of captured cards. 46. An issuer shall disclose all necessary information regarding the capture of Payment Card at the point of application of an Automated Teller Machine card.

11 Penalties for non-compliance 47. A Regulated Financial Institution in breach of the provisions of this Directive shall be liable to an administrative penalty of not less than two thousand (2000) penalty units and not more than ten thousand penalty units in accordance with Section 92 (8) of Act 930. 48. Notwithstanding the penalties specified in Paragraph 47, the Bank of Ghana may impose any other penalty or take any remedial action that the Bank of Ghana considers appropriate in accordance with Section 102 of Act 930.