Buyer beware: online payment solutions explained.

On the surface, file online collection of rent and related service payments is a win-win situation for property managers and their residents. Lurking just below the surface. however, are several significant issues that can drown the best intentioned of initiatives.

Online rent payment is popular with residents who like the convenience of recurring payments and participation in credit card reward programs every time they pay their rent. Managers benefit from assured, next-day funds availability, integrated data reporting and the streamlining of key administrative tasks.

This sounds great in theory. In practice, the uninitiated can quickly and catastrophically run aground. Online payment solutions that do not comply with local real estate laws, credit card association rules and common sense business practices can be risky and counter-productive. In a heavily regulated industry such as real estate, companies should never seek solutions that will put their businesses in jeopardy.

The Real World Dangers

Non-compliant payment solutions may expose property managers to risks, fraud and malicious network attacks, termination of merchant processing agreements and penalties imposed by state and federal regulators. Residents are also unwittingly placed into a situation where their privacy, credit ratings and quiet enjoyment of rental properties may be impacted as a result of the failings of non-compliant payment systems, especially when funds paid by residents are never received by owners or managers.

These scenarios are no exaggerations. Credit card association rules, state and local real estate laws and federal legislation covering fair housing, fair credit reporting and accounting practices have been agreed to and implemented by regulators with the intention to protect consumers and investors, defend the integrity of national infrastructure and systems and ensure that acceptable business standards are maintained.

To help prevent those kinds of situations from recurring, regulators are taking a strong proactive stance in defining the rules and processes that constitute compliance. In some cases this has resulted in third-party online payment services losing their ability to process credit cards, such as Visa and American Express. In other cases, departments of real estate in states, including California, have ruled that only licensed brokers or owners of a property, and not third-party payment aggregators, may receive funds paid by residents in terms of a lease agreement.

The message is clear. Property managers and owners need to take compliance seriously and to select their partners wisely. The following collection of issues highlights the top-level compliancy considerations for any property manager considering the online collection of rent and related service payments.

Aggregation of Multiple Merchants

Some third-party service providers process credit card and check payments for property managers on an aggregate basis, through a single account controlled by the service provider. Once the funds have cleared and are deposited in the service provider's account, the service provider will transfer funds to the manager's trust account.

Is It Compliant? This service model is not compliant with Visa rules. Any merchant seeking to accept payment by credit card is required to enter into an agreement with an authorized member bank. This approach protects merchants from third-party providers who aggressively hold and have liability for merchant funds. It also protects consumers who are unaware that they are not paying a merchant directly.

Control of Funds

Certain third-party aggregators have sole control over funds paid in favor of property managers and manage a disbursement process that is outside of the standard merchant account system. The processors control the funds at all times prior to disbursement to the manager.

Is It Compliant? This service model is not compliant with real estate laws in many jurisdictions because the managers do not control the processing accounts, and loss of control is considered to be a breach of trust in account compliance. Additionally, all trust-related accounts must be clearly described as such in banking records.

Banking Relationship

Before accepting Visa and MasterCard payments, a manager is required to establish a merchant account with an authorized acquiring bank or a registered Independent Sales Organization (ISO) or Member Service Provider (MSP) of the bank. American Express and Discover require direct contracts with merchants. Only authorized merchants may accept payment by credit card.

Is It Compliant? Only representatives of an acquiring bank or a registered ISO or MSP can present merchants with a processing offer and merchant account agreement. Unless an owner contracts directly with the bank through official sales channels, the solution may not establish a binding relationship between the business and the acquiring bank. As a result, owners and residents will not have any banking industry protections.

Commingling of Funds

Commingling of funds occurs when funds belonging to several entities are mixed in a single account. Certain lenders and housing assistance organizations enforce strict covenants that preclude the commingling of any rental income paid by residents of a property with other funds. Additionally, states that regulate trust accounting practices have ruled that commingling constitutes a breach of fiduciary duties of the trustee.

Is It Compliant? Compliance is achieved by maintaining separate merchant accounts for each community under management and ensuring that clear disbursement instructions are implemented when these are established. Never settle unrelated funds from multiple properties in a single merchant account.

Convenience Fees

In an attempt to offset the costs of processing online transactions, certain managers seek to charge residents convenience fees. Unfortunately, these fees are often applied arbitrarily and inconsistently. Credit card associations--Visa and MasterCard--as well as issuers of non-bank cards, enforce a wide range of regulations on card-accepting merchants through member banks that offer credit card processing services. Failure to comply with association rules can result in fines and the termination of processing privileges.

Is It Compliant? Convenience fees are only compliant with association rules when the fee is imposed on all like transactions regardless of the form of payment used and when the fee is a flat or fixed amount regardless of the value of payment due. Charging variable percentage-based fees and failing to ensure that the same fee is applied to all transactions in the alternative payments channel is prohibited.

Sarbanes-Oxley Act 

Section 404 of the Sarbanes-Oxley Act requires that publicly traded companies must establish, document and maintain internal controls and procedures for financial reporting. It also requires companies to check the effectiveness of internal controls and procedures for financial reporting. Companies must document existing controls and procedures that relate to financial reporting, test their effectiveness and report on any gaps or poorly documented areas.

Is It Compliant? Compliance is achieved by recording and reporting transaction data at each stage of a transaction from initial authorization through to settlement and ultimate funds disbursement. Additionally, it is important to be able to disburse funds directly to the intended deposit account for the business function and not via unrelated commingled accounts.

Statement on Auditing Standards

Statement on Auditing Standards (SAS) No. 70, Service Organizations, is an internationally recognized auditing standard developed by the American Institute of Certified Public Accountants (AICPA). The standard represents that a service organization has been through an in-depth audit of its control activities, which generally include controls over information technology and related processes. Service organizations or service providers must demonstrate that they have adequate controls and safeguards when they host or process data belonging to their customers.

Is It Compliant? The requirements of Section 404 of the Sarbanes-Oxley Act of 2002 make SAS 70 audit reports even more important to the process of reporting on effective internal controls at service organizations. Request a SAS 70 letter from an acquiring bank or ISO or MSP to satisfy compliance obligations.

Data Security

When residents offer their bankcards at the point of sale, over the Internet, on the phone or through the mail, they want assurance that their account information is safe. That's why Visa USA has instituted the Cardholder Information Security Program (CISP) and MasterCard has mandated the Site Data Protection (SDP) Program. These programs--based on a common payments industry security requirement, the Payment Card Industry (PCI) Date Security Standard are intended to protect cardholder data, wherever it resides, ensuring that members, merchants and service providers maintain the highest standards of information security. All merchants and their processors are subject to strict compliance with these rules.

Is It Compliant? Distinct, yet as significant as the mandate to comply with data security requirements, is the validation of compliance. It is a fundamental and critical function that identifies and corrects vulnerabilities and protects customers by ensuring that appropriate levels of cardholder information security are maintained. Visa and MasterCard have prioritized and defined levels of compliance validation based on the volume of transactions, the potential risk and exposure introduced into their system by merchants and service providers.

Managed Payment Service Providers and ISOs and MSPs of major acquiring banks are required to comply with association roles including these data security rules. As such, managers processing transactions through these managed services are able to benefit from their "built-in" compliance and conduct their businesses with the full knowledge that their data and customer data are secure and confidential.

This is an abbreviated executive summary of a white paper co-authored by Ryan Gilbert, CEO of PropertyBridge Inc., a provider of online payment systems to real estate managers and owners, and published by National Multi Housing Council, titled "Automated Electronic Payments: Leveraging Technology for Cost Effective Collections and Transaction Management."