Best Practices

TSYS Acquiring Solutions requires that all merchants processing on our platform have a record built in the TSYS Acquiring Solutions boarding systems. However, client discretion is used for merchant numbers, features provided to merchants, and portfolio management processes. TSYS recommends considering the guidelines in this section when boarding merchants and terminals in Express.

Consider several elements to avoid when generating a business entity merchant number:

Avoid issuing merchant numbers sequentially.
Avoid using numbers in an identifiable pattern.
Avoid using repeating numbers within the merchant number (such as 000000000xxx or 111111111xxx).
Avoid building training profiles using a generic merchant number (such as 000000000001 or 999999999999). Follow normal merchant setup procedures to generate a merchant number for training profiles. When it is no longer needed, the record should be blocked.

Consider several elements to avoid when generating store and terminal numbers for a business entity:

Avoid using the default values of 0001 for every merchant number that is created.
Avoid using the same numbers for every Merchant ID that is created.

Consider suggestions to limit risks when business entities stop processing transactions:

Block seasonal merchant profiles when they are not in use.
Periodically review merchant activity to Close merchants that have not processed transactions for six months or longer.

Consider suggestions to limit risks when business entities change structure or ownership:

When a business changes ownership, the new owner should be provided a new merchant setup that includes the new owner information. The old profile should be closed.
To ensure processing continuity, when a merchant hierarchy needs to be changed:
- Create a new profile with the new hierarchy
- Close the old profile
- Download the merchant's terminal with the new profile if needed

Consider suggestions to limit risks when boarding business entities:

Ensure profiles are using the correct Merchant Category Code (MCC); use of MCC 5999 should be minimized.
Configure the Daily Auth Count.
The maximum number of authorization requests per terminal (V number) allowed in a rolling 24-hour period. This field accepts a maximum value of 999999.

The Daily Auth Count value set at the merchant level is applied by default to any subsequent terminal record created for the merchant, although you can then edit the terminal level value. If a Daily Auth Count value exists at the terminal level, that value is used to set the maximum daily auth count, otherwise the merchant level value is used.

Whether set at the merchant or the terminal level, the Daily Auth Count value indicates each individual terminal's maximum daily auth count, and not the total auth count allowed for all the merchant's terminals.

Note: When you set or update a Daily Auth Count for a merchant on the Merchant Account page, that value will populate the Daily Auth Count on the Terminal Setup page for each subsequent terminal you set up for the merchant, but it will not update the Daily Auth Count for any existing terminals for the merchant. If you update the Daily Auth Count for a terminal, it will not update the Daily Auth Count on the Merchant Account page.

Enable risk mitigation features when they are supported by the point of sale application:

Restrict Secure Socket Layer (SSL) access if the terminal will use only dial connectivity to process transactions. If the SSL field is set to N in the file build, any transactions submitted through the internet will be rejected.
Generate a unique, non-sequential Authentication Code for each terminal profile. Authentication is required by all Summit Gateway host capture applications and all EMV capable, Sierra Gen2 applications.
Enable encryption and tokenization within the terminal profile.
Note: TSYS Guardian Encryption and Tokenization is a product which must be implemented at the BIN level. Once implemented, the point of sale application must also support the functionality. Class A applications support only Voltage encryption type without tokenization.