Accounting and Financial Services

Merchant Services

Central Washington University’s Accounting and Financial Services Office provides guidance and operational support to university departments authorized to accept credit and debit card payments.

Merchant Services helps departments establish approved payment card operations, understand processing and reconciliation requirements, complete required training, and maintain compliance with the Payment Card Industry Data Security Standard (PCI DSS) and university policy.

Only departments that have received written approval from the Accounting and Financial Services team may accept payment cards on behalf of Central Washington University.

PCI DSS Policies

How We Can Help

The Accounting and Financial Services Office serves as the primary point of contact for university payment card activities. Support includes:

  • Reviewing requests to establish new merchant accounts
  • Coordinating the setup of approved payment card processing environments
  • Providing processing and reconciliation guidance
  • Coordinating required merchant and security training
  • Helping departments understand PCI DSS and university compliance requirements
  • Reviewing proposed payment card vendors and service providers
  • Maintaining departmental merchant contact information
  • Assisting existing merchants with operational or compliance questions

Departments must receive approval before purchasing payment card equipment, selecting a payment processor, entering into an agreement with a payment service provider, or beginning to accept payment cards.

Apply for Merchant Services

Requesting a New Merchant Account

Departments interested in accepting payment cards should contact the Accounting and Financial Services Office before making any purchasing, contracting, or technology decisions related to payment processing.

The approval process includes:

  1. Consulting with the Accounting and Financial Services Office about the department’s payment-processing needs
  2. Completing a Merchant Application
  3. Designating a Merchant Department Responsible Person and a secondary contact
  4. Completing all required training
  5. Reviewing and signing the Payment Card Processing and Security Agreement
  6. Receiving approval from the Accounting and Financial Services office.

A department may not accept payment cards until the merchant account and its associated payment environment have been approved.

Request Merchant Services

Merchant Department Responsible Person

Each approved merchant must designate a Merchant Department Responsible Person, or MDRP.

The MDRP has primary responsibility for the department’s payment card operations and PCI DSS compliance. The department must also designate a secondary contact who can assume these responsibilities when the MDRP is unavailable.

The MDRP is responsible for helping ensure that:

  • Employees receive appropriate training before handling payment card transactions
  • Departmental procedures comply with university policy and PCI DSS requirements
  • Payment card equipment is protected from unauthorized access or tampering
  • Transactions are processed and reconciled according to university procedures
  • Required compliance documentation is completed and maintained
  • Suspected security incidents are reported immediately

Changes to the MDRP or secondary contact must be reported to the Accounting and Financial Services Office within two business days.

Update your mdrp

Department Responsibilities

Each merchant department is responsible for maintaining internal controls that protect payment card information and reduce the risk of unauthorized access, fraud, or a data breach.

Departments must:

  • Limit payment card responsibilities to properly trained employees
  • Follow all university payment card policies and procedures
  • Use only payment systems, equipment, vendors, and service providers approved by the university
  • Protect payment card equipment and records from unauthorized access
  • Complete required PCI DSS assessments, training, and compliance activities
  • Reconcile payment card transactions according to Accounting Office instructions
  • Report operational, personnel, equipment, or processing changes to the Accounting Office
  • Cooperate with compliance reviews, security assessments, and investigations

Departments using third-party payment service providers must coordinate with the Accounting and Financial Services Office, Contracts and Procurement, and Information Services before purchasing or implementing the service.

 

 

Protecting Payment Card Information

University business processes should be designed to avoid storing cardholder data whenever possible.
  • Never Send Payment Card Information by Email

    Payment card numbers and other sensitive payment information must never be requested, accepted, or transmitted through email.

    When payment card information is received by email:

    1. Remove the payment card information from the reply.
    2. Inform the sender that Central Washington University does not accept payment card information by email because email is not a secure transmission method.
    3. Securely delete the original message in accordance with university procedures.
    4. Notify the appropriate departmental contact when additional review may be necessary.

  • Storage and Disposal

    Cardholder information must not be retained longer than a documented business need. Under university policy, the maximum retention period is 90 days.

    Cardholder information may not be stored on:

    • Laptop computers
    • USB drives
    • Portable hard drives
    • CDs or other removable media
    • Personal devices
    • Unapproved databases, spreadsheets, or electronic files

    Any authorized paper or electronic records containing cardholder information must be physically and electronically secured and destroyed in accordance with PCI DSS and university records-management requirements.

    Sensitive authentication data—including a card’s security code and the full contents of its magnetic stripe—must never be stored.

Payment Card Vendors and Technology

Departments may use only university-approved payment card vendors and service providers.

Before purchasing or implementing a payment system, departments must work with the appropriate university offices to confirm that:

  • The proposed vendor is PCI DSS compliant
  • The service is included on the university’s approved vendor list
  • The contract contains required data-security and compliance provisions
  • The system meets university information-security requirements
  • Responsibility for security updates, patches, and ongoing maintenance is clearly established
  • The vendor’s PCI DSS compliance will be reviewed at least annually

Departments should not independently create merchant accounts, purchase card readers, install payment applications, or sign agreements with payment processors.

Security Incidents

Immediately report any suspected loss, theft, tampering, unauthorized access, disclosure, or misuse involving:

  • Payment card information
  • Payment card terminals or equipment
  • Merchant usernames or passwords
  • Transaction records
  • Payment processing systems
  • Third-party payment providers

Do not attempt to investigate or resolve a suspected breach independently. Preserve relevant records and equipment and follow instructions provided by university security personnel.

Report a Security Incident

Departments That Are Not Approved Merchants

Departments that have not been approved to accept payment cards must not collect or process payment card information.

Individuals wishing to pay a university bill by credit or debit card should be directed to the Cashier’s Office or the appropriate authorized university payment website.

Resources

Contact Merchant Services Finance Managers

CWU News

The CWUPD before summiting Mount Rainier.

Four CWU Police officers summit Mount Rainier

August 19, 2026 by

The CWU Dining team posing with their awards.

CWU Dining Services recognized with pair of national awards

August 17, 2026 by

More News