Maintenance
Part of Card payment guide: authorization, capture, clearing, settlement, and disputes
Merchant card acceptance and statement review checklist
Merchant card acceptance checklist for contracts, security, authorization, capture, refunds, chargebacks, statement fees, reconciliation, and records.
What to take away
- Map the acquirer, processor, gateway, equipment provider, payment facilitator, and bank before signing.
- Configure authorization, capture, tips, holds, descriptors, refunds, and card-not-present controls for the real sales model.
- Payment security is an operating program, not a logo displayed at checkout.
- Reconcile transaction, batch, processor, and bank records every day sales are processed.
- Review fees and chargebacks by defined category, not only by total cost.
Accepting cards creates a chain of contracts, systems, records, and deadlines. A low headline rate can hide operational limits or costs that matter more to a business.
Use this checklist for due diligence and recurring review. It is general operational information, not legal, tax, security, or accounting advice.
Provider and contract checklist
- Record every legal entity and role.
- Identify whether the business contracts with an acquirer or a payment facilitator.
- Confirm the processor, gateway, terminal vendor, and ecommerce plug-in.
- Record the settlement bank account and authorized users.
- Read the initial term, renewal, termination, and early-exit provisions.
- List equipment purchase, rental, return, and replacement obligations.
- Identify reserves, delayed funding, setoff, and account-freeze rights.
- Confirm which operating rules are incorporated by reference.
- Locate support, security-incident, and chargeback contacts.
The OCC's merchant processing handbook describes the acquiring bank's role, the path through issuers and card networks, merchant settlement, and chargeback exposure. It supports mapping those functions, but the signed merchant agreement controls the business relationship.
Sales-channel checklist
Document every way a card can enter the system:
Card entry channels
- Attended countertop terminal
- Unattended terminal or kiosk
- Mobile reader
- Ecommerce checkout
- Telephone or mail order
- Invoice link
- Recurring billing
For each channel, record who hosts the payment page, where card data travels, which authentication and fraud controls apply, and whether the transaction is card-present or card-not-present.
Do not key a card into a general office form or spreadsheet. If a manual fallback exists, document when it is allowed, who can use it, and how sensitive data is protected.
Authorization and capture checklist
- Confirm whether sales are authorized and captured together or separately.
- Set a documented time for closing batches.
- Train staff not to retry an uncertain response blindly.
- Retain the result and reference for every authorization attempt.
- Define how partial approvals are handled.
- Define when estimated and incremental authorizations are permitted.
- Match the final captured amount to the final receipt.
- Reverse unused approvals when the system and rules call for it.
- Escalate duplicate, delayed, or orphaned records before resubmission.
A decline is not an instruction to split or disguise the same transaction. Follow the provider's acceptance procedures and use another verified payment method when appropriate.
Authorization to capture
- Authorize sale
- Capture or close batch
- Match captured amount to receipt
- Reverse unused approvals
- Escalate duplicate or orphaned records
Tips, lodging, rentals, and deposits
Businesses with variable final amounts need a written flow from estimate to completion.
Record:
Estimate to final amount
- StartInitial authorized amount
- NextBasis for estimate
- NextCustomer disclosure
- NextEach incremental request
- NextFinal amount and receipt
- EndCompletion or reversal time
Keep optional tips voluntary and clearly presented. Do not assume a terminal's suggested-tip screen satisfies every disclosure or wage requirement.
Descriptor and receipt checklist
- Test how the business name appears on customer statements.
- Include a recognizable location or support detail where permitted.
- Keep the descriptor consistent with receipts and order emails.
- State return, cancellation, and delivery terms before purchase.
- Give the customer a durable receipt.
- Mask the card number on customer and merchant copies.
- Avoid printing or storing authentication data that should not be retained.
A clear descriptor can reduce friendly confusion, but it cannot cure an unauthorized or incorrectly processed transaction.
Descriptor and receipt checks
- Test statement business name
- Include recognizable location or support
- Keep descriptor consistent with receipts
- State return and cancellation terms
- Give durable receipt
- Mask card number on copies
Security checklist
Determine the merchant's payment-data environment and validation duties with its acquirer or payment facilitator. The PCI Security Standards Council's merchant payment-security process calls for PCI DSS controls, approved PIN-entry devices, validated payment software, protection against storing sensitive authentication data, and ongoing monitoring. Scope and validation details depend on the environment and provider instructions.
Payment security controls
- Inventory terminals and payment pages
- Change vendor defaults
- Apply security updates
- Inspect terminals for tampering
- Monitor ecommerce scripts
- Use individual staff accounts
- Test backups and incident contacts
- Maintain an inventory of terminals, payment pages, plug-ins, and service providers.
- Change vendor defaults and restrict administrative access.
- Apply security updates through controlled change management.
- Inspect physical terminals for substitution or tampering.
- Monitor ecommerce scripts and account changes.
- Use individual staff accounts and least privilege.
- Test backups and incident contacts.
- Document retention and secure disposal.
- Review provider compliance status without treating it as a transfer of merchant responsibility.
Never ask a customer to send the card security code by email or chat.
Refund and cancellation checklist
- Publish a clear return and cancellation policy.
- Verify that staff can find the original sale.
- Return funds through the approved channel and method.
- Record refund amount, date, transaction reference, and staff user.
- Give the customer written confirmation.
- Reconcile the credit on processor and bank reports.
- Distinguish a void before completion from a refund after posting.
- Revoke recurring billing when cancellation is effective.
Do not promise an exact issuer posting time unless the business controls it. State when the merchant submitted the credit and provide its reference.
Refund and cancellation steps
- Publish return and cancellation policy
- Verify original sale
- Return funds through approved channel
- Record refund details
- Give written confirmation
- Reconcile credit on reports
- Revoke recurring billing
Chargeback and inquiry checklist
Create a single intake queue with an owner and backup.
Chargeback intake queue
- Record received date and deadline
- Identify reason category and amount
- Preserve original notice
- Match transaction and communications
- Submit only relevant evidence
- Record decision and fees
- Correct operational cause
Winning a case does not prove the process is healthy. Track repeated descriptors, shipping failures, subscription cancellations, staff errors, and fraud patterns.
Daily reconciliation checklist
Use four layers:
Four-layer reconciliation
- Order or receipt
- Transaction log
- Processor batch
- Bank deposit
For each processing day:
- Compare completed orders with captured transactions.
- Identify approved transactions that were not captured.
- Identify captures without orders.
- Review duplicates, reversals, refunds, and declines.
- Tie the batch total to the processor report.
- Tie net funding to the bank deposit.
- Explain fees, reserves, and adjustments.
- Assign unresolved differences and a due date.
Do not force a reconciliation by entering an unexplained adjustment. Preserve the discrepancy until it is understood.
Monthly statement checklist
Break total processing cost into:
| Category | Review question |
|---|---|
| Network and interchange | Does the transaction mix explain the category? |
| Processor markup | Does it match the contract? |
| Gateway or software | Are all accounts and features still used? |
| Equipment | Is the billed device installed and owned or rented as stated? |
| Chargebacks | Are amount, fee, and outcome recorded? |
| Refunds | Do totals match transaction records? |
| Reserves and holds | Is the basis and release date documented? |
| Adjustments | Can each item be traced to a transaction or contract term? |
Calculate effective cost using a consistent denominator and period. A rate based only on gross sales can hide fixed fees, refunds, and chargebacks.
Quarterly control review
- Test a purchase, decline, void, refund, and settlement trace.
- Remove former staff and unused integrations.
- Verify the bank account and alert recipients.
- Compare the public cancellation policy with system behavior.
- Review incident drills and provider contacts.
- Sample transaction retention and redaction.
- Reprice only after reconciling the current statement.
Common questions
Is the processor the same as the acquirer?
Not necessarily. Record the legal entity performing each role rather than relying on a sales representative's shorthand.
Can a merchant store card security codes for later charges?
Do not design a process around retaining sensitive authentication data. Confirm the applicable security standard and use approved credential-storage methods.
Why does the bank deposit not equal the day's gross sales?
Funding may be net of fees, refunds, chargebacks, reserves, and timing differences. Reconcile through the processor batch.
How often should statements be reviewed?
Reconcile transactions and funding daily when sales occur, and conduct a full fee and contract review at least monthly.
