Merchant and Event Services

Merchant and Event Services

Central Washington University’s Merchant and Event Services provides guidance and operational support to university departments authorized to accept card payments both internally and externally.

Merchant and Event Services helps departments establish approved payment card operations, coordinate events through authorized University channels, understand processing and reconciliation requirements, complete required training, and maintain compliance with the Payment Card Industry Data Security Standard (PCI DSS) and University policy. Merchant & Event Services also plays a key role in preventing unauthorized events and financial activities while connecting departments with available University services, resources, and approved platforms to support successful and compliant operations. 

Only departments that have received approval from the Controller's office may accept payments or charge for services on behalf of Central Washington University. 

If you are looking to get approval, please submit the form below. The approval process includes: 

  1. Consulting with the Controller’s Office about the department’s payment-processing needs 
  2. Completing a Merchant Application (link below) 
  3. Designating a Merchant Department Responsible Person and a secondary contact 
  4. Completing all required training 
  5. Reviewing and signing the Payment Card Processing and Security Agreement 
  6. Receiving approval from the Accounting and Financial Services office.

A department may not accept payment cards until the merchant account and its associated payment environment have been approved. 

Apply for merchant services

If you are looking to host an event

Once your department is cleared to accept payments, the first step is scheduling your event within 25Live at the link below.

For more information or to schedule space contat the scheduling team at schedule@cwu.edu.

Schedule Your Event

Merchant Department Responsible Person

Each approved merchant must designate a Merchant Department Responsible Person, or MDRP.

The MDRP has primary responsibility for the department’s payment card operations and PCI DSS compliance. The department must also designate a secondary contact who can assume these responsibilities when the MDRP is unavailable.

The MDRP is responsible for helping ensure that:

  • Employees receive appropriate training before handling payment card transactions
  • Departmental procedures comply with university policy and PCI DSS requirements
  • Payment card equipment is protected from unauthorized access or tampering
  • Transactions are processed and reconciled according to university procedures
  • Required compliance documentation is completed and maintained
  • Suspected security incidents are reported immediately

Changes to the MDRP or secondary contact must be reported to the Accounting and Financial Services Office within two business days.

Update your mdrp

Department Responsibilities

Each merchant department is responsible for maintaining internal controls that protect payment card information and reduce the risk of unauthorized access, fraud, or a data breach.

Departments must:

  • Limit payment card responsibilities to properly trained employees
  • Follow all university payment card policies and procedures
  • Use only payment systems, equipment, vendors, and service providers approved by the university
  • Protect payment card equipment and records from unauthorized access
  • Complete required PCI DSS assessments, training, and compliance activities
  • Reconcile payment card transactions according to Accounting Office instructions
  • Report operational, personnel, equipment, or processing changes to the Accounting Office
  • Cooperate with compliance reviews, security assessments, and investigations

Departments using third-party payment service providers must coordinate with the Accounting and Financial Services Office, Contracts and Procurement, and Information Services before purchasing or implementing the service.

 

 

Protecting Payment Card Information

University business processes should be designed to avoid storing cardholder data whenever possible.
  • Never Send Payment Card Information by Email

    Payment card numbers and other sensitive payment information must never be requested, accepted, or transmitted through email.

    When payment card information is received by email:

    1. Remove the payment card information from the reply.
    2. Inform the sender that Central Washington University does not accept payment card information by email because email is not a secure transmission method.
    3. Securely delete the original message in accordance with university procedures.
    4. Notify the appropriate departmental contact when additional review may be necessary.

  • Storage and Disposal

    Cardholder information must not be retained longer than a documented business need. Under university policy, the maximum retention period is 90 days.

    Cardholder information may not be stored on:

    • Laptop computers
    • USB drives
    • Portable hard drives
    • CDs or other removable media
    • Personal devices
    • Unapproved databases, spreadsheets, or electronic files

    Any authorized paper or electronic records containing cardholder information must be physically and electronically secured and destroyed in accordance with PCI DSS and university records-management requirements.

    Sensitive authentication data—including a card’s security code and the full contents of its magnetic stripe—must never be stored.

Payment Card Vendors and Technology

Departments may use only university-approved payment card vendors and service providers.

Before purchasing or implementing a payment system, departments must work with the appropriate university offices to confirm that:

  • The proposed vendor is PCI DSS compliant
  • The service is included on the university’s approved vendor list
  • The contract contains required data-security and compliance provisions
  • The system meets university information-security requirements
  • Responsibility for security updates, patches, and ongoing maintenance is clearly established
  • The vendor’s PCI DSS compliance will be reviewed at least annually

Departments should not independently create merchant accounts, purchase card readers, install payment applications, or sign agreements with payment processors.

Security Incidents

Immediately report any suspected loss, theft, tampering, unauthorized access, disclosure, or misuse involving:

  • Payment card information
  • Payment card terminals or equipment
  • Merchant usernames or passwords
  • Transaction records
  • Payment processing systems
  • Third-party payment providers

Do not attempt to investigate or resolve a suspected breach independently. Preserve relevant records and equipment and follow instructions provided by university security personnel.

Report a Security Incident

Departments That Are Not Approved Merchants

Departments that have not been approved to accept payment cards must not collect or process payment card information.

Individuals wishing to pay a university bill by credit or debit card should be directed to the Cashier’s Office or the appropriate authorized university payment website.

Resources

Contact Merchant Services Finance Managers

CWU News

CWU Foundation Director At-Large Lisa Conquergood speaks at the Oct. 9 event on the CWU campus.

Community voices help CWU launch $75 million Futures Campaign

October 14, 2026 by

A CWU Psychology student in a classroom

Behavioral Health BS program helps CWU fill growing need statewide

October 14, 2026 by

More News