E-Commerce and Payment Card Systems

1. Why This Topic Matters for the CTP Exam and for Treasury Practice

E-commerce and payment card systems sit at the intersection of three core treasury responsibilities: collecting cash efficiently, controlling disbursements, and managing operational and fraud risk. The AFP's Essentials of Treasury Management places this material within the Technology in the Treasury Function domain because card networks, online payment channels, and electronic invoicing are the plumbing through which an increasing share of corporate cash actually moves.

For the exam, this area is heavily tested because it rewards precise vocabulary. Questions tend to ask who does what in a card transaction, what a particular fee is called, which party bears a given risk, and which control or standard addresses a specific vulnerability. Candidates who memorize the flow of a card transaction and the roles of each participant pick up these points quickly; candidates who treat the topic as background reading lose them.

In practice, a treasury professional who understands these systems can reduce the merchant discount paid on card receipts, negotiate better acquiring arrangements, deploy purchasing cards to slash procure-to-pay costs, and ensure the organization is not exposed to catastrophic penalties for non-compliance with card industry security standards.

2. What E-Commerce Means in a Treasury Context

Electronic commerce (e-commerce) is the buying and selling of goods and services, and the exchange of related documents and payments, over electronic networks. For CTP purposes, the key distinctions are:

Business-to-Consumer (B2C): A company sells to individuals, typically via a website or mobile app. Payment is dominated by credit and debit cards, digital wallets, and increasingly buy-now-pay-later arrangements. Treasury concerns include card acceptance costs, chargebacks, fraud in card-not-present (CNP) transactions, and the timing of settlement from the acquirer.

Business-to-Business (B2B): Companies trade with other companies. Historically this relied on Electronic Data Interchange (EDI) using standardized formats such as ANSI X12 (North America) and EDIFACT (international). Modern B2B increasingly uses XML-based and ISO 20022 messaging, web portals, and APIs. Payment instruments include ACH (CCD+ and CTX formats carrying remittance data), wire transfers, purchasing cards, and virtual cards.

Electronic Invoice Presentment and Payment (EIPP) is the B2B equivalent of consumer Electronic Bill Presentment and Payment (EBPP). In both models an invoice or bill is delivered electronically and the payer can approve and pay through the same channel. Models include the biller-direct model (payer visits the seller's own portal), the consolidator model (a third party aggregates bills from many sellers, often a bank's online banking site), and the buyer-direct model used in B2B where suppliers submit invoices into the buyer's portal.

Straight-Through Processing (STP) is the goal: an invoice is received, matched, approved, paid, and posted to the ledger with no manual re-keying. STP reduces errors, lowers cost per transaction, and improves cash forecasting because payment timing becomes predictable.

3. The Payment Card Ecosystem: Who Does What

The single most important thing to master is the cast of participants in a card transaction. Exam questions repeatedly test whether you can identify each role.

Cardholder: The consumer or employee who presents the card.

Merchant: The business accepting the card as payment.

Issuer (issuing bank): The financial institution that issued the card to the cardholder, extends credit (credit cards) or debits the deposit account (debit cards), and bears the credit risk on the cardholder.

Acquirer (acquiring bank or merchant bank): The financial institution that has a contract with the merchant, accepts the transactions on the merchant's behalf, and credits the merchant's account. The acquirer bears the risk that the merchant fails to honor refunds or goes bankrupt with outstanding chargebacks.

Processor: A third party (often working for the acquirer or issuer) that handles the technical routing, authorization messaging, and data capture. Some acquirers process in-house; many outsource.

Card network (card association or scheme): Visa and Mastercard operate open-loop four-party networks in which issuers and acquirers are separate banks. American Express and Discover historically operated closed-loop three-party networks in which the network itself is both issuer and acquirer, though both now also license third-party issuers in some markets. The network sets operating rules, sets interchange rates, and operates the clearing and settlement infrastructure.

Payment gateway: In e-commerce, a gateway is the technology service that captures card data from the merchant's website or app, encrypts it, and passes it to the processor or acquirer. Think of it as the online equivalent of a point-of-sale terminal.

4. How a Card Transaction Works: The Three Phases

Authorization: When the card is presented, the merchant (via terminal or gateway) sends an authorization request through the acquirer and network to the issuer. The issuer checks for available credit or funds, fraud indicators, and card status, then returns an approval code or a decline. Authorization places a hold on the cardholder's available balance but does not move money. An authorization is not a guarantee of payment if the merchant later fails to follow network rules.

Clearing: Usually at end of day, the merchant batches its approved transactions and submits them to the acquirer, which forwards them through the network to the issuers. Clearing is the exchange of transaction information that establishes what each party owes.

Settlement: The network calculates net positions, and funds move from issuers to acquirers. The acquirer then credits the merchant's deposit account, net of fees (or gross with fees billed separately, depending on the merchant agreement). Merchant funding typically occurs one to three business days after the transaction. The issuer bills the cardholder on the statement cycle and collects later, which is why the issuer earns most of the interchange.

5. The Cost of Card Acceptance: Fee Vocabulary You Must Know

Merchant discount (merchant discount rate, MDR): The total percentage (plus sometimes a per-item fee) deducted from the merchant's sales proceeds. It is the all-in cost to the merchant and is composed of three layers.

Interchange fee: The largest component, set by the card network but paid by the acquirer to the issuer. Interchange varies by card type (rewards cards cost more than basic cards, commercial cards more than consumer cards), transaction type (card-present is cheaper than card-not-present), merchant category, and data quality. The merchant does not pay interchange directly, but the acquirer passes it through within the merchant discount.

Network assessment fees: Smaller fees paid to the card network (Visa, Mastercard, etc.) for use of the brand and infrastructure.

Acquirer or processor markup: The portion the acquirer keeps for its service. This is the only component the merchant can realistically negotiate.

Pricing models: Interchange-plus (also called cost-plus or pass-through) pricing charges actual interchange plus a disclosed fixed markup, and is favored by larger merchants for transparency. Tiered or bundled pricing groups transactions into qualified, mid-qualified, and non-qualified buckets at blended rates, which is simpler but less transparent and often more expensive. Flat-rate pricing charges one rate on everything and suits very small merchants.

Chargebacks: A reversal of a transaction initiated by the cardholder through the issuer, typically for disputed, fraudulent, or non-received goods. The merchant loses the sale amount and usually pays a chargeback fee. Excessive chargeback ratios can lead to fines or termination of the merchant account. Card-not-present merchants bear far more chargeback risk than card-present merchants.

6. Types of Payment Cards

Credit cards: The issuer extends a revolving line of credit. The cardholder may pay in full or carry a balance. From the merchant's view, credit cards carry the highest interchange.

Charge cards: Like credit cards, but the balance must be paid in full each cycle. Common in corporate travel programs.

Debit cards: Linked directly to the cardholder's deposit account. PIN debit (online debit) routes over EFT or ATM networks such as STAR, NYCE, and Pulse, and is authorized in real time against the account. Signature debit (offline debit) routes over the Visa or Mastercard network and settles like a credit transaction. In the United States, the Durbin Amendment to the Dodd-Frank Act, implemented through Regulation II, caps debit interchange for issuers with more than 10 billion dollars in assets (roughly 21 cents plus 0.05 percent plus a small fraud adjustment) and requires that debit cards be enabled on at least two unaffiliated networks so merchants have routing choice. Exam questions often test that Durbin applies to debit, not credit, and only to large issuers.

Prepaid and stored-value cards: Funds are loaded in advance. Examples include gift cards, payroll cards, and government benefit cards. Closed-loop prepaid cards work only at a specific merchant; open-loop prepaid cards carry a network brand and work anywhere the brand is accepted. Payroll cards are a treasury tool for paying unbanked employees and eliminating paper checks.

Purchasing cards (P-cards, procurement cards): Corporate cards issued to employees for low-value, high-volume purchases such as office supplies, maintenance items, and indirect spend. The treasury rationale is powerful: a traditional purchase order to check cycle can cost 50 to 100 dollars or more in fully loaded processing cost, whereas a P-card transaction may cost a few dollars. Benefits include consolidated billing (one payment to the issuer instead of hundreds of checks), extended float (the company pays the issuer once a month, often with a grace period), rebates from the issuer based on volume, rich data for spend analysis, and reduced accounts payable headcount. Controls include single-transaction limits, monthly limits, Merchant Category Code (MCC) blocking to prevent use at inappropriate merchants, velocity limits, and manager review of statements.

Level II and Level III data: Commercial card transactions can carry enhanced data. Level I is basic (amount, date, merchant). Level II adds sales tax amount and customer code. Level III adds line-item detail such as quantities, item descriptions, unit prices, and freight. Suppliers who pass Level II or III data qualify for lower interchange, and buyers receive data that supports automated reconciliation.

Fleet cards: Specialized commercial cards for fuel and vehicle maintenance, with controls on fuel type, odometer entry, and driver ID.

Travel and entertainment (T&E) cards: Corporate cards for employee travel. Liability may be individual (employee is liable and reimbursed), corporate (company is liable), or joint and several.

Virtual cards and single-use account numbers: A unique 16-digit number is generated for a specific payment, often set to the exact invoice amount and a short validity window. Treasury uses virtual cards to pay suppliers electronically while earning rebates, with far lower fraud risk than a physical card because the number cannot be reused. Virtual card programs are a major driver of accounts payable automation and are frequently tested as an example of both e-commerce payment and fraud mitigation.

7. Security, Fraud, and Compliance

Card-present versus card-not-present: In a card-present transaction the physical card is read by a terminal. In a card-not-present transaction (online, phone, mail order) the merchant cannot inspect the card, so fraud risk and interchange are higher and the merchant generally bears the fraud loss. Mitigation tools include the Address Verification Service (AVS), which compares the billing address supplied against the issuer's records, the card verification value (CVV2, CVC2, CID) printed on the card, and 3-D Secure protocols (Verified by Visa, Mastercard Identity Check) that authenticate the cardholder and shift liability to the issuer.

EMV chip cards: Named for Europay, Mastercard, and Visa. The chip generates a dynamic cryptogram for each transaction, making counterfeiting far harder than with static magnetic stripe data. The United States adopted an EMV liability shift in October 2015: when a counterfeit card is used, liability for the fraud falls on whichever party (issuer or merchant) has not adopted EMV technology. EMV addresses counterfeit card-present fraud; it does not prevent card-not-present fraud, which is why online fraud rose after EMV adoption.

PCI DSS (Payment Card Industry Data Security Standard): A set of requirements maintained by the PCI Security Standards Council (founded by the major card brands) that applies to every entity that stores, processes, or transmits cardholder data. The twelve requirements cover areas such as maintaining a secure network and firewall, protecting stored cardholder data, encrypting transmission over public networks, using and updating anti-malware, restricting access on a need-to-know basis, assigning unique IDs, tracking and monitoring access, regularly testing systems, and maintaining an information security policy. Merchants are classified into Levels 1 through 4 based on annual transaction volume; Level 1 (the largest, over six million transactions annually) requires an annual on-site assessment by a Qualified Security Assessor, while smaller levels may use a self-assessment questionnaire. PCI DSS is a contractual obligation imposed through the card networks and acquirers, not a government law, but non-compliance can trigger fines, higher fees, liability for breach costs, and loss of the right to accept cards. A key treasury strategy is scope reduction: minimizing the systems that touch card data so that less of the organization falls under PCI requirements.

Tokenization: Replaces the actual card number (primary account number, PAN) with a surrogate value (token) that has no exploitable value outside the system. The merchant stores only tokens, so a breach of the merchant's database yields nothing useful. Tokenization reduces PCI scope and is used in digital wallets like Apple Pay and Google Pay.

Encryption: Transforms data using a key so that it is unreadable without the key. Point-to-point encryption (P2PE) encrypts card data at the moment of swipe or dip in the terminal so that the merchant's own systems never see clear-text data. The exam distinction: encryption protects data in transit or at rest but the data can be decrypted; tokenization substitutes a reference value with no mathematical relationship to the original.

Digital wallets and mobile payments: Apple Pay, Google Pay, Samsung Pay, and PayPal store tokenized credentials and use near-field communication (NFC) or in-app APIs. They improve conversion rates in e-commerce and reduce fraud through tokenization and biometric authentication.

8. Treasury's Role in Managing Card Programs

On the receipts side, treasury should: review merchant statements for effective rate and reconcile to deposits; negotiate interchange-plus pricing; ensure terminals and gateways pass full data to qualify for the best interchange; monitor chargeback ratios; evaluate whether to accept all card types or steer customers to cheaper methods such as debit or ACH; consider surcharging or cash discounts where legally permitted; and ensure PCI compliance to avoid penalties.

On the disbursement side, treasury should: champion P-card and virtual card programs to cut processing cost and earn rebates; establish card controls and MCC restrictions; manage the monthly card settlement as a significant cash outflow in the forecast; negotiate rebate tiers and payment terms with the issuer; and work with procurement to enroll suppliers in card acceptance.

In cash forecasting, card receipts are highly predictable in timing (acquirer funding lag) but net of fees, while card disbursements consolidate into a few large payments to issuers, improving disbursement float.

9. Exam Tips: Answering Questions on E-Commerce and Payment Card Systems

Tip 1: Memorize the roles and the direction of money and fees. The issuer serves the cardholder; the acquirer serves the merchant. Interchange flows from acquirer to issuer, and the merchant pays the acquirer a merchant discount that includes interchange. If a question asks which party sets interchange, the answer is the card network. If it asks who ultimately receives most of the interchange, it is the issuer. If it asks who bears credit risk on the cardholder, it is the issuer; who bears risk of merchant default on chargebacks, it is the acquirer.

Tip 2: Know the sequence authorization, clearing, settlement. Authorization checks and holds; clearing exchanges information; settlement moves money. A question describing a hold on available credit refers to authorization, not settlement.

Tip 3: Distinguish card-present from card-not-present. Whenever a question mentions internet, telephone, or mail order, think higher fraud risk, higher interchange, higher chargeback exposure, merchant bears fraud loss, and mitigation by AVS, CVV, and 3-D Secure.

Tip 4: Match the security tool to the threat. EMV chip counters counterfeit card-present fraud. Tokenization and P2PE protect stored and transmitted card data and shrink PCI scope. PCI DSS is the overarching contractual standard. AVS and CVV address CNP fraud. If a question asks how to reduce PCI compliance burden, look for tokenization, outsourcing to a hosted gateway, or P2PE.

Tip 5: Remember that PCI DSS is an industry standard, not a law. The Durbin Amendment and Regulation II, by contrast, are law and regulation, apply to debit interchange only, and apply only to issuers above 10 billion dollars in assets. Questions love to test whether Durbin covers credit cards (it does not).

Tip 6: Know the P-card value proposition cold. The benefits are lower procure-to-pay processing cost, fewer invoices and checks, consolidated monthly payment, extended float, rebates, and better spend data. The controls are transaction limits, monthly limits, MCC blocking, and review. When a question asks for the best tool for high-volume, low-dollar purchases, the answer is almost always the purchasing card.

Tip 7: Level II and Level III data lower interchange for the supplier and improve data for the buyer. If a question mentions line-item detail, think Level III.

Tip 8: Understand pricing models. Interchange-plus is transparent and preferred by sophisticated merchants; tiered pricing obscures costs; flat rate suits small merchants. If asked how a treasurer can lower card acceptance costs, correct answers typically include moving to interchange-plus pricing, ensuring proper data capture to qualify for lower interchange categories, settling batches promptly, and reducing chargebacks.

Tip 9: Open-loop versus closed-loop. Visa and Mastercard are open-loop four-party systems. American Express and Discover are traditionally closed-loop three-party systems. Closed-loop also describes a store-specific gift card; open-loop describes a network-branded prepaid card.

Tip 10: Signature debit versus PIN debit. PIN debit routes over EFT networks and is authorized against the actual account in real time; signature debit routes over the credit card networks. PIN debit is generally cheaper for merchants. Regulation II requires two unaffiliated networks on each debit card to give merchants routing choice.

Tip 11: EIPP versus EBPP and the three presentment models. EBPP is consumer, EIPP is business. Biller-direct means the payer goes to the seller's site; consolidator means a third party aggregates multiple bills; buyer-direct means the buyer hosts the portal and suppliers upload invoices.

Tip 12: Read for the treasury objective behind the question. CTP questions are rarely about technology for its own sake. Ask yourself whether the scenario is about reducing cost, accelerating collections, improving control, mitigating fraud, or enhancing information. Then pick the answer that most directly serves that objective. For example, if the scenario emphasizes supplier payments with fraud concerns, virtual single-use cards beat physical P-cards. If it emphasizes paying unbanked employees, payroll cards beat direct deposit.

Tip 13: Eliminate answers that confuse parties. Distractors frequently swap issuer and acquirer, or claim the merchant pays interchange directly to the network. Knowing the correct relationships lets you eliminate two choices immediately.

Tip 14: Watch for absolute language. Answers stating that EMV eliminates all card fraud, or that PCI compliance guarantees no breach, are wrong. EMV addresses counterfeit card-present fraud only; PCI compliance reduces but does not eliminate risk.

10. Quick Review Summary

Participants: cardholder, merchant, issuer, acquirer, processor, network, gateway.
Phases: authorization, clearing, settlement.
Fees: merchant discount = interchange + assessments + acquirer markup; interchange set by network, received by issuer.
Card types: credit, charge, PIN debit, signature debit, prepaid (open and closed loop), P-card, T&E, fleet, virtual single-use.
Commercial card data: Level I, II, III.
Regulation: Durbin Amendment and Regulation II cap debit interchange for large issuers and require two unaffiliated networks.
Security: PCI DSS (industry standard, 12 requirements, merchant levels 1 to 4), EMV (counterfeit card-present fraud, October 2015 liability shift), tokenization (surrogate value), encryption and P2PE (protects data with a key), AVS and CVV and 3-D Secure (card-not-present fraud).
E-commerce: B2B via EDI, XML, ISO 20022, and APIs; B2C via cards and wallets; EIPP and EBPP with biller-direct, consolidator, and buyer-direct models; straight-through processing as the goal.
Treasury value: lower acceptance cost, faster predictable collections, reduced procure-to-pay cost, rebates, extended float, better data, and controlled fraud and compliance risk.

Master these relationships and vocabulary, and the e-commerce and payment card questions on the CTP exam become some of the most reliable points you can earn.