1. Office of the State Controller November 2008 Statewide E-Commerce Program State of North Carolina 101

2. Three Components Statewide E-Commerce Program Electronic Funds Transfer Merchant Cards Inter/Intra Governmental Transfers Inbound (Collections) Outbound (Payments ) Transfers between accounts at State Treasurer

3. Origination of Concept Statewide Enterprise Approach E-Commerce Work Group (1999) Statewide E-Government Steering Committee (2000) IRMC (1999) OSC E-Commerce Task Force (2007) Senate Bill 222 (1999) State Cash Management Plan GS 147-86.10 & 11 Reports 1999 - “A New Way of Doing Business” (ECWG) 1999 – “ITS Framework for Developing an Ecommerce – Enabled Technical Environment” 2001 – “E-Government – Using Technology to Transform North Carolina’s Governmental Service Operations in the Digital Age” March 2007 – “Statewide Electronic Commerce Program Status Report” April 2008 – “Electronic Commerce Task Force Report"

4. Definition “Electronic Payments” Electronic Payments Electronic Funds Transfer (EFT) Wire Transfers ACH Transactions Direct Deposit (Outbound) Bank Draft (Inbound) Debit Card (Outbound) Merchant Cards Credit CardsDebit Cards Wire Transfers primarily handled through State Treasurer’s Office Wire Transfers primarily handled through State Treasurer’s Office ACH and Merchant Cards primarily handled through OSC arrangements ACH and Merchant Cards primarily handled through OSC arrangements Debit card is a form of ACH remitted to cardholder’s account where cardholder withdraws funds via card Debit card is a form of ACH remitted to cardholder’s account where cardholder withdraws funds via card Corporate P-Cards administered by Purchase & Contract Division Corporate P-Cards administered by Purchase & Contract Division Corporate Corporate Purchasing Cards (Disbursements)

5. Electronic Payments Wire Transfers ACH Debit Cards Credit Cards Regulatory Applicability EFTA – Electronic Funds Transfer Act Reg E NACHA Operating Rules EFTA – Electronic Funds Transfer Act Reg E PCI Data Security Council TILA - Truth In Lending Act Reg Z Card Association Rules PCI Data Security Council Reg E and Z issued by Federal Reserve Bank

6. Primary Cost Differences Wire Transfers Item Cost - $6.75+ Item Cost - $6.75+ Same day funds Same day funds Transfer almost instantaneous Transfer almost instantaneous Used for critical payments (e.g. debt service) Used for critical payments (e.g. debt service) ACH Item Cost < 1 penny Item Cost < 1 penny Next day funds Next day funds One day delay in settlement One day delay in settlement Used for large batch files (e.g., payroll, vendor payments) Used for large batch files (e.g., payroll, vendor payments) State Checks Average Cost – $.74 (According to 2008 EC Task Force Survey) Merchant Cards Item Cost - $.04 Item Cost - $.04 Next day funds Next day funds One day delay in settlement One day delay in settlement Primarily for smaller payments Primarily for smaller payments Additional costs of interchange (pass through costs) Additional costs of interchange (pass through costs) Credit Cards - Paid to Visa, MC, Amex Range 1.5% - 3%Credit Cards - Paid to Visa, MC, Amex Range 1.5% - 3% Debit Cards – Paid to switch networks Approx..53%Debit Cards – Paid to switch networks Approx..53%

7. EFT Utilization Biggest Inbound User – (June 30, 2008) Biggest Inbound User – (June 30, 2008) Dept of Revenue – Started 1994Dept of Revenue – Started 1994 130,000 taxpayers remitting electronically130,000 taxpayers remitting electronically 1.6 million transactions annually1.6 million transactions annually $18.2 billion of $26.7 billion collected = 68%$18.2 billion of $26.7 billion collected = 68% Increased investment earnings of $6.3 million per yearIncreased investment earnings of $6.3 million per year Biggest Outbound Users - (June 30, 2008) Biggest Outbound Users - (June 30, 2008) Retirement System – Started 1977Retirement System – Started 1977 203,000 out of 211,000 = 96% 203,000 out of 211,000 = 96% Central Payroll – Started 1979Central Payroll – Started 1979 96,000 out of 100,000 = 96% 96,000 out of 100,000 = 96% NCAS Vendors – Started 2000NCAS Vendors – Started 2000 ACH: 254,000 out of 949,000 = 27% ACH: 254,000 out of 949,000 = 27%  Big Opportunity

8. Paper Warrant Trend Decrease of: 3% 6% 11% 3% 7% 30% Million FY 2001-02 was peak in paper warrants = 18.2 million FY 2007-08 had biggest % decrease = 30% (Child Support & ESC) Decrease in paper checks reflective of increase of EFT 14.7 16.5 17.6 18.2 Largest Accounts 14.3 13.3 9.3

9. Cost of Paper State Check Agency CostDST CostTotal Cost Gen. Govt. Agency $.43 $.11 $.54 University $1.30 $.11 $1.41 Community College $2.11 $.11 $2.22 Weighted Average $.63 $.11 $.74 Two components of cost = Agency cost & DST cost Two components of cost = Agency cost & DST cost Cost does not include cost to “produce” the check (A/P costs) Cost does not include cost to “produce” the check (A/P costs) DST functions as “bank” for agencies DST functions as “bank” for agencies Internal costs = $.09Internal costs = $.09 FRB fees = $.02FRB fees = $.02 Cost of the issuance of a paper state check varies from agency to agency Cost of the issuance of a paper state check varies from agency to agency General Government agencies experiences lower per item cost due to several large volume accounts General Government agencies experiences lower per item cost due to several large volume accounts Average overall cost for a State warrant is $.74 Average overall cost for a State warrant is $.74 Smaller check volumes = higher per item costs Smaller check volumes = higher per item costs Some agencies’ cost as high as $35 Some agencies’ cost as high as $35

10. #Transactions $ Million FY-01 285,000 FY-02 868,000 FY-031,573,000 FY-042,078,000 FY-052,842,000 FY-063,673,000 FY-074,509,000 FY-086,018,000 FY-01$ 22.8 FY-02$ 76.7 FY-03$ 182.6 FY-04$ 233.7 FY-05$ 311.4 FY-06 $ 435.7 FY-07$ 534.8 FY-08$ 646.3 Merchant Card Utilization Dollar Amount Cards represent 11% of total collection transactions (But less than 1% of $) Growth rate of card transactions has been 30% annually Currently 95 participants (900+ merchant numbers): 21 Agencies28 Community Colleges 15 Universities 31 Local Governments

11. Card Activity FY 2006-07 Trans. Vol. Sales Vol. Pass-Thru Fees Vendor Fees Total Fees General Govt 1.967 M $ 107.541 M $ 1.895 M $.140 M $ 2.036 M Universities 1.797 M $ 349.237 M $ 5.634 M $.168 M $ 5.802 M Com. Colleges.161 M.161 M $ 19.910 M $.283 M $.019 M $.302 M Local Units.583 M.583 M $ 58.006 M $.986 M $.047 M $ 1.033 M LEAs.001 M.001 M $.113 M $.002 M $ 0 M $.002 M Total 4.509 M $ 534.807 M $ 8.801 M $.374 M $ 9.175 M Two Types of Fees Pass-thru fees are paid to Visa/MC Vendor Fees are paid to STMS DMV Vehicle Registration largest volume 1.25 million transaction $ 39 million

12. E-Commerce Policies October 1, 2005 – Major rewrite of the State’s E-Commerce policies October 1, 2005 – Major rewrite of the State’s E-Commerce policies Intent was to provide foundation for major emphasis on expanding E-Commerce Intent was to provide foundation for major emphasis on expanding E-Commerce Major room for improvement is vendor payments Major room for improvement is vendor payments Good success in payroll – 96%Good success in payroll – 96% Little success in vendor payments – 27%Little success in vendor payments – 27% Maximization of Electronic Payments Policy Maximization of Electronic Payments Policy Specifies requirements of agencies to utilize ecommerce as part of both receipt and disbursement processesSpecifies requirements of agencies to utilize ecommerce as part of both receipt and disbursement processes PCI Data Security - Issued October 2008 PCI Data Security - Issued October 2008 Specifies process for agencies to be validated as compliant with PCI Data Security StandardSpecifies process for agencies to be validated as compliant with PCI Data Security Standard

13. ACH – Standard Method of Payment Vendor Payments – “Each NCAS agency shall develop procedures to require the standard method of payment to all vendors and other payors to be by ACH direct deposit, utilizing either the E-Payment feature of NCAS or a stand- alone system approved by the State Controller. Exemptions for individual payees may be considered if a hardship case can be provided, or if the payments are non- recurring.” Vendor Payments – “Each NCAS agency shall develop procedures to require the standard method of payment to all vendors and other payors to be by ACH direct deposit, utilizing either the E-Payment feature of NCAS or a stand- alone system approved by the State Controller. Exemptions for individual payees may be considered if a hardship case can be provided, or if the payments are non- recurring.” Payroll – “Each payroll center shall utilize ACH direct deposit for all payroll payments to all full-time employees. Exemptions for individual employees may be considered if a hardship case can be provided. Each payroll center is encouraged to offer ACH direct deposit to all part-time and temporary employees.” Payroll – “Each payroll center shall utilize ACH direct deposit for all payroll payments to all full-time employees. Exemptions for individual employees may be considered if a hardship case can be provided. Each payroll center is encouraged to offer ACH direct deposit to all part-time and temporary employees.”

14. Implementation of Policy Basis – Policy provides agencies with the basis for requiring electronic payment to be the “standard method of payment” Basis – Policy provides agencies with the basis for requiring electronic payment to be the “standard method of payment” Two types of delivery of payments recognized by statute Two types of delivery of payments recognized by statute G.S. 143-3.2 - “All disbursements made to non-State entities shall be delivered by the appropriate agency to the entity’s legally designated recipient by United States mail or its equivalent, including electronic funds transfer.”G.S. 143-3.2 - “All disbursements made to non-State entities shall be delivered by the appropriate agency to the entity’s legally designated recipient by United States mail or its equivalent, including electronic funds transfer.” Allows mailing of paper checks or EFTAllows mailing of paper checks or EFT Central Payroll & BEACON Payroll – July 1, 2007, OSC issued a policy requiring all employees paid under an OSC-administered payroll to be paid by direct deposit Central Payroll & BEACON Payroll – July 1, 2007, OSC issued a policy requiring all employees paid under an OSC-administered payroll to be paid by direct deposit Effective October 1, 2007Effective October 1, 2007 Hardship cases (cannot obtain a bank account) exemptedHardship cases (cannot obtain a bank account) exempted If not direct deposit, pay made by “check” being mailed on paydayIf not direct deposit, pay made by “check” being mailed on payday NCAS Vendors NCAS Vendors OSC will be looking at ways to enroll more vendors in EFTOSC will be looking at ways to enroll more vendors in EFT Agencies should take an active role in enrolling vendors in EFTAgencies should take an active role in enrolling vendors in EFT

15. Master Contracts Statewide E-Commerce Program Electronic Funds Transfer Merchant Cards October 1, 2005August 1, 2006 American Express Related Merchant Card Contract With Trustwave For PCI Validation Services Discover

16. Master Contracts Two master contracts to support the SECP Two master contracts to support the SECP EFT – Wachovia BankEFT – Wachovia Bank Merchant Cards – SunTrust Merchant ServicesMerchant Cards – SunTrust Merchant Services Benefits of master contracts Benefits of master contracts Support the Statewide Enterprise ApproachSupport the Statewide Enterprise Approach Leverage volume pricingLeverage volume pricing Increase competitive biddingIncrease competitive bidding OSC also has three supplemental contacts to support cards:  Trustwave - PCI Security Validation Services  American Express Card Services  Discover Network Card Services

17. EFT Master Contract RFP issued in June 2005 RFP issued in June 2005 Five bidders respondingFive bidders responding Wachovia Bank re-selected October 1, 2005Wachovia Bank re-selected October 1, 2005 Resulting Benefits of New Contract Resulting Benefits of New Contract Programs previously operating separately brought under the master contractPrograms previously operating separately brought under the master contract Central Payroll, DOT Payroll, and universities payrolls Central Payroll, DOT Payroll, and universities payrolls Community Colleges and LEAs using Wachovia Community Colleges and LEAs using Wachovia DST still pays costs, but now operate under Master Contract DST still pays costs, but now operate under Master Contract Price decreased by over one-half of the old pricingPrice decreased by over one-half of the old pricing Annual costs will decrease from $1.5 million to $700,000 Annual costs will decrease from $1.5 million to $700,000 Per item cost decreased from 2 1/2¢ to.9¢ Per item cost decreased from 2 1/2¢ to.9¢ Tiered pricing of.75¢ once total volume > 5 million Tiered pricing of.75¢ once total volume > 5 million Participation Participation Agencies and universities required to participate unless business case is givenAgencies and universities required to participate unless business case is given Community colleges and LEAs voluntary, considering local bank arrangementsCommunity colleges and LEAs voluntary, considering local bank arrangements

18. Merchant Card Contract RFP issued in December 2005 RFP issued in December 2005 Four bidders respondingFour bidders responding SunTrust Merchant Services re-selected August 1, 2006SunTrust Merchant Services re-selected August 1, 2006 Resulting Benefits of New Contract Resulting Benefits of New Contract Vendor-levied fees decreased by 63% from the old pricingVendor-levied fees decreased by 63% from the old pricing Per item cost decreased from 10.8¢ to 4¢ Per item cost decreased from 10.8¢ to 4¢ Annual vendor-levied fees will decrease from $670,000 to $280,000 (average over 5 years of contract) Annual vendor-levied fees will decrease from $670,000 to $280,000 (average over 5 years of contract) Interchange fees will remain at actual “pass-through” Interchange fees will remain at actual “pass-through” Other enhancementsOther enhancements Extended negotiations to obtain more favorable terms than the previous contract Extended negotiations to obtain more favorable terms than the previous contract Different environment today than in 2000, primarily due to PCI Security Compliance Rules and associated fines Different environment today than in 2000, primarily due to PCI Security Compliance Rules and associated fines

19. PCI Data Security Payment Card Industry Data Security Standard Standard applies to any agency’s card capture s ystem that: Standard applies to any agency’s card capture s ystem that: Stores cardholder dataStores cardholder data Transmits cardholder dataTransmits cardholder data Processes cardholder dataProcesses cardholder data Non-Compliance can result in possible: Non-Compliance can result in possible: Substantial fines by Visa and/or MasterCardSubstantial fines by Visa and/or MasterCard Termination of services by STMSTermination of services by STMS Trustwave Validation Services: Trustwave Validation Services: Online Portal provided to agenciesOnline Portal provided to agencies Annual Self-Assessment QuestionnaireAnnual Self-Assessment Questionnaire Quarterly Vulnerability Scans of NetworksQuarterly Vulnerability Scans of Networks Monitoring and Management Reports Monitoring and Management Reports OSC and STMS has access to Non-compliance reportsOSC and STMS has access to Non-compliance reports Central Oversight agencies provided Confidential ReportsCentral Oversight agencies provided Confidential Reports Hacker

20. Common Payment Service EFT (ACH) Agency Internet Application Application STMS API Gateway Service available to participants of the MSA Gateway Service available to participants of the MSA Provided by Office of Information Technology Services (ITS) Provided by Office of Information Technology Services (ITS) Gateway for both EFT and Merchant Card transactions Gateway for both EFT and Merchant Card transactions For participants: For participants: Having an internet application requiring a gateway to the processor (EFT and Merchant Cards)Having an internet application requiring a gateway to the processor (EFT and Merchant Cards) Desiring a virtual terminal for capturing card not-present transactions (MOTO)Desiring a virtual terminal for capturing card not-present transactions (MOTO) Not having ability to transmit ACH files directly to bankNot having ability to transmit ACH files directly to bank Cards Agency Acct/Pay System Agency Acct/Rec System Wachovia Virtual Credit Card Terminal API = Application Program Interface

21. Outbound Payments

22. Inbound Payments

23. Cooperative Effort Statewide E-Commerce Program Participants

24. More Information Office of the State Controller Web Site www.osc.nc.gov David C. Reavis E-Commerce Manager (919) 871-6483 November 2008 David McCoy State Controller Amber Young Central Compliance Manager (919) 981-5481 Three power point presentations are suggested viewing: EFT-101 and Merchant Card Services -101 and CPS-101 Support Services Center (919) 875-HELP (4357)