Merchant Agreement

Summary of the key terms of your Merchant Facilities and Section 24 Fraud Prevention 

• Updated to specify that the “Your guide to the Payment Card Industry Data Security Standard (PCI DSS)” is available online on banksa.com.au/merchant-terms

• Inserted additional context about the requirements you need to meet under your Merchant Facility Agreement. It now states:
  
  “Under this Agreement, you also must meet:
  • If you plan to add a surcharge amount to a transaction, the conditions set out at banksa.com.au/surcharging
  • If you use an API or SDK as part of an eCommerce Service that is provided by us, you agree to abide by any license terms and conditions that accompany the API and/or SDK.”
• Removed the reference to “data processor” from subparagraph d). It now states:
  • “if you are an eCommerce Merchant using an Accredited Gateway Provider by obtaining a MID and Merchant Category Code.”

• Amended the definition for “Accredited Gateway Provider” to remove reference to data processor.
• Introduced the following new definitions for API, Checkout Page, Compatible Mobile Device, Documentation, SDK and Tokenised Credentials.
• Renamed the definition “eCommerce Merchant Facility” to “eCommerce Service” and updated to include dashboards.
• Updated the definition for “UnionPay” to “UnionPay International Co. Ltd.;”

• Clarified that processing transactions offline and without real-time Authorisation from the Card issuer only applies for Transactions for EFTPOS terminals. It now states:
  • “Where you have requested, and we have agreed, to process offline Transactions for EFTPOS terminals without real-time Authorisation from the Card issuer, for instance, in Electronic Fall Back Mode (EFB)..”
  • “When processing transactions offline (for EFTPOS terminals only) such as in Electronic Fall Back Mode (EFB) and without real-time authorisation from the Card issuer, you will be held responsible for any resulting fraudulent Transactions or chargebacks.”
• Added the following new section outlining how tokenisation services work:
  
  • “You may apply to use tokenisation services offered by Card Schemes or via applicable eCommerce Services for eligible Cardholder’s products. Tokenisation allows you to store Tokenised Credentials instead of the Cardholder’s PAN. You can provide us with the Cardholder’s Tokenised Credentials instead of the Card Information to process a Transaction.”

• Amended this section to remove references to eCommerce Merchant Facilities.

• Clarified the use of a password when processing a sale refund. It now states:
  • “You may not process a sale refund unless you enter the password prior to each Transaction on the terminal or prior to accessing the eCommerce Service with a password.
  • Where we have issued you with a password or eCommerce Service that allows sales refunds, we will not be responsible for any unauthorised sale refunds processed except to the extent …
  • You will control and be responsible for access to the Terminal sale refunds password or managing user access to the eCommerce Service.”

• Updated to outline the requirements that apply to eCommerce Merchants conducting eCommerce Transactions, including:
  • Your Website Requirements
  • Your Goods and Services
  • Customer Receipts
  • Payment Gateways:
    • Your Responsibilities
    • Third Party Gateway
  • BankSA Payment Gateway
    • General Requirements
    • Acceptable Use
  • API and SDK
  • Your Business Logo
  • Security
  • Responsibility for Cost Associated with your Facility.

• Amended to clarify how we use the ‘publish and notify’ notification method through the merchant statements, it now states:
  • “Notifying you by statements means via your merchant statement which may direct you to visit our website banksa.com.au/merchant-terms for more information.”
• Amended the type of change “Any other term or condition (including a variation of fees and charges)” to specify that a notice of the changes will be available on banksa.com.au/merchant-terms

• Added the effect of terminating an eCommerce Service with one or multiple products. It now states:
  • “On termination of an eCommerce Service where this is the only Merchant Product, you will not have access to the eCommerce Service dashboard, portal or API.  You are responsible to ensure you have downloaded all records that you require from the dashboard or API, prior to termination.  We will not be responsible for information from the dashboard or API that you cannot access due to termination.
    Where a Merchant has another Product attached to the eCommerce Service Dashboard then access to this Product will continue after the closure of the eCommerce Product.”

• Updated to clarify the potential use of merchant data for geographical brand affinity and penetration measures based on aggregated Westpac Group Cardholder insights.

• Added the following new section:
  • “Additionally, for eCommerce Services, we make no representation or warranty in connection with:
    • a) any connection or capacity to successfully connect to any telecommunications system with your telecommunications provider;
    • b) the interoperability between the eCommerce Service and your Website(s), systems, or telecommunications system; or
    • c) any features, functionality, characteristics or capability of your eCommerce merchant dashboard, portal or API or its availability, nor that access will be continuous or uninterrupted. We will use reasonable endeavours to overcome any fault in the services we provide to you quickly.”
• Added the following new subparagraphs under “General liability limitation”:
  
  • d) payments of amounts owed by an invoiced recipient to you (including, for example, where you do not receive the full amount required to be paid under an invoice, or where the payment is delayed);
  • e) any dispute between you and your customers and/or invoice recipients (including without limitation any dispute arising from inaccurate or inappropriate information you have included in an invoice);

Detecting and reducing fraud - Card Not Present businesses

How can I reduce Card Not Present fraud?

• Remove the following security check:
  • “Ask the cardholder the name of the cardholder’s bank. Criminals with compromised account details won’t have this information.”
• Securing your customers' payment information
  • Updated to specify that the “Your guide to the Payment Card Industry Data Security Standard (PCI DSS)” is available online on banksa.com.au/merchant-terms

Entire guide

Your guide to the Payment Card Industry Data Security Standard will no longer be available as a standalone guide. Instead, it will be replaced with an online version that will provide you with information on what PCI DSS is, your compliance requirements and what to do in case of a breach.

You can find more information on PCI DSS and helpful merchant resources by visiting pcisecuritystandards.org.

• Added a new heading “Fee Summary Table” to make the document easier to read and understand.

• Removed “EFTPOS Establishment Fees” and “eCommerce Establishment Fees” as these fees are no longer charged.
• Amended the heading “Additional and Ongoing fees” to “Additional and Ongoing fees for Merchant Flat Rate Pricing”, to clarify when these fees apply.
• Removed EFTPOS 1 fees from the “EFTPOS Terminal Stand and Accessories” and “EFTPOS Terminal Accessories” as EFTPOS 1 is no longer available. 
• Removed the footnote that required changes to pricing plans to be requested two Business Days before the end of the month from “Simple Pricing Plan - No longer for sale from 8 December 2023” as merchant customers are no longer able to change pricing plans.

• Removed the explanations of “EFTPOS and eCommerce Establishment Fee” and “Additional Outlet Establishment Fee” as these fees are no longer charged.
• Amended “Chargeback Fee” to include debit cards.