Iowa Administrative Code › Agency 187 - Banking Division › Chapter 10 - Electronic Transfer of Funds › Rule 187-10.4 - Compliance Examinations of a Central Routing Unit

Current through Register Vol. 47, No. 3, July 24, 2024
(1)
Performance examinations.
			 A
central routing unit shall be subject to examination by the
			 administrators for the purpose of determining compliance with Iowa Code chapter
			 527. Such an examination may be conducted after the central routing unit is
			 operating under the approval of the administrators and shall be conducted at
			 the time the approval of the administrators is sought in accordance with rule
			 10.3(527).
(2)
Compliance
			 factors. A
compliance examination of a central routing unit conducted
			 by the administrators shall consider the following factors to ensure that the
			 central routing unit and all other components of an electronic funds transfer
			 system are in full compliance with the requirements of Iowa Code chapter 527:
a.
Transaction charges.
The
			 transaction charges paid to the central routing unit by each financial
			 institution which utilizes the central routing unit must be consistent with the
			 schedule of charges set forth in the application to operate a central routing
			 unit and must be consistent with the requirements of Iowa Code subsection
			 527.5(6).
b.
Transmission
			 capabilities.
The central routing unit must be capable of accepting
			 and routing and, if approved to operate, is being operated to accept and route
			 transmissions of transaction data originating at any satellite terminal located
			 in the state, whether receiving transaction data from a satellite terminal or
			 from a data processing center or other central routing unit.
c.
Connections with data processing
			 centers.
The central routing unit must be directly connected to every
			 data processing center that is directly connected to a satellite terminal
			 located in the state.
d.
Transaction requirements. A
central routing unit must ensure
			 that an electronic funds transfer system consistently complies with the
			 following transaction requirements:
(1) All
			 cardholders initiating transactions at satellite terminals must use an access
			 device and an electronic personal identifier issued by the cardholder financial
			 institution, unless the use of an electronic personal identifier is not
			 required by Iowa Code chapter 527 for transactions initiated at specified types
			 of satellite terminals.
(2) All
			 transactions must originate at satellite terminals certified by a central
			 routing unit. Satellite terminals located in this state must meet all
			 applicable state and federal requirements.
(3) All transactions shall be authorized
			 either on an on-line real time basis or on a batch basis through a data
			 processing center or a central routing unit.
(4) If the establishing financial
			 institution's data processing center cannot authorize or reject a particular
			 transaction, then the transaction must be routed to a central routing
			 unit.
e.
Validation.
A central routing unit must validate and edit all
			 transaction messages flowing through the electronic funds transfer system to
			 ensure transaction integrity.
f.
Error recovery.
A central routing unit must be responsible for
			 error recovery of all of the central routing unit's owned or controlled
			 hardware, software, and communication facilities and must define all necessary
			 interface requirements for data processing centers, satellite terminals, and
			 financial institutions.
g.
Authorization services.
A central routing unit shall provide
			 authorization services for all cardholder financial institutions which have
			 agreed to such authorization services if:
(1)
			 The cardholder financial institution's data processing center is unavailable or
			 is responding slowly; or
(2) The
			 cardholder financial institution's cardholder information is retained at the
			 central routing unit for card authorization services.
h.
Third-party audits.
Third-party audits of an electronic funds transfer system, including a central
			 routing unit, must be conducted at least annually to ensure adequate security
			 and controls and must be documented for review by the administrators, upon
			 request.
i.
Duplication of
			 critical processing hardware.
A central routing unit must provide
			 duplication of critical processing hardware to ensure functional integrity of
			 the central routing unit.
j.
Electronic funds transfer system reliability standards.
A
			 central routing unit must be available for processing transactions 99 percent
			 of the time, on an annual basis, during the schedule of operation established
			 by the central routing unit. To provide this continuous service to cardholders
			 and the respective cardholder financial institution, a central routing unit
			 must provide for data processing center backup service for all cardholder
			 financial institutions which utilize a data processing center. This may be
			 accomplished by either of the following:
(1)
			 Cardholder financial institutions may maintain a cardholder authorization file
			 at the central routing unit; or
(2)
			 A central routing unit may authorize transactions based on cardholder financial
			 institution's established parameters when the cardholder financial
			 institution's data processing center is responding slowly or is in an
			 inoperative state.
k.
Confidentiality.
(1) A
			 central routing unit shall not divulge specific transaction information to any
			 person or financial institution concerning any cardholder, or an establishing
			 or cardholder financial institution, unless such person or financial
			 institution is part of, or is necessary to effect, the specific transaction, or
			 unless disclosure of such information is required by applicable state or
			 federal law.
(2) A central routing
			 unit shall not divulge any statistics on the operations of any establishing or
			 cardholder financial institution to any third party without the written consent
			 of the particular financial institution.
(3) A central routing unit may disclose total
			 terminal statistics that are generic to the central routing unit and which do
			 not identify any particular financial institution or the operations of any
			 particular financial institution.
(4) A central routing unit may disclose
			 transaction(s) data to any federal or state regulatory authority as required by
			 law.