INTRODUCT ION T O ME RCHANT’S B AN K O F A ME RICA (“ MB A”), SUPERIOR CARD PROCESSOR, INC. (SCP), A ND T O “YOU” T HE NEW HE AD OF T HE IG STEERING COMMITTEE AND PROJECT MANAGER FOR THE INFORMATION GOVERNANCE PROJECT DESIGN AND DEVELOPMENT TEAM
Merchant’s Bank of America (herein after “Merchant’s Bank” or “MBA”) received its charter in
2006. It is a relatively young but growing financial institution and commercial bank that among the many other banking services it offers to its customers extends banking services for credit card processing and collection to its Merchant depositors who are retailers, small businesses, and self- employed individuals (collectively “Merchants”). MBA’s main office and principal place of business is in Lexington, Fayette County, Kentucky. Since first opening its doors in 2006, MBA has opened additional branches, first in Fayette County, and then across the Commonwealth of Kentucky. Today, MBA has one or more branches in every county in the state, totaling 300 in number.
MBA is structured as is a traditional financial institution with the Board of Directors, Banking officers that include Chief Financial Officer, Chief Executive Officer and Bank President. There are a number of Vice-Presidents related to each major department or functional units of MBA. Among the major departments or functional units is the Loan Department housing both the residential personal loans, residential mortgage loans and commercial or business loans, Customer Accounts Department responsible for the different merchant and consumer checking and saving accounts, Investments Department responsible for investment services including but not limited to
401K accounts and other types of investment and/or brokerage accounts, Marketing Department, Customer Services Department that among other things is responsible for setting up Merchant credit card processing through the bank, for keeping an inventory of POS terminals, leasing or selling the terminals to the Merchant depositors who permit their customers to make credit card purchases, for delivery, installation and training for the Merchants who use the POS terminals, and who coordinate with IT and the bank’s credit card processor Superior Card Processor, Inc. to provide web hosting for MBA’s merchant depositors who offer on-line credit card purchases, Information Technology Department (which is also responsible for MBA’s wide ranging on-line banking services, customer privacy and security, as well as the traditional functions we associate with IT, a Human Resources Department, Accounting Department, in-house Legal Department, and a catch-all Other Services Department.
All of its 300 branches and the principal bank location are networked. Each of the 300 branches has a branch manager and assistant manager, and each branch offers a full range of services.
Approximately 10 years ago Merchant Bank of America (MBS’s) Merchant depositors began to inquire as to whether Merchant’s Bank (MBA) offered credit card processing for the Merchant’s customers who wanted to make their purchases with a major credit card. The number of inquiries increased significantly over the next couple of years, to where approximately 8 years ago
Merchant’s Bank of America made this service available to its Merchant depositors who requested the service. To that end, Merchant Bank (MBA) contracted with a reputable and growing Credit Card Processor, Superior Card Processor, Inc. (“SCP”) to act as its credit card processor. SCP provides point of sale terminals to MBA, who can either sell or lease the POS terminals to its Merchant depositors for use in their businesses. In the alternative, SCP offers web hosting for MBA’s Merchant depositors who do not have a physical presence or who, in addition to their physical brick and mortar stores engage in e-commerce that accepts credit card purchases. Merchant Bank of America (MBA) has negotiated with SCP to set the discount and interchange rates and fees charged for credit card processing with all of the major credit card companies that are members of the credit card associations. These rates are applicable to MBA’s Merchant depositors who authorize MBA to accept and deposit the Merchant’s credit card sales proceeds into the Merchant’s deposit account with MBA. The Merchants who accept this service offered by MBA are not free to negotiate their own separate rates with Superior Card Processor, Inc. but who by virtue of their contract with MBA are bound by the rates negotiated and contracted for between MBA and SCP.
Superior Card Processor, Inc., is a Credit Card Processor for Merchants who accept any of the major credit cards who are members of the Credit Card Associations, including Visa, MasterCard, Discover, Bank of America, and American Express, and for Merchant Banks who hold those Merchant deposits. Superior Card Processor, Inc. offers the exact same service to thousands of Merchants (brick and mortar and those engaged in e-commerce) who have contracted directly with SCP or indirectly through their Merchant Bank for credit card process using SCP’s POS terminals and/or web hosting. SCP also offers the same service to thousands of banks, credit unions and other financial institutions all across the United States for managing deposits and discounts that it offers MBA for its Merchant customers. (For the purposes of our project, we will not consider international transactions.)
Specifically, the contract between SCP and MBA provides for SCP to withhold a certain percentage of each transaction for processing the credit cards, and also provides for an additional percentage of each transaction to be withheld by SCP on behalf of MBA, representing MBA’s fee or “discount”. These fees are deducted after the Issuing Bank (the bank who extended credit to the customer by issuing a credit card to the customer) has deducted its own interchange fee, and forward the balance to the SCP for further distribution. SCP will accept the funds from the Issuing Bank, deduct its own discount fee and MBA’s discount fee, and then deposit the balance into the Merchant account held with MBA. SCP will then deposit MBA’s discount fee that it withheld from the Merchant’s deposit into an MBA account earmarked for this purpose.
Related to the credit card processing services it offers its customers, monthly, Superior Card Processor, Inc. provides it Merchants equipped with SCP’s POS terminals and/or web hosting with a detailed breakdown and a summary of all credit card transactions that the Merchant has processed that period using SCP’s POS terminal (or website where applicable), which will include among other things the name of the Customer who used the credit card, the name of the major credit card or credit card association, the total amount of purchase, date of purchase, the interchange rate withheld by the card holder’s issuing bank, the discount withheld by the SCP for its own services and for and the discount withheld on behalf of MBA for its services. Additionally, SCP will
provide Merchant’s Bank of America with a similar monthly statement setting forth the
information and a breakdown of the discount amounts deposited into MBA’s account.
Related to the credit card processing services it offers its customers, monthly, Superior Card Processor, Inc. provides it Merchants equipped with SCP’s POS terminals and/or web hosting with a detailed breakdown and a summary of all credit card transactions that the Merchant has processed that period using SCP’s POS terminal (or website where applicable), which will include the name of the Customer who used the credit card, will identify the credit card association, the total amount of purchase, date of purchase, the interchange rate withheld by the card holder’s issuing bank, the discount withheld by the SCP and/or the Merchant Bank, depending on the specific contract between the two, and the net amount deposited into the Merchant’s account with its Merchant Bank. Additionally, SCP will provide its Merchant Banks with a monthly summary of the same information and the amount of discounts deposited into the Merchant Bank’s own account.
In this scenario, you are an employee of Merchant’s Bank of America. You have worked for MBA for nearly 15 years and have worked your way up through the ranks. During high school you were an intern at MBA. During college you worked part-time as a teller. Upon graduation from college with a double major in Business Administration and Finance, and Information Science and Technology you were hired by MBA on a full-time basis. For a period of months you continued as a bank teller. Thereafter, you moved over to become a loan officer. After a couple of years you became involved in marketing and research and in financial services offered by MBA. As you wanted to put your IT skills to use, you asked to be transferred to the IT department to get a feel for how that department functioned in MBA. You have also engaged in customer relations, while part of the marketing department. Suffice to say, you have worked in many different areas of banking at MBA and have gained valuable experience in each. Furthermore, you have a good professional and working relationship with those in authority in a number of departments at MBA.
Over the past 5 to 7 years MBA has grown rapidly and in response to the changing demands and needs of its customers. The Board of Directors and Bank President have concerns that during this period of rapid grown that potentially MBA has not addressed information governance of its information and data as it should have been. The Information Technology Department has likewise expressed the same concern. MBA does not have a comprehensive, enterprise wide Information Governance Plan or Program. This lack of information governance has led to issues related to breaches in security, disclosure of what should have been protected customer credit card information, and merchant information. In addition, MBA has not been responsive to legal holds on customer and/or banking information, which has led to delays in the legal department responding to legal discovery requests. Further, there have been incidents where MBA did not retain information for as long as it should have, resulting in sanctions by the Courts for its inability to respond to legal discovery requests. Other times, MBA had retained potentially damaging information that legally it could have disposed of but did not. As the result of a legal discovery request for that information, MBA was required to turn it over, which led to sanctions and adverse affects that could have been avoided. This is evidence of the fact that MBA does not have a legally defensible data retention and disposal plan in place.
You have been approached by the Chairman of MBA’s Board or Directors and its Bank President to head up an Information Governance Steering Committee and Project Director for MBA’s Information Governance Project Development and Implementation Team. You have agreed to
serve in both capacity. This is where the process begins. The members of the Steering Committee have not been selected, and the project development team has not been selected to develop and implement the enterprise wide Information Governance Plan or Program for MBA.