SECTION 2 Operating Rules and Regulations without the prior written permission of CO-OP Financial Services. All Rights Reserved
ATM OWNER DUTIES & RESPONSIBILITIES ATM, Kiosk and other EFT-related Device (collectively ATM) Owners shall have the following responsibilities: 2.1 ATM SHARING A. Except as determined by CO-OP Financial Services in its sole discretion, only CO-OP Network Member Institution owned, operated or controlled ATMs may participate in CO-OP Network and those ATMs that are owned, operated or controlled by CO-OP Network Member Institutions that participate in a shared network must participate in CO-OP Network. All Shared Branch transactions conducted at an ATM that are acquired and processed within the CO-OP Network are subject to Shared Branch Rules and Regulations of the applicable shared branch network and are not governed by these ORRs. B. Each ATM Owner shall cause its shared ATMs to be operated in such a manner that all such ATMs accept all qualified cards that comply with Section 3 of these ORRs. C. ATM Owner shall execute an agreement with CO-OP Financial Services and shall provide in writing to CO-OP Financial Services the location, together with related supplementary data required by CO-OP Financial Services, for each ATM owned or operated by the ATM Owner to participate in CO-OP Network. ATM Owner will be responsible for informing CO-OP Financial Services of any such updated information related to each ATM. Each ATM participating in CO-OP Network shall have, at a minimum, the functional capabilities as specified in these ORRs. The ATM Owner shall make all of its ATMs, which are generally available for public access, available to CO-OP Network users, unless the ATM is exempted by written agreement from CO-OP Financial Services, in its sole discretion. D. The ATM Owner shall provide advance written notice to CO-OP Financial Services of any change in the services at its ATMs at least ten (10) Credit Union Business Days prior to the effective date of the change. E. CO-OP Financial Services will make a reasonable effort to update its public records with the change in services available at ATMs. The removal, addition, or modification of service provided by an ATM is generally within the control of the ATM Owner and CO-OP Financial Services is neither responsible nor liable to a Card Issuer or the ATM users for the discontinuance or modification of an ATM service at any particular location. F. If a Card Issuer, now or during the term of the Agreement, owns or controls an ATM which receives On-Us (Card Issuer's) deposits, and is accessible by the public or is in a shared environment, the Card Issuer agrees that the ATM shall receive CO-OP Network deposits. An exception may be granted, by CO-OP Financial Services in its sole discretion if the Card Issuer does not participate in the CO-OP Network shared deposit environment, and the Card Issuer s Cardholders do not have deposit access at any CO-OP Network ATMs. All provisions under the Agreement and in these ORRs related to an ATM Owner are applicable to the Card Issuer who participates as an ATM Owner in the shared deposit environment. REVISED 03/18 Page 15
G. An ATM Owner may submit a written request to exclude a specific device from CO-OP Network Deposit Program when both of the following reasons apply: 1. Restricted area; and 2. Device does not accept On-Us deposits. H. If a Member Institution is not an Issuer in CO-OP Network Deposit Program, participation is optional as an Acquirer; however, if the credit union participates in any shared deposit network, participation in CO-OP Network Deposit Program is mandatory. I. By October 1, 2017, each ATM equipped with a Chip reading device that meets the applicable EMVCo compliance standards, must be capable of initiating a CO-OP Network transaction by reading the Common U.S. Debit AID from a Chip if: 1. Such Application Identifier (AID) is present; and 2. Such CO-OP Network ATM is capable of processing, through another debit network, transactions initiated in the U.S. with a Chip. By October 1, 2017, ATM Terminals that are not equipped with a Chip reading device are liable for CO-OP Network ATM transactions that are disputed as counterfeit fraud if the CO-OP Card is embedded with a Chip. 2.2 DISPLAYING CO-OP NETWORK ATM MARKS Each ATM Owner shall display CO-OP Network ATM Marks on its ATMs in accordance with CO-OP ATM Graphic Standards within forty-five (45) Credit Union Business Days of the ATM Owner's live date in CO-OP Network. A. The CO-OP Network brand mark must be at least the same size and no less prominent than any other brand mark on the terminal, with the exception of the proprietary mark of the Member Institution itself. B. The CO-OP Network brand mark may be located in more than one location on the machines as needed to identify the capabilities of the machine (e.g. deposit-taking, check imaging) and Network. CO-OP Financial Services recommends using all available ATM signage to identify each capability of the terminal to the cardholder. C. It is recommended that the CO-OP Network brand mark be placed at the upper-left position in horizontal signage and the top-left position in vertical signage. If this position is occupied by the Member Institution s brand mark, then it is recommended that the CO-OP Network brand mark is to be placed in the next prominent position. D. All CO-OP Network brand marks and signage must be removed from all ATM terminals within fifteen (15) calendar days of termination/resignation in CO-OP Network. 2.3 TYPES OF TRANSACTIONS Each ATM Owner shall ensure that its ATMs are capable of processing the following transactions for CO-OP Network Card Issuers: A. Deposits to share and share draft accounts; B. Cash withdrawals from share, share draft and credit accounts; C. Balance inquiries to share, share draft and credit accounts; REVISED 03/18 Page 16
D. Transfers to and from share and share draft accounts; and E. Reversals. ATM Owners who, as Card Issuers, are processing On-Us Transactions at their ATMs for their own members, may provide a unique set of transactions.2.4 CHAINING Each ATM Owner shall ensure in instances where a Cardholder requests more than one transaction, that either the card is retained by the terminal until completion of the final transaction (insertion type card reader), or a separate PIN entry is required for each transaction. 2.5 KEYBOARD REQUIREMENT Each ATM Owner shall ensure that its ATMs have an alphanumeric PIN keyboard that complies with ANSI specifications. Each ATM must be capable of allowing entry of PINs having four (4) to twelve (12) characters. 2.6 PIN ENCRYPTION Each ATM Owner shall ensure the following with respect to processing CO-OP Network transactions. Each PIN, after entry into an ATM, must be encrypted using Triple DES technology in accordance with the CO-OP Network Triple DES mandate issued February 2003. Initial PIN encryption must be performed within a secure hardware device without the use of software at the ATM. The PIN must always remain encrypted until it reaches CO-OP Network, and any translation of the PIN by the Terminal Processor, including any translation at the Terminal Processor's host computer, must be performed within a secure hardware device, without the use of software. All keys by which PINs are encrypted must be generated in a secure manner and management of encryption keys must meet the standards as set by the American National Standards Institute; ANSI X9.8-1982; X3.92-1987 and X9.24-1992. At a minimum, all encryption keys must be subject to Dual Control and Split Knowledge. If there is a known or suspected compromise of an encryption key, internal escalation procedures must be followed and the encryption key must immediately be changed. An ATM Owner is responsible to maintain its ATM encryption keys in a secure manner that is consistent with dual control and Split Knowledge. A unique encryption key per device is required. PINs must be encrypted with unique keys and that dynamic key exchange must be implemented between processing nodes, assuring that zone working keys are used for no more than one processing day. This adds to the operating life span of a Data Encryption Algorithm by increasing the cryptographic robustness of the algorithm. The Data Encryption Algorithm is a secret key, symmetric encryption method that uses the same secret 56-bit key to encrypt and decrypt a message. 2.7 PIN VERIFICATION Each ATM Owner Shall Ensure That Each ATM equipped with a Chip reading device that it owns, operates, controls or sponsors is operated in such a way that a CO-OP Network Transaction initiated with a Chip card must use online PIN as its Card Validation Method. 2.8 MESSAGE FORMAT REVISED 03/18 Page 17
Each ATM and ATM system must be capable of transmitting messages in the format as specified in CO-OP Network technical specifications. 2.9 AUTHORIZATION OF TRANSACTIONS All ATMs and ATM systems shall be operated in such a way that no network transaction may be effected without receiving authorization from the Card Issuer or receiving authorization from CO-OP Network (using established authorization parameters). 2.10 RECEIPT REQUIREMENT A. It shall be the ATM Owner's responsibility and not the Card Issuer (if different from the ATM Owner) or CO-OP Network to ensure that each ATM, upon completion of an authorized transaction on CO-OP Network involving a cash withdrawal, deposit or other electronic funds transfer, makes available to the Cardholder a receipt that complies fully with all applicable state and federal laws and regulations, including, but not limited to, Reg E for Debit products and Reg Z for Credit products and includes, but is not limited to, the following information: 1. The amount of the transaction; and, if a surcharge applies, the amount dispensed to the Cardholder; 2. The transaction date; 3. The type of transaction; 4. The type of account accessed; 5. Include only the last four digits of the primary account number (PAN), replacing all preceding digits with fill characters such as x, *, or # (do not use blanks or non numeric characters); 6. The ATM location or Terminal ID at which the transaction was initiated; 7. The trace number (if available); 8. The transaction time; 9. The remaining balance in the account accessed, if such balance information is provided by the Card Issuer; 10. The amount of any surcharge levied on or paid by the Cardholder must be listed as a separate item and labeled using the word Fee preceded by an acronym or other label identifying the ATM Owner levying the surcharge, and 11. Any other information required under applicable federal, state or local laws, rules or regulations. B. Provided federal, state, and local laws, rules and regulations permit, the ATM may allow Cardholders the option of not receiving the receipt required under this section. If the ATM is unable to provide a receipt at any time, the ATM must display an on-screen notice that the ATM is temporarily unable to provide a receipt and provide the option of canceling the transaction. 2.11 CASH WITHDRAWAL REQUIREMENT Each ATM must be capable of dispensing at least $200.00 cash per transaction. REVISED 03/18 Page 18
2.12 CARD CAPTURE CO-OP Network ATMs are not required to capture CO-OP Network cards. ATM Owners are not required to notify Card Issuers of the capture of a CO-OP Network card. In the event of a CO-OP Network card capture at a CO-OP Network On-Premise ATM due to a machine malfunction or due to a member neglecting to remove the card, the ATM Owner shall hold the card for one (1) Credit Union Business Day. Card may be returned to Cardholder with two (2) forms of proper ID. If the card is captured due to a Card Issuer request, the ATM Owner should cut the card in half through the magnetic stripe and Chip if present and dispose of it the same day. In the event of a CO-OP Network card capture at a CO-OP Network Off-Premise ATM for any reason, the ATM Owner should cut the card in half through the magnetic stripe and Chip if present and dispose of it the same day. Any ATM Owner that captures a card that appears counterfeit (e.g. plain white plastic card, cardboard card or any other card that is unusual in nature) may, at their option, retain, preserve and release to appropriate law enforcement authorities such card for possible use as evidence in prosecuting any action arising from its use. Care should be exercised in handling any suspected counterfeit card to prevent fingerprints or any other physical evidence from being destroyed. All other networks captured cards shall be returned in accordance with the current rules, regulations and procedures established by that network. 2.13 ATM AND ATM SYSTEM AVAILABILITY A. Each ATM Owner shall ensure that its ATMs have scheduled operating hours, at a minimum, from 06:00:00 to 24:00:00 (midnight) local time and that its ATMs and ATM system meet the minimum performance standards established by CO-OP Network. An ATM Owner may provide shorter operating hours, if it believes such shorter operating hours are necessary as a matter of security and safety and must promptly notify CO-OP Financial Services of the change. B. It shall be the ATM Owner's responsibility and not the Card Issuer (if different from the ATM Owner) or CO-OP Financial Services to comply with all federal, state and local laws that apply to ATM safety, security and handicap access, including without limitation, the Americans with Disabilities Act. 2.14 RECORD RETENTION Each ATM Owner shall maintain a record of each network transaction communicated to or by it for a minimum of two (2) years or as is required by applicable federal, state, or local law, rule, or regulation. (Direct-attached ATMs connected to CO-OP Network meet this requirement). Each ATM Owner shall maintain sufficient audit trails with respect to deposits received to be able to provide pertinent information to the appropriate Card Issuer (if participating in the shared deposit program) and to match returned items with the original deposit. Applicable fines may be assessed for non- Random annual compliance audits may be performed. compliance. (See 2.26) REVISED 03/18 Page 19
2.15 CARDHOLDER ERROR RESOLUTION PROCEDURES The ATM Owner shall fully cooperate with CO-OP Network and the Card Issuer in the resolution of all Cardholder disputes and Adjustments in accordance with the procedures outlined in these ORRs. All Adjustments and Representments initiated by a CO-OP Network ATM Owner for transactions occurring between CO-OP Network participants must be processed via DataNavigator. ATM Owners that fail to comply may be held liable for any loss. 2.16 OTHER NETWORK AFFILIATION The ATM Owner participating in regional and/or national networks must provide the transaction types at its ATM as required for each network and abide by the operating rules and regulations set forth by each network. 2.17 ATM MINIMUM TIME-OUT REQUIREMENT ATM Owners must allow CO-OP Network a minimum of forty (40) seconds before timing-out the transaction. 2.18 CO-OP FINANCIAL SERVICES PIN SECURITY SELF AUDIT Each ATM Owner is responsible for ensuring that the ATMs and the systems under their direct control, and any third party they engage to service the ATMs, are in full compliance with the applicable standards set forth in guidelines for Financial Services X9/ TR-39 TG-3 2009, Retail Financial Services Compliance Guideline Part 1: PIN Security and Key Management. A. Direct-Attached 1. Each ATM owner shall, on or before December 31 of each even numbered year, at its expense, complete and submit the CO-OP Financial Services PIN Security Self Audit, respondent information, and all applicable Compliance Exception Reporting forms including all required signatures and submit completed forms to CO-OP Financial Services. 2. The PIN Security Self Audit may be performed by a staff member or auditor of the credit union that does not have operational responsibility for the areas under review. If the credit union chooses to use an external auditor, they are required to be knowledgeable in ANSI Standards X9.8 and X9.24 for Retail Encryption. The designated auditing staff of each ATM owner is required to keep all data associated with the most recent PIN Security Self Audit, for a period of three (3) years and make this information available upon request. B. Intercept Processors ATMs 1. Each ATM owner shall, on or before December 31 of each even numbered year, at its expense, complete and submit the PIN Security Self Audit, respondent information, and all applicable Compliance Exception Reporting forms including all required signatures. 2. The PIN Security Self Audit must be performed by an auditor knowledgeable in ANSI Standards X9.8 and X9.24 for Retail Encryption. If the audit is performed by an internal auditor, they cannot have operational responsibility for the areas under review. REVISED 03/18 Page 20
3. The designated auditing staff of each ATM owner is required to keep all data associated with the most recent PIN Security Self Audit, for a period of three (3) years and make this information available upon request. 2.19 MONITORING AND MAINTENANCE OF ATMS ON CO-OP NETWORK A. Direct-Attached The ATM Owner's ATMs, modems and the telecommunication lines attached to CO-OP Network will be monitored in accordance with CO-OP Network procedures for the purpose of determining the status and functionality of each ATM. It is understood that such monitoring shall be done twenty-four (24) hours a day, seven (7) days a week. CO-OP Financial Services shall use its best efforts to contact and inform the ATM Owner of any problems detected in the ATMs or modems and of extended telecommunications line outages in accordance with the normal procedures of CO-OP Network. 1. The ATM Owner will maintain all of its ATMs. The ATM Owner's maintenance services shall include, but not be limited to balancing ATMs on a regular basis, replenishing all cash and supplies and providing preventive and remedial ATM and/or site maintenance. 2. True dial up ATMs (e.g. Triton, Tidel, Diebold CSP 100 & 200, etc.) are only in communication with the Switch when a transaction is initiated. Due to this type of ATM hardware limitation, these ATMs are not monitored by CO-OP Network for errors, which include, but are not limited to, hardware faults, cash errors or communication errors. It is the ATM Owner s responsibility to ensure that this type of ATM is available and able to process transactions per Section 2.12 of the CO-OP Network ORRs. B. Intercept Processor ATMs 1. The ATM Owner operating as an Intercept Processor is responsible for its own modems and telecommunication lines. It is recommended that such monitoring should be performed during the operating hours of the ATMs. ATMs excepted from public access are not subject to this rule. The ATM Owner will notify CO-OP Financial Services of any problems with an ATM and will also notify CO-OP Financial Services if the ATM will be unavailable for more than twentyfour (24) hours. 2. The ATM Owner will maintain all of its ATMs. The ATM Owner's maintenance services shall include, but not be limited to, replenishing all cash and supplies and providing preventive and remedial ATM maintenance and site maintenance. CO-OP Financial Services and the Card Issuer (if different from the ATM Owner) shall have no responsibility in this regard. 2.20 BIN FILES It is the responsibility of all participating Intercept Processors, Third Party Processors and ATM ISOs to load and maintain the CO-OP Network BIN files on a weekly basis to ensure that CO-OP Network transactions are processed in accordance with routing and surcharging requirements. (See Sections 2.1 and 2.23). BIN files are made available at www.co-opfs.org each Tuesday morning by 10:00 AM, Pacific Time and must be loaded no later than the end of the current credit union business week. A. Domestic BIN File. This file contains all BINs that participate in CO-OP Network on a nonsurcharge basis. This file is only for use by Intercept Processors who route all foreign (not On-Us) transactions to CO-OP Network. B. CO-OP BIN File. This BIN file contains all CO-OP Network participating BINs. These BINs must be routed surcharge free to CO-OP Network for processing. REVISED 03/18 Page 21
C. Credit Card BIN File. This BIN file contains credit cards issued by CO-OP Network participants. Transactions are not routed to CO-OP Network, but should be routed surcharge free. 2.21 TELECOMMUNICATION LINES AND EQUIPMENT The ATM Owner shall pay for all telecommunication charges, including equipment charges, between their ATMs, host computer, administrative terminal, if any, and the Switch. CO-OP Financial Services will invoice the ATM Owner for such telecommunication charges. The ATM Owner shall pay for all charges relating to the installation and use of telephone lines, modems and other telecommunication equipment referred to above. Any equipment lease shall be coterminous with CO-OP Network agreement unless otherwise specifically indicated. 2.22 ATM DOWNSTREAM PROCESSORS No more than two (2) Processors, the Processor that drives the ATM and the Processor that is directly connected to the Switch, may process CO-OP Network ATM transactions between an ATM terminal and the Switch. 2.23 SURCHARGING Processing Participant and Network Access Member Institutions may elect to surcharge for transactions performed at their ATMs. However, CO-OP Financial Services requires that a Processing Participant or Network Access Member Institution NOT impose surcharge fees on the members of another Processing Participant or Network Access Member Institution. In the event the ATM Owner elects to surcharge transactions other than CO-OP Network transactions, it is the responsibility of the ATM Owner to understand, implement, and comply with the network(s) requirements regarding surcharging as specified in the applicable network(s) operating rules. ATM Owners that intend to surcharge transactions other than CO-OP Network transactions must adhere to the following requirements: A. Notification of Intent to Surcharge The terminal owner who elects to surcharge shall notify CO-OP Financial Services in writing no less than ninety (90) calendar days prior to implementing the surcharge fee. Within the written notification, the terminal owner shall identify the location of the terminal(s) that will add a surcharge by providing the following information: 1. Terminal number; 2. Descriptive location; 3. Street address; 4. City, state, and zip code; and 5. Date surcharging is to begin. The terminal owner must submit to CO-OP Financial Services for approval no less than ninety (90) calendar days prior to implementing the surcharge fee the following information: 1. Copies of on-screen notice; 2. Copies of receipt layout; and 3. A completed copy of all applicable affiliated network forms. B. Transactions Eligible for Surcharge REVISED 03/18 Page 22
Surcharge fees imposed by ATM Owners may be collected on the following transactions only: 1. Cash withdrawals. 2. Purchases of non-cash media (stamps, traveler s cheques, etc.). 3. Deposits. C. Surcharge Amount/Non-Discrimination Application of a surcharge at an ATM must be non-discriminatory. The amount of surcharge imposed on the transaction of any financial institution not belonging to CO-OP Network (Processing Participant or Network Access) must be no less favorable than the amount imposed on the transaction of any other financial institution not belonging to CO-OP Network (Processing Participant or Network Access) performed at the same ATM. The exception to the non-discrimination rule is Electronic Benefit Transfer (EBT) transactions. A CO-OP Network ATM Owner that has elected to surcharge transactions performed by non CO-OP Network financial institution Cardholders may choose to NOT surcharge Electronic Benefit Transfer (EBT) transactions while surcharging all other non CO-OP Network financial institution Cardholder transactions subject to federal, state, and local laws. D. Reversals Any reversal of a transaction in which a surcharge was imposed must also fully reverse the surcharge. If a surcharge is a fixed amount, but only a portion of the funds for the transaction are dispensed, the ATM Owner may choose not to reverse the surcharge. E. ATM Screen Requirements Before a surcharge may be imposed, the Cardholder must be given on-screen notification that clearly states the following information: 1. Name of the institution to which the surcharge is being paid; 2. Exact amount of the surcharge; 3. Option to continue or cancel the transaction; and 4. Explanation that if the Cardholder continues the transaction, they will be charged the fee; if the Cardholder cancels the transaction, they will not be charged a fee. A two (2) pass message format is required if hardware is capable. F. Receipt Requirements (See Section 2.9). G. Audit Record Requirement Each ATM must record, separately on its audit record, any surcharge imposed at such ATM. 2.24 ATM ISO (INDEPENDENT SALES ORGANIZATION) REVISED 03/18 Page 23
An ISO is a person or entity, other than a CO-OP Network credit union, that enters into an agreement with a merchant (or business owner) on behalf of a CO-OP Network credit union to accept ATM transactions at a merchant s location. These ATMs are subject to all rules in this chapter including sharing, priority routing, and downstream processing. 2.25 PRIORITY ROUTING All transactions, without exception, initiated by a Cardholder of a CO-OP Network credit union at an ATM owned, controlled, or operated by another member of CO-OP Network must be routed exclusively through the Switch. 2.26 ROUTING REQUIREMENTS Prior to initiating a transaction using a Chip, each ATM Owner that owns, operates, controls or sponsors a CO-OP Network ATM equipped with a Chip reading device, must perform the following: 1. Cause each such CO-OP ATM s Chip reader to prioritize selection of the Common U.S. Debit AID, if such AID is present, above any other AID on the Chip. 2. Route transactions initiated using such Chip in accordance with the Issuer Card Duties and Responsibilities (See Section 3.18). 2.27 CAMERAS Cameras are not required at CO-OP Network ATM locations. If an ATM Owner does have cameras, pictures obtained with such cameras with respect to a disputed transaction shall be provided upon a Card Issuer s request within seven (7) Credit Union Business Days of receipt of the request. Such pictures shall be provided and used at the sole expense of the requesting Card Issuer. Fees for providing such pictures shall be established by mutual agreement of the two (2) parties but shall not exceed $75.00 per picture. 2.28 LIABILITY OF PARTICIPANTS Failure to comply with the rules and requirements as set forth in these ORRs will result in an assessed fine of up to $5,000 per incident and/or termination from CO-OP Financial Services. Each day on which there is a failure to comply with these ORRs is a separate incident for purposes of this paragraph. REVISED 03/18 Page 24