Iowa Administrative Code › Agency 189 - Credit Union Division › Chapter 24 - Electronic Transfer of Funds › Rule 189-24.4 - Compliance Examinations of a Central Routing Unit

Current through Register Vol. 47, No. 3, July 24, 2024
(1)
Performance examinations.
			 A
central routing unit shall be subject to examination by the
			 administrators for the purpose of determining compliance with Iowa Code chapter
			 527. Such an examination may be conducted after the central routing unit is
			 operating under the approval of the administrators and shall be conducted at
			 the time the approval of the administrators is sought in accordance with rule
			 24.3(527).
(2)
Compliance
			 factors. A
compliance examination of a central routing unit conducted
			 by the administrators shall consider the following factors to ensure that the
			 central routing unit and all other components of an electronic funds transfer
			 system are in full compliance with the requirements of Iowa Code chapter 527:
a.
Transaction charges.
The
			 transaction charges paid to the central routing unit by each financial
			 institution which utilizes the central routing unit must be consistent with the
			 schedule of charges set forth in the application to operate a central routing
			 unit and must be consistent with the requirements of Iowa Code subsection
			 527.5(6).
b.
Transmission
			 capabilities.
The central routing unit must be capable of accepting
			 and routing and, if approved to operate, is being operated to accept and route
			 transmissions of transaction data originating at any satellite terminal located
			 in the state, whether receiving transaction data from a satellite terminal or
			 from a data processing center or other central routing unit.
c.
Connections with data processing
			 centers.
The central routing unit must be directly connected to every
			 data processing center that is directly connected to a satellite terminal
			 located in the state.
d.
Transaction requirements. A
central routing unit must ensure
			 that an electronic funds transfer system consistently complies with the
			 following transaction requirements:
(1) All
			 cardholders initiating transactions at satellite terminals must use an access
			 device and an electronic personal identifier issued by the cardholder financial
			 institution, unless the use of an electronic personal identifier is not
			 required by Iowa Code chapter 527 for transactions initiated at specified types
			 of satellite terminals.
(2) All
			 transactions must originate at satellite terminals certified by a central
			 routing unit. Satellite terminals located in this state must meet all
			 applicable state and federal requirements.
(3) All transactions shall be authorized
			 either on an on-line real time basis or on a batch basis through a data
			 processing center or a central routing unit.
(4) If the establishing financial
			 institution's data processing center cannot authorize or reject a particular
			 transaction, then the transaction must be routed to a central routing
			 unit.
e.
Validation.
A central routing unit must validate and edit all
			 transaction messages flowing through the electronic funds transfer system to
			 ensure transaction integrity.
f.
Error recovery.
A central
			 routing unit must be responsible for error recovery of all of the central
			 routing unit's owned or controlled hardware, software, and communication
			 facilities and must define all necessary interface requirements for data
			 processing centers, satellite terminals, and financial institutions.
g.
. Authorization services.
A
			 central routing unit shall provide authorization services for all cardholder
			 financial institutions which have agreed to such authorization services if:
(1) The cardholder financial institution's
			 data processing center is unavailable or is responding slowly; or
(2) The cardholder financial institution's
			 cardholder information is retained at the central routing unit for card
			 authorization services.
h.
. Third-party audits.
Third-party audits of an electronic funds transfer system, including a central
			 routing unit, must be conducted at least annually to ensure adequate security
			 and controls and must be documented for review by the administrators, upon
			 request.
i.
. Duplication of
			 critical processing hardware.
A central routing unit must provide
			 duplication of critical processing hardware to ensure functional integrity of
			 the central routing unit.
j.
. Electronic funds transfer system
			 reliability standards.
A central routing unit must be available for
			 processing transactions 99 percent of the time, on an annual basis, during the
			 schedule of operation established by the central routing unit. To provide this
			 continuous service to cardholders and the respective cardholder financial
			 institution, a central routing unit must provide for data processing center
			 backup service for all cardholder financial institutions which utilize a data
			 processing center. This may be accomplished by either of the following:
(1) Cardholder financial institutions may
			 maintain a cardholder authorization file at the central routing unit;
			 or
(2) A central routing unit may
			 authorize transactions based on cardholder financial institution's established
			 parameters when the cardholder financial institution's data processing center
			 is responding slowly or is in an inoperative state.
k.
Confidentiality.
(1) A central routing unit shall not divulge
			 specific transaction information to any person or financial institution
			 concerning any cardholder, or an establishing or cardholder financial
			 institution, unless such person or financial institution is part of, or is
			 necessary to effect, the specific transaction, or unless disclosure of such
			 information is required by applicable state or federal law.
(2) A central routing unit shall not divulge
			 any statistics on the operations of any establishing or cardholder financial
			 institution to any third party without the written consent of the particular
			 financial institution.
(3) A
			 central routing unit may disclose total terminal statistics that are generic to
			 the central routing unit and which do not identify any particular financial
			 institution or the operations of any particular financial
			 institution.
(4) A central routing
			 unit may disclose transaction(s) data to any federal or state regulatory
			 authority as required by law.