SUPPLEMENTARY INFORMATION:

Acronyms, Abbreviations, and Definitions

CSC—Card Security Code. A numeric code printed on a payment card by the issuer used to verify possession of the physical card. May also be known as a Card Verification Value (CVV), Card Validation Code (CVC), Card Authentication Value (CAV), or by other similar terms.

EBT—Electronic Benefit(s) Transfer. An electronic system allowing the issuance of benefits via payment cards.

EBT Host Processor—The vendor contracted by a State to operate the State's central EBT database.

EMV—Europay, Mastercard, and VISA. A payment standard in the consumer payment industry for payment cards with an integrated electronic circuit chip and the terminals which accept them.

FNA/the Agency—Food and Nutrition Administration. The Federal agency with oversight over the Supplemental Nutrition Assistance Program.

IVR—Interactive Voice Response. A technology allowing automated customer service interactions to take place over a telephone call.

NFC—Near Field Communication. Protocols which enable wireless communication over short distances for payment cards and their terminals, also known as `tap-to-pay' or contactless payment.

PAN—Primary Account Number, commonly found on payment cards.

PII—Personally Identifiable Information. Any representation of information that permits the identity of an individual to whom the information applies to be reasonably inferred by either direct or indirect means.

PIN—Personal Identification Number. In SNAP, a user-selected numeric passcode used for authentication purposes.

POS—Point-of-Sale—the point where a retail transaction is processed and payments from customers are accepted.

SNAP—Supplemental Nutrition Assistance Program

The Act—The Food and Nutrition Act of 2008, as amended.

TPP—Third-party Processor—within the context of SNAP, a business entity serving as host processor that facilitates enabling a retailer to accept EBT payments

USDA/the Department—The United States Department of Agriculture

WIC—Special Supplemental Nutrition Program for Women, Infants, and Children

Background

SNAP is the largest domestic nutrition assistance program in the United States. In fiscal year 2025, around 42 million low-income individuals received SNAP benefits in an average month to help meet their food needs.

Since 2004, all States have exclusively used EBT cards, which operate similarly to a debit card, to deliver SNAP benefits to households. Most States completed the transition from the paper coupons previously used to EBT cards in the 1990s. At the time of transition, payment cards with magnetic stripes were the predominant form of electronic payment technology in the consumer payment industry. Accordingly, as States transitioned to EBT, payment cards with magnetic stripes were the standard used for EBT as well.

As payment technology has evolved in the years since the universal implementation of EBT, EBT cards utilizing magnetic stripes have fallen behind newer consumer payment methods in terms of security, placing household SNAP benefits at risk. Most EBT systems currently lack security elements common in the consumer payment industry and lag behind in terms of customer experience features as well. The Department employed commercial standards that were in place when EBT was initially rolled out. However, due to evolving consumer payment methods and increased security risks and the Congressional directive to issue proposed rulemaking, the Department must update and modernize those standards to maintain ongoing alignment with the current commercial marketplace.

Through this rule, the Department proposes changes to SNAP with the goal of improving EBT card security, as well as aligning the SNAP client experience to consumer payment processing industry standards, improving both Program integrity and convenience for SNAP clients who depend on the benefits provided to feed their families.

Authority

Section 11 of the Food and Nutrition Act of 2008, as amended (`the Act'), establishes the responsibility of State agencies for issuing benefits via EBT. Section 7(h)(2) of the Act authorizes the USDA to establish and revise standards for EBT issuance.

Section 501(a) Title IV within Division HH of the Consolidated Appropriations Act, 2023, Public Law 117-328, requires that the Secretary promulgate regulations through notice-and-comment rulemaking to require ( printed page 66959) State SNAP agencies to take security measures in detecting and preventing the theft of benefits, including through card skimming, card cloning, and other similar fraudulent methods.

Summary of EBT Technology

Federal regulations at 7 CFR part 271.2 currently define EBT cards as a method for SNAP households to access the EBT system and their SNAP benefits, including via an online magnetic stripe card (requiring connectivity to a central EBT database), an offline smart card (where benefit balances are tracked individually on the EBT cards themselves), a chip card, a contactless digital wallet with a stored card, or any other similar benefit access technology approved by FNA.

However, all agencies operating SNAP have continued to issue benefits via the same payment method used since the transition from paper coupons: EBT cards with magnetic stripes, secured using Personal Identification Numbers (PINs).

Regulations require that households who participate in SNAP be able to use their cards at any FNA-approved SNAP retailer throughout the United States. Each SNAP transaction involves a series of steps and partners that exchange data.

When EBT cards with magnetic stripes are used, the point-of-sale (POS) terminals operated by SNAP retailers read the data stored on the magnetic stripe and send the transaction information, frequently routed by a third-party processor (TPP) via an EBT gateway, to the card-issuing State's EBT host processor, who is responsible for the operation of the central EBT database and tracking SNAP benefit balances for the State. The EBT host processor responsible for the central EBT database containing the benefits subsequently determines if the transaction is approved or denied and routes the response back to the POS terminal.

In addition to SNAP, several other benefit programs including Summer EBT and Temporary Assistance for Needy Families (TANF) are issued on EBT cards. State agencies may provide these benefits on the same EBT card as SNAP or separate EBT cards. In cases where States issue other benefits on the same EBT card as SNAP, those benefits would also be protected by the security improvements proposed in this rule. Although separately issued EBT cards are subject to the same security weaknesses that affect SNAP, they would not be required to comply with the standards proposed in this rule. Regulations for other EBT programs are distinct from SNAP regulations, and changes to requirements for those programs would be promulgated in a separate rulemaking process.

Benefit Theft and Card Security

SNAP benefit theft is a direct threat to the health and well-being of SNAP participants, denying them access to food that they may not otherwise have the financial means to purchase. Ensuring the integrity of SNAP benefits is necessary so that clients can shop for food with confidence in the EBT system and to ensure that benefits are reserved only for eligible SNAP households. Further, fraudulent EBT schemes also constitute the theft of hard-earned, American tax dollars. Under its oversight of SNAP, the Department is responsible for ensuring EBT systems prevent fraud, waste, and abuse of funds.

Historically, it was preferable for bad actors to pursue the cash obtained from credit/debit cards versus the SNAP benefits obtained from EBT cards. Over the last decade, the changing technology used by the consumer payment industry has strengthened protections against credit/debit card theft, yet SNAP continues to rely on magnetic stripes secured only by PINs as the primary means of conducting transactions. Now that credit/debit cards have significantly increased protections and primarily rely on chip and NFC transactions, experienced criminals have turned their attention to EBT cards and implemented the same techniques previously used against credit/debit cardholders. This leaves SNAP participants increasingly vulnerable to benefit theft, potentially forcing them to spend money already budgeted for other necessities on food.

Magnetic stripes as a technology for conducting transactions are inherently vulnerable, as many techniques have been developed that exploit known vulnerabilities. Bad actors may attach devices to POS terminals that can intercept card data to easily access information that is encoded on the magnetic stripe of the EBT card (“card skimming”), such as the Primary Account Number (PAN). PINs can be obtained or guessed by a variety of methods including interception methods, hidden cameras, algorithmic attacks, customer service interactive voice response (IVR) vulnerabilities, and phishing attacks where SNAP clients are deceived into unwittingly divulging PIN information.

In the past, when complete card information was obtained, bad actors still had challenges obtaining equipment that could then write the stolen card information onto a new card (“card cloning”). Due to the cost of complex electronics decreasing over time, card cloning equipment is now more affordable and easily accessible. This has minimized the barrier for bad actors to clone cards and use benefits stolen from the original SNAP benefit account involved.

Additionally, bad actors exploited the expansion of SNAP online shopping as another route to spend fraudulently obtained EBT card information. During the COVID-19 pandemic, the USDA expedited nationwide participation in the previously existing SNAP Online Purchasing Pilot. To help SNAP clients make purchases of food while remaining safely isolated, clients in all States could enter their EBT card number and PIN to make online purchases from authorized SNAP retailers offering pick-up or delivery of SNAP-eligible products. Post-pandemic, SNAP online purchasing continues to be available nationwide. If proper security measures are not implemented in these online purchasing systems, algorithmic attacks can be used by bad actors to attempt large numbers of transactions with varying inputs until they succeed. For example, there is often significant vulnerability to `soft' PINs that may be easily guessed, such as common number sequences (“1234”), or repeating numbers (“1111”).

With this proposed rule, the Department looks to address some of the common vulnerabilities inherent to the transaction technologies currently used in EBT systems by bringing EBT in alignment with the consumer credit/debit industry. The Department intends to take advantage of existing strategies and technologies known to be effective in detecting and preventing theft of SNAP benefits through card skimming, card cloning, and other similar electronic fraudulent methods, with the goal of ensuring the integrity of SNAP benefit issuances.

Availability of Data

Although EBT fraud and benefit theft has attracted national attention in recent years, the Department does not have data that can conclusively and accurately track long-term historical levels of EBT benefit theft perpetrated via electronic methods such as card skimming and card cloning, as historically there were no requirements for States to provide data on EBT fraud.

The Consolidated Appropriations Act, 2023 included time-limited requirements for States to provide FNA with statistical reports on such theft and implement plans to replace stolen SNAP benefits with Federal funds. The data provided by States pursuant to this requirement (starting in Federal Fiscal ( printed page 66960) Year 2023) on the volume of stolen SNAP benefits replaced can be viewed online at: www.fna.usda.gov/​data-research/​data-visualization/​snap-replacement-stolen-benefits-dashboard, and provides FNA and the public with limited insight into the scale and patterns of EBT benefit theft. However, the authority provided by the Consolidated Appropriations Act, 2023 for replacement of stolen SNAP benefits with Federal funds expired on December 20, 2024, so States are once again no longer required to report EBT fraud statistics to the Department. As of the second quarter of Federal Fiscal Year 2025, 753,929 claims for replacement of stolen SNAP benefits have been approved across the nation, with a total replacement value of $360,441,561. A limited number of retroactive claims and associated replacements are expected as States sunset their replacement process. Further, these data only reflect fraudulent transactions for which SNAP households filed claims to replace their benefits during this period and may not capture the full scope of benefit theft during this period.

While the lack of retrospective data makes it difficult to assess historical rates of EBT benefit theft, analysis of publicly available reporting on the topic points strongly to a significant increase in reports of benefit theft to State agencies starting in recent years.

Information Access for Benefit Integrity

Beyond the deficiencies with the transaction method itself, SNAP EBT also frequently lags the consumer payment industry in features available to clients to monitor and secure their benefits. Some existing EBT systems do not make available comprehensive transaction information including the name of the retailer involved. The availability of user-selectable account security options (such as benefit account freezing or blocking of purchases of specific types or in specific locations) also varies widely from State to State.

Ensuring all SNAP clients in every State are fully aware of the details of purchases being made with their account helps to strengthen benefit integrity and enhance the customer experience. Giving SNAP clients access to enhanced account features, many of which are common in the consumer payment industry, will enable them to control how their benefits can be spent and help avoid EBT fraud. SNAP clients must be able to activate and deactivate these accounts freely via online cardholder portal systems, or mobile account information applications, as well as by contacting their local State office via telephone or visiting in person. Offering multiple customer service channels is critical for all services offered to ensure that the disparate needs of SNAP clients are met, including disabled clients or clients with limited internet or mobile phone access.

With these changes, this proposed rule intends to improve the general customer experience of SNAP clients as they purchase food via EBT by giving them greater control and understanding of their benefit account.

Listening Sessions

In 2023, the Department prepared for this proposed rule by conducting 16 listening sessions focused on the migration to EBT cards with electronic chip and NFC payment technology with partners from the SNAP industry, such as: EBT host processors, third-party processors, retailers and retailer associations, anti-hunger advocates, equipment manufacturers, and State agencies. The Department continues to engage with these partners with additional listening sessions facilitated through the USDA EBT Card Industry Forum hosted by the Accredited Standards Committee X9. The Accredited Standards Committee X9 is the American National Standards Institute (ANSI)-accredited standards developing organization that sets standards for exchanging EBT financial transaction messages. Beginning in June 2023, the X9 EBT Card Industry Forum was created, consisting of FNA, State agencies, EBT host processors, third-party payment processors, retailers, point-of-sale providers, the branded card networks, and mobile payment processors. All partners involved in the Forum agreed on the establishment of national standards for mobile payment and electronic chip card technologies to be used in EBT. After an extensive public notice and comment process, the updated EBT standard was officially ratified and published ^[1] by ANSI in August 2024.

Guidance

In October 2022, the Department issued guidance titled “Supplemental Nutrition Assistance Program (SNAP) and Temporary Assistance for Needy Families (TANF) Electronic Benefit Transfer (EBT) Card Skimming Prevention—Tools and Resources” with the intent to educate State SNAP agencies on known forms of benefit theft and recommended prevention tactics.^[2] The Department issued this guidance in response to increasing reports of benefit theft from State SNAP agencies. In March 2023, the Department issued guidance titled “Addressing Stolen SNAP Benefits” to SNAP participants, State SNAP agencies, and SNAP retailers additional regarding best practices to combat benefit theft.^[3]

In the creation of this rule, the Department has considered effectiveness against benefit theft and consistency with consumer payment industry standards, as well as the cost of the requirements to be imposed on parties involved with implementing the EBT changes.

With this proposed rule, the Department seeks comments from the public regarding the potential changes to EBT. The Department will discuss each of the proposed regulatory changes in more detail below.

Discussion of Proposed Rule

SNAP EBT Operating Standards

The Department currently does not utilize any type of operating standards for SNAP EBT-related purposes. As a result, when payment technology that enhances security evolves in the consumer payment industry, the Department is unable to enforce integration of such technology into EBT due to the time constraints of the regulatory process. Financial pressures and lack of updated Federal standards may also cause State SNAP agencies to delay or avoid EBT system enhancements.

The Department proposes the creation and adoption of a set of SNAP EBT Operating Standards into regulation to address these issues. These standards will be found at Appendix A to Part 274—Supplemental Nutrition Assistance Program Electronic Benefit Transfer Operating Standards. This document establishes technical operating standards to be utilized by State agencies (and the contracted vendors acting on their behalf) in their operation of SNAP and EBT payment methods and supplement the regulatory requirements found in 7 CFR 274. The SNAP EBT Operating Standards define a variety of mandatory and optional features for State agencies to implement within their EBT systems and payment methods. Some of the elements covered within the SNAP EBT Operating Standards include transaction ( printed page 66961) processing, documentation, reporting, and system requirements.

The SNAP EBT Operating Standards, in conjunction with the proposed regulatory changes, have the following key objectives:

—Aligning SNAP closer to consumer payment (credit and debit) industry practices

—Ensuring responsiveness to future industry developments

—Reduction of benefit theft targeting SNAP clients

—Increased informational awareness and confidence for clients regarding their SNAP benefit accounts

—Improved SNAP customer experience

—Improved FNA oversight of new EBT implementation projects, database conversions, and system testing

—Enhanced data availability and accuracy for key Program metrics

Along with these key objectives, the SNAP EBT Operating Standards will specifically provide guidance on requirements and standards for: SNAP-authorized retailers; EBT host processors; what is required to perform and process an EBT transaction; how parties to a transaction share and store transaction data; security measures related to EBT transaction fraud and benefit theft; State EBT system implementation; the design, security, and functions of EBT cards; SNAP Online and card-not-present transaction requirements for internet retailers; SNAP EBT mobile payments; and household EBT training.

The Department proposes to create and then subsequently revise the Operating Standards on a regular, ongoing basis. The Department seeks feedback regarding the format and frequency of future revisions.

The SNAP EBT Operating Standards are available within Appendix A of Part 274.

EBT Cards With Chip and NFC Technology

While the regulatory definition at 7 CFR 271.2 for “Electronic Benefit Transfer (EBT) card” includes chip cards within the definition, at the time of this writing there are a limited number of States actively working to transition their EBT payment system to payment cards with electronic chip and near-field communication (NFC) technology, commonly known as EMV (Europay, Mastercard and Visa) technology from the commercial industry's security standard with that name. EBT cards with chip and NFC technology have enhanced security features that mitigate skimming and cloning attacks when compared to EBT cards with only magnetic stripe technology.

Information available to FNA suggests a significant portion of EBT benefit theft is due to skimming of EBT card data facilitated by magnetic stripes. The Department believes that EBT cards utilizing chip and NFC technology are likely to significantly reduce incidences of benefit theft based on information available regarding the transition to chip and NFC technology in the consumer payment industry. In the early stages of chip and NFC adoption, Mastercard fraud data showed a 54 percent decrease in counterfeit fraud costs at US retailers completing chip and NFC adoption from April 2015 to April 2016.^[4] Visa fraud data showed in 2019 ^[5] that merchants who accepted chip and NFC cards “witnessed a 76 percent dip in card present counterfeit payment fraud since the U.S. payments industry began the shift to EMV chip.” The shift to universal adoption of chip technology starting in 2015 (when liability was moved onto retailers for non-chip transactions), and the increasing prevalence of NFC technology in the consumer payment industry, together mean that many SNAP households will likely already be familiar with the use of a payment card with chip and NFC technology. The Department is also hopeful that the experience gained from years of established use of chip and NFC technology in the consumer payment industry will help expedite payment method transitions for all parties as well as reducing costs involved when compared to earlier transitions.

While mobile wallet payment systems may benefit from even greater security due to the use of tokenization, a process that adds an additional layer of authentication to the purchasing process by replacing traditional card data with unique electronic tokens tied to specific devices, the technology is newer and potentially requires significant additional costs to provide token services. The Agricultural Act of 2018 (Pub. L. 115-334) authorizes the use of mobile technologies for the purpose of accessing SNAP benefits for payment at the point-of-sale following up to five initial demonstration projects. The Department will continue the Mobile Payment Pilot and evaluate its results to determine if mobile payment technology should be authorized or required nationwide in the future. At this time, the Department is prioritizing chip and NFC technologies within the existing EBT systems infrastructure to expedite more secure payment methods for all SNAP households.

The Department is proposing a two-year timeframe after the date of publication of a final rule for implementing requirements regarding the issuance of SNAP benefits via EBT cards utilizing chip and NFC technology. This timeframe will allow for sufficient testing of systems with State agencies, third-party processors, EBT vendors, and retailers both large and small, to ensure that no complications arise from the switch in payment technology that could hinder SNAP clients from making the same regular purchases that they rely on. However, the Department encourages and continues to support States moving towards more secure EBT cards before the proposed implementation date. As of August 2026, seven States have issued EBT chip cards to participants with additional States in progress.^[6]

Aligned with this timeframe will be the requirement that States adequately notify households and retailers in advance regarding any such transition in payment method. In conjunction with this, the Department proposes updating the definition of an EBT card, defined at 7 CFR 271.2 “Electronic Benefit Transfer (EBT) card,” to explicitly include cards with integrated electronic chips capable of conducting transactions either by being inserted into a card reader or via wireless NFC protocols. The Department welcomes public comment on the proposed chip and NFC technology implementation timeframe of two years from the date of publication of the final rule and whether that timeframe is both sufficient for compliance and effective at combating electronic benefit theft.

As noted, a limited number of States are now actively working to transition their EBT payment system to EBT cards with chip and NFC technology. It is clear that transition to payment processing via chip and NFC transactions will require significant system changes for all parties involved, along with replacement of EBT cards for all participants, as well as cooperation by retailers upgrading their equipment to comply with the requirements needed to accept payments via EBT cards with chip and NFC technology. The Department believes that the best approach would be an expedited nationwide transition to EBT cards with chip and NFC technology, as opposed to a limited pilot program. This expedited ( printed page 66962) approach would be best due to the scale of the existing nationwide threat of SNAP benefit theft through the skimming of EBT cards with magnetic stripes, demonstrated clearly with at least $360 million in stolen benefits that have been replaced through the second quarter of Federal fiscal year 2025. Furthermore, an expedited transition would streamline interoperability concerns and transition communications for SNAP households.

The Department acknowledges that a transition to EBT cards with chip and NFC technology will come at a financial cost to the State agencies administering SNAP and to other entities involved in the operation of EBT systems. However, the Department believes that it is critical for SNAP clients to have reliable and secure access to the benefits that they use to purchase food for their families, and that the transition to chip and NFC cards in the credit/debit industry has proven the effectiveness of the technology involved in reducing incidents of fraud. Letting the consumer payment industry lead in transitioning payment technology has positioned EBT to benefit from experiences gained there and will help avoid costs that would otherwise be encountered in developing untested payment technology. Further, as stewards of taxpayer dollars, the Department considers these administrative costs as a necessary investment to deter the loss of Federally-funded SNAP benefits.

The Department also encourages State SNAP agencies to work with retailers and retailer associations to ensure that as many SNAP retailers as possible complete preparations for the acceptance of EBT transactions via chip and NFC before State SNAP agencies begin the process of replacing existing SNAP cards, to simplify the transition from the perspective of SNAP households who might otherwise face confusion over which transaction methods should be used at individual retailers. Furthermore, the Department encourages State SNAP agencies to educate SNAP households regarding the security benefits of chip and NFC technologies to conduct transactions.

Given the current prevalence of issues with the timely delivery of benefits in accordance with 7 CFR 274.2(b), the Department is specifically interested in comments from State SNAP agencies on the impact that migrating to EBT cards with chip and NFC technology would have on over-the-counter issuance of EBT cards and for State operations.

With the goal of a smooth transition to EBT cards with chip and NFC technology, there will be a need for retailers to continue to accept transactions via EBT card with magnetic stripe, for the time being (although fallback rules would enforce the requirement of inserting/tapping a card with a chip to attempt the transaction in that manner before the magnetic stripe could be used). As such, the Department is also interested in understanding the costs that will be borne by State agencies, third-party processors of EBT transactions, and retailers to ensure that point-of-sale machines can properly fall back to accepting magnetic stripe transactions if chip/NFC-based transactions fail or are otherwise unavailable (such as during a period of transition, or due to shopping across State borders in a State that has not yet transitioned to EBT cards with chip and NFC technology).

One consideration for moving to EBT cards with chip and NFC technology is the limited lifespan of chip technology. As a result of this, EBT cards with chip and NFC technologies will have expiration dates. The Department proposes to update regulations at 7 CFR 274.6(b)(3), 274.6(b)(5), and 274.6(b)(6) to clarify that EBT cards replaced as a result of their expiration date, or replaced as a result of a change in benefit delivery method, must not be counted towards the threshold for the number of card replacements considered excessive in 7 CFR 274.6(b)(5).

In conjunction with the move to EBT cards with chip and NFC technology, the Department is proposing to update regulations at 7 CFR 274.8(b)(5)(vi) to specify that the PAN on each EBT card shall be printed on the back of the card. This will enhance security measures by making it more difficult to capture account information visually from EBT cards and is aligned with the consumer credit/debit industry.

Magnetic Stripe

EBT's current reliance on magnetic stripes for payment cards is a major enabler of benefit theft, as the account information stored on the magnetic stripe can be easily read in plain text by skimming devices that intercept card data during a transaction. This creates an incentive for thieves who may have targeted credit/debit transactions in the past, when they were conducted mainly via magnetic stripe, to now focus their efforts on EBT cards made more vulnerable as one of the last remaining payment methods conducted almost exclusively via magnetic stripe.

The consumer payment card industry has begun preparations to phase out magnetic stripes, with Mastercard stating in 2023 that “by 2033, no Mastercard cards will have magnetic stripes.” ^[7] With this in mind, the Department is seeking public comment specifically related to the eventual removal of magnetic stripes from EBT cards, particularly regarding:

—Barriers to the removal of magnetic stripes

—Alternative methods of conducting transactions if chip and NFC technology fails at the point-of-sale

—Interoperability issues

—Timeframe for removal

The Department proposes revising the existing regulation at 7 CFR 274.8(b)(3)(ii)(C) to remove the reference to EBT cards specifically containing magnetic stripes in advance of any transition away from their use, as well as revising references at 7 CFR 274.6(b) to clarify that the card replacement methods within that section of regulations apply specifically to physical card replacements. This will enable a transition away from magnetic stripe technology in the future and ensure clarity if SNAP benefits are to be delivered via EBT cards in non-physical form such as virtual cards in mobile wallets.

End of Manual Voucher Transactions

SNAP regulations in the past allowed SNAP retailers to redeem benefits using manual vouchers if they did not have, or were unable to use, a POS device to process SNAP transactions at the time of the purchase. This was designed to help ensure that SNAP clients would not be denied the ability to use their benefits as the result of unreliable EBT system connectivity.

Since these manual voucher transactions do not require the use of a secure PIN, they have been shown to be susceptible to fraud. The Agricultural Act of 2014 (2014 Farm Bill) amended Section 7(f) of the Act to prohibit the use of manual vouchers for benefit redemption, except in the specific cases where the Secretary determines they are necessary such as due to an EBT system outage or a disaster. The 2014 Farm Bill also provided the Department with the option to exempt certain retailer categories from this prohibition based on established criteria established by the Secretary if the Department determined it appropriate.

The March 21, 2014, implementing memorandum for the 2014 Farm Bill ^[8] stipulated that this manual voucher restriction would be effective immediately for any newly authorized ( printed page 66963) retailer. However, the memorandum also noted that until regulations were promulgated, the Secretary was exempting those existing retailers that were already using manual vouchers for ongoing business. At the same time, the implementing memorandum stated that it was “the intent of the Secretary to largely eliminate manual vouchers as a means to conduct ongoing business through regulations, but [that FNA would] use the regulatory process to fully define the extent continued usage will be permitted.” Consistent with that stated intent, this rule proposes to codify elimination of the usage of manual vouchers except in disasters or in the event of an EBT system failure, with other exceptions being limited.

Proposed language revising 7 CFR 274.3(a)(1)(i) would stipulate manual vouchers be authorized only when there is a significant EBT connectivity problem. This could occur as the result of either system issues, or other outage issues, including those resulting from a natural disaster. The Department's expectation is that State SNAP agencies would require of their EBT vendors that the processing of manual vouchers be disabled by default. Manual vouchers would then be enabled by EBT vendors upon request by their State SNAP agency, restricted to certain geographic areas as appropriate. FNA would monitor for manual voucher use that would be considered excessive on an ongoing basis, and work with States to resolve any issues encountered. In situations where manual voucher use is not being appropriately restricted and sufficient levels of fraud are being encountered as a direct result, FNA may seek disallowance of administrative funding under 7 CFR 276.4(a)(2) and 276.4(a)(3) regarding State agency responsibilities for preventing losses of Federal funds.

It is important to note that manual voucher transactions are an extremely small minority of SNAP transactions in total.^[9] The proposed changes to manual vouchers would primarily impact retailers that conduct business via delivery routes as well as some retailers operating in remote areas; both have been known to rely on manual vouchers historically as their principal method of benefit redemption. Those retailers would be expected to utilize some form of mobile POS device or mobile POS phone/tablet application to conduct their business, with both approaches becoming even more commonplace in the consumer payment industry since the implementing memorandum for the 2014 Farm Bill. Since the passing of that legislation, general internet connectivity nationwide has improved significantly. A June 2020 Government Accountability Office report ^[10] indicated that, based on FCC data, broadband internet availability in rural areas of the US increased from 45.7% to 77.7% from 2012 to 2018.

The Department will consider allowing limited exceptions on a case-by-case basis in specific scenarios, and seeks public comment regarding the need for these exceptions:

First, the Department will consider an exception for retailers that regularly process transactions via manual vouchers in rural areas that do not have internet connectivity, such as some areas of Alaska, making it impossible to utilize mobile POS devices or mobile POS phone/tablet applications.

Second, the Department will consider exempting retailers who are eligible for free State-provided EBT equipment due to the nature of their organization.

Third, the Department will consider exempting retailers in designated Tribal areas from requirements regarding manual vouchers. During consultation with Tribal leaders on March 15, 2024, a summary of this proposed rule was presented and there were no concerns expressed.

EBT Equipment Costs

To better align SNAP with current industry practices, the 2014 Farm Bill amended Section 7(f) of the Food and Nutrition Act to require that all non-exempt retailers be financially responsible for any EBT equipment, supplies, and related services needed to participate in EBT. As a result, most retailers are no longer eligible to receive free EBT equipment, supplies, and related services to participate in SNAP which they may previously have been eligible for.

This legislative change recognized that credit and debit card usage is more prevalent today than it was when EBT was first implemented, and the equipment needed for card acceptance has become nearly ubiquitous. The statute provided exemptions for farmers markets, direct marketing farmers, military commissaries, non-profit food buying cooperatives, and establishments, organizations, programs or group living arrangements described in clauses (3), (4), (5), (7), (8), and (9) of section 3(k) of the Act. While this change was put in place by the March 21, 2014, FNA implementing memorandum,^[11] it must still be codified in regulations.

This proposed rule would codify the statutory provision by making changes accordingly at 7 CFR 274.3(a)(2). The Department also proposes changing regulations in this area at 7 CFR 274.3(b) to remove outdated requirements regarding EBT terminal deployment, to properly reflect that FNA currently only requires States to provide no-cost, EBT-only POS equipment to retailers exempted by the Agricultural Act of 2014 from the requirement that SNAP retailers pay for their own EBT equipment. All other retailers must source their own equipment to be able to process EBT transactions.

SNAP Transaction and Account Information Access

Informational awareness is a critical element in benefit theft prevention and early detection of signs of potential fraud. 7 CFR 274.7(d) requires that SNAP households be able to access their account balances, and that EBT systems be “. . . capable of providing a transaction history for a period of up to 2 calendar months to households . . .” but the existing regulation does not specify the information regarding each transaction which should be included in that transaction history, nor how quickly the systems which display this information to SNAP clients be updated with new transaction data.

As a result, existing online account management systems and mobile account information applications accessed by SNAP participants in some States do not currently display detailed information such as retailer names and locations of prior purchases made, and do not offer participants the ability to review certain activity on their account such as balance inquiries. The lack of a requirement for immediate updates to this information also means that some EBT systems only make SNAP transaction information available after a delay. Both of these shortcomings hinder the abilities of SNAP households to review and confirm the activity on their own account to ensure purchases made and other actions taken are legitimate.

The Department intends to create new provisions in SNAP regulations at 7 CFR 274.8(b)(4)(i)(H) and 274.8(b)(4)(i)(I) to specify information which must be made available to SNAP participants when they review their benefit account through an online account management ( printed page 66964) system or mobile account information system, including:

—Transaction dates, times, and amounts

—Type of transaction (card-not-present or card present. Card-not-present transactions would be encountered when making purchases from internet retailers)

—Identifying information for retailer, excluding FNA retailer numbers

—History of balance inquiries made

—History of PIN changes

—History of other personal account information changes including address, email address, and telephone number

The Department also intends to revise SNAP regulations at 7 CFR 274.7(d)(2) to require EBT systems to provide 12 months of transaction history instead of the current requirement of 2 months. This will align SNAP with the Consumer Financial Protection Bureau's Regulation E requirements for electronic fund transfers at 12 CFR 1005.15(d)(1)(ii).

These regulatory updates will also require that the required information be made available to SNAP clients immediately after SNAP purchases are made. With these changes in place, the Department believes SNAP households will have greater informational awareness regarding the integrity of their account and will be able to monitor their benefit account for potentially fraudulent transactions.

One concern regarding this information being made available involves victims of domestic violence. There is the possibility that a household member who has fled a domestic violence situation could be tracked using a SNAP online cardholder portal or cardholder mobile application by another household member with access, who would be able to review the location of purchases made with the SNAP benefits. The Department is considering requiring that State agencies accept verified requests via telephone or in-person contact to disable all location-based account information (including masking transaction locations) in their online cardholder portal and mobile application for a specific account, and requests comment from the public in this area specifically.

Balance Inquiries

At this time, there are no requirements regarding verification of minimum information for a balance inquiry to be conducted via IVR. As a result, it is possible for bad actors to conduct bulk balance inquiries via the EBT customer service phone number. These bulk balance inquiries facilitate benefit theft by making it significantly easier for bad actors to determine which card data can potentially be exploited.

To prevent benefit theft, the Department proposes creating regulations at 7 CFR 274.7(d)(4) and using the SNAP EBT Operating Standards document (see Appendix A to Part 274) to require that SNAP balance inquiries conducted via IVR shall require verification. This will help reduce incidents of bad actors using IVR as a method of enabling and expediting benefit theft—a pattern that has been noted across the country by State SNAP agencies reporting to FNA trends in EBT benefit theft. The verification must involve secured information (such as additional card security features) but should not involve PII, as a SNAP household may include multiple persons shopping with the benefits of the SNAP account.

As an additional measure to ensure the integrity of balance inquiries, the Department intends to revise existing regulations at 7 CFR 274.7(d)(1) to permit internet retailers to conduct business without offering a method of balance inquiry. Online balance inquiry methods can be vulnerable due to security flaws, and FNA regularly grants waivers in this area currently as a matter of business. The Agency has not received any complaints regarding balance inquiry availability after 5 years of the pilot program for SNAP online purchasing. Though the Department considers it a safe assumption that households who are making SNAP purchases online can conduct a balance inquiry online in a secure manner by logging into their State's SNAP cardholder portal or mobile application, public comments regarding the accessibility and security of balance inquiries are welcomed.

In addition, the introduction of internet retailers has brought awareness to the outdated requirements in 7 CFR 274.7(d)(3) and 274.8(b)(7) that mention printed receipts. Since many internet retailers (and some brick-and-mortar retailers) now take advantage of electronic receipts, the Department proposes revising these regulations to remove the word “printed” to clarify that retailers may also provide receipts via electronic means.

Household Training Updates

Current regulations at 7 CFR 274.2(e) on household training requirements for SNAP households do not specify that the households be trained on best practices to avoid EBT benefit theft, although FNA does offer a Tips and Resources website ^[12] with suggestions for SNAP clients to follow to reduce incidents of SNAP fraud.

Household training should empower SNAP households not only with the knowledge needed to use their SNAP benefits, familiarity with program requirements, and awareness of time limits for using SNAP benefits before they are expunged, but also with knowledge of security best practices that will reduce their chances of being a victim of benefit theft. The training requirements' message and format should also balance not overwhelming participants with information that prevents them from absorbing the most important knowledge.

The Department proposes updating the household training requirements accordingly. The Department does not intend to change or specify to State agencies the method in which each element of household training should be delivered, as long as all clients can be assured to receive all elements of the required household training.

The Department proposes revising training requirements to include familiarizing participants specifically with:

—Timeframes within which households are to be given the opportunity to participate (also known as timeliness requirements);

—The issuance schedule and availability date for households to access their benefits;

—The appropriate utilization and security of the EBT card's PIN including a number of important steps to take in fraud prevention;

—Responsibilities in reporting theft of or damage to a physical EBT card, and responsibilities in reporting suspected fraud;

—Information regarding EBT card replacement, including any applicable fees;

—Requirements regarding availability of information in languages other than English, for households with disabilities, and the inclusion of civil rights statements;

—Information needed to recognize retailers where EBT benefits can be used;

—Information regarding retailer-initiated debit adjustments and a household's right to notice, fair hearings, and provisional credits, as well as how to dispute such adjustments by requesting a hearing and the timeframes involved; ( printed page 66965)

—The right to request an adjustment in case of an error transaction and the timeframes involved;

—Timeframes involving benefit expungement;

—Information regarding replacement of food destroyed in a household misfortune including the timeframe for a timely report;

—Food that is eligible for purchase with SNAP benefits;

—The prior payment prohibition described in 7 CFR 274.7(b);

—Information on transaction limits as described in 7 CFR 274.7(c);

—Information regarding container deposit fees;

—Common methods of EBT theft and how to avoid them;

—Where information regarding rights and responsibilities as a SNAP client can be found;

—Information regarding expiration dates on physical EBT cards and the resulting replacement, in order to avoid client confusion with misinterpreting expiration dates as reflecting either benefit expungement or certification period end dates.

Codifying Common Waivers

FNA routinely receives EBT waiver requests regarding client-initiated credit adjustments and retailer-initiated debit adjustments that replace the timeliness standard of 10 business days with an extended time period of 15 calendar days and that allow State SNAP agencies to act on retailer-initiated debit adjustment requests without placing a hold on the adjustment balance in the household's account. The Department proposes revisions to regulations at 7 CFR 274.2(g)(2) to bring the procedures for client-initiated credit adjustments and retailer-initiated debit adjustments in line with these waivers, which are commonly approved, to simplify SNAP operations and ensure that State agencies will not need to potentially revise training material contingent on waiver approval or denial.

The Department also proposes revisions to 7 CFR 274.2(f)(2)(i) regarding the ability of clients to select PINs for their EBT cards via IVR telephone system. Current regulations state that PINs provided to or selected by SNAP clients for use in accessing benefits in the household's EBT account must be encrypted, at a minimum, from the point of entry, in accordance with the current requirement at 7 CFR 274.8(b)(3)(ii)(C). This protects the client's PIN both when the client is initially selecting it at the local office and afterwards when using it to make a purchase at a POS device. Because of this encryption, the PIN cannot be viewed or obtained by someone else with access to the system, whether authorized or not. However, due to these regulations, States have needed to obtain a waiver from this requirement to allow clients to select their own PINs over a telephone or cellular line through an IVR system, a process in which the PIN is not encrypted when the client first enters a PIN of his/her own choosing. FNA has approved this waiver to allow States to provide this enhanced customer service. However, in doing so, the Agency has also reminded States that they would have liability for any losses resulting from this procedure.

In response to State waiver requests, the proposed rule would allow States the option to give clients the ability to select their own PIN at their convenience without having to visit the local certification office. While this procedure is consistent with the PIN selection process used by commercial bank customers, it does pose inherent risks when compared to the encrypted capture and transmission of a PIN from the point-of-entry utilizing PIN select devices. As a partial safeguard, the Department would also require the process to be completely automated, with no involvement of a customer service representative, and that clients using this process would need to enter two elements of their personally identifiable information (PII) to confirm their identity. Consistent with Section 7(e)of the Act, and FNA regulations at 7 CFR 274.1(d)(1). FNA would also continue to require States to accept liability for any losses resulting from this procedure, such as the replacement of the lost benefits due to an unauthorized transaction, compromise in security, or incorrect identification of the person requesting a PIN via the telephone.

Implementation of Specific Anti-Fraud Measures in EBT Systems

EBT vendors offer to State SNAP agencies a variety of optional card security services focused on combating EBT fraud. Many of these services involve household-selected options to restrict usage of their account in some form, while other services can affect how households manage use of their benefits. However, States are not required to elect any of the most common card security services designed to reduce levels of EBT fraud.

Section 501(a) of Title IV within Division HH of the Consolidated Appropriations Act, 2023 required that the Department issue guidance to State SNAP agencies to protect and replace SNAP benefits stolen via card skimming, card cloning, and other similar fraudulent methods. In response to this, the Department published Tips and Resources ^[13] regarding fraud mitigation best practices for SNAP participants, State SNAP agencies, and SNAP retailers. One of the recommendations for State SNAP agencies was to “Let SNAP households know how to opt into card security services that proactively protect their cards and PINs.” However, SNAP clients are unable to opt into card security services when they live in a State that has not worked with their EBT vendor to make some or all of these card security services available. Different State SNAP agencies have elected to implement different optional card security services, leaving households with different treatment and protections depending on their location.

The Department proposes adding a new regulation at 7 CFR 274.7(k) to require that all State SNAP agencies offer a minimum list of specific card security services, referred to as participant-selected account options. The regulation will refer to the SNAP EBT Operating Standards (see Appendix A to Part 274), which will contain the list of specific card security services required, many of which are designed to reduce incidents of benefit theft.

The Department also proposes updating 7 CFR 274.7(d) to require that States establish standards covering client access to platforms such as client websites, EBT cardholder portals, or mobile applications that clearly inform clients of balances, features, security options, and other services available for their EBT account.

First, regulations at 274.2(f)(2)(i) and the SNAP EBT Operating Standards document (see Appendix A to Part 274) will require that States disallow the use of common PINs, including PINs with:

—Entirely sequential digits (with zero considered sequential to both one and nine);

—Entirely reverse sequential digits (with zero considered sequential to both one and nine);

—One digit repeated for the entire length of the PIN;

—The last digits of the associated EBT card's PAN;

—Entirely alternating digits ( e.g., 1212, 8989, or 5454);

—The first two digits 19 (potential birth year vulnerability);

—The first two digits 20 (potential birth year vulnerability);

—The sequential digits 2580, 8520, 0852, or 0258 (these sequences are ( printed page 66966) common as they reflect the vertical digits of a numeric keypad in order).

Second, the SNAP EBT Operating Standards document will require that States offer SNAP households the self-service ability to elect or remove all of the following specific account options at a minimum:

—An account block on out-of-State transactions;

—An account block on card-not-present (online) transactions;

—An account block on all transactions;

—Alerts delivered via email or text message for purchases on the account, including rejected purchases, out-of-State purchases, and purchases over a user-selected limit;

—Alerts delivered via email and/or text message for specific account activity such as PIN changes, balance inquiries, and changes to personal account information such as address, email address, or telephone number;

—A user-selected maximum transaction limit, over which all transactions are to be blocked.

There are some States which, working with their EBT host processors, have already opted to provide transaction blocking account options to SNAP households. In States where these options are available, a particular type of blocking (for example, an account block on out-of-State transactions) may be enabled by default for SNAP households as long as States adhere to statute and regulations regarding interoperability and ease-of-use for EBT transactions. The Department seeks comments on concerns or benefits related to blocking transactions by default.

Clients must be able to opt-in to these account options via all of the following methods, and clients should not be restricted in making such a selection in any way by disability or speaking a primary language other than English:

—EBT cardholder portal

—Mobile application or equivalent mobile-first web interface

—Telephone request

—In-person request

Fourth, newly proposed regulations at 274.2(f)(3) and the SNAP EBT Operating Standards document will require that States issue EBT cards that are not active until the recipient takes actions to enable the card.

Vendor Monitoring of EBT Terminals

Current regulations require State SNAP agencies to ensure that only authorized retailers can access the EBT system. This is important to the integrity of the EBT system, as unauthorized EBT terminal usage by bad actors can facilitate the commission of EBT fraud in several ways.

First, bad actors can use EBT terminals to verify skimmed card data by attempting to make purchases or balance inquiries to determine which benefit accounts they are able to access.

Second, bad actors can utilize fraudulent balance inquiries to facilitate algorithmic attacks where large quantities of transactions are attempted using computer automation to find access to new benefit accounts.

Third, bad actors can input fraudulent transactions to drain funds from SNAP benefit accounts. These events have been encountered in greater numbers in recent years, as witnessed by State agencies monitoring terminal usage and receiving reports of fraud. Illegitimate access is made possible by third-party processors or their contracted independent sales organizations ( e.g., sub-vendors), who facilitate payment for EBT transactions via the EBT gateway. When third-party processors and independent sales organizations fail to verify that retailers they transact with are authorized by FNA to participate in the program before they process any transactions from a given retailer, they make it possible for bad actors to access the EBT system. The Department is exploring various ways to address this issue, in alignment with the priorities of the Task Force to Eliminate Fraud established in Executive Order 14395.^[14]

The Department proposes revising 7 CFR 274.3(e)(4) and 274.8(b)(3)(v)(F) to clarify that State SNAP agencies, and by extension their contracted EBT vendors, both play a critical role in denying access to bad actors and must perform adequate due diligence. EBT terminal usage must be actively monitored by the EBT vendors contracted by State SNAP agencies to remove unauthorized terminal access to the EBT system, in accordance with existing regulations at 7 CFR 274.8(b)(3)(ii)(A) which require controls to “ensure acceptance of data from authorized terminals only.”

FNA is improving fraud prevention efforts with support from third party vendors by providing ways in which FNA can block miscoded payment terminals from accessing the EBT network. FNA expects that State agencies and their contracted EBT vendors will investigate and consider such terminals for deactivation. Additionally, FNA is working with State agencies and providing technical support to help identify and block miscoded terminals. New retailers participating in the EBT system with addresses that do not match the address registered for their FNA retailer account number must also be investigated where possible.

In the event of unchecked fraudulent activity, clear signs of unauthorized access, or other similar negligence with no response or action taken to address an ongoing issue, FNA may seek disallowance of administrative funding under 7 CFR 276.4(a)(2) and 276.4(a)(3) regarding State agency responsibilities for preventing losses of Federal funds.

Requiring Timely Updates to EBT Systems in Accordance With the X9.58 Technical Specifications

Current regulations require that State SNAP agencies ensure their EBT systems comply with technical specifications established by the American National Standards Institute (ANSI) and International Organization for Standardization (ISO) where applicable, but do not explicitly cover technical specifications established by the Accredited Standards Committee (ASC) X9. ASC is responsible for the development of their technical specification X9.58 Financial transaction messages—Electronic benefits transfer (EBT)—Supplemental Nutrition Assistance Program (SNAP) to accommodate the use of EBT cards with chip and NFC technology, as well as specifying all aspects of EBT financial transaction data transmission. The latest revision to the ASC X9.58 technical specification was released in 2024,^[15] but the Department also assumes that ASC X9 will implement additional revisions in the future, as payment technology continues to grow and evolve. The ASC X9.58 technical specification has previously been updated in 2022, 2013, and 2007. When updates are made to the ISO 8583 or ANSI X9.58 specification, or other applicable specifications, the Department proposes that State agencies ensure EBT systems comply with the new version of the specification within 180 days from the publication of the updated specification.

The Department welcomes public comment on the 180-day timeframe for compliance, with the understanding that deploying upgrades to EBT systems can require significant financial resources in addition to the time and staffing requirements needed to ensure successful deployment.

The Department also proposes revising regulations at 7 CFR 274.8(b)(3)(iv)(B) to require that State ( printed page 66967) EBT systems and data processing centers utilize multifactor authentication as a method of enhancing internal security. Multifactor authentication is commonly used in the consumer payment industry and requires at least two forms of verification to protect online accounts, such as password, a one-time pin sent to a verified email or phone, and user selected challenge question.

Delete References to Offline EBT Systems

Regulations at 7 CFR 274.1(b) currently require SNAP benefits to be issued via either an online EBT system involving a central computer database accessed electronically by EBT cards at the point of sale, or an offline EBT system with benefit allotments stored on EBT cards. 7 CFR 274.1(b)(2) currently permits State agencies to issue SNAP benefits through an offline EBT system in which “. . . benefit allotments can be stored on a card or in a card access device and used to purchase authorized items.”

No States currently use an offline EBT system, and none are expected to in the future. Given that all States now utilize an approach to managing accounts in which benefits are issued from and stored in an online central databank, as well as the existence of new initiatives such as online purchasing and mobile payments, each relying significantly on online EBT systems, the Department does not believe an offline EBT system would be a viable alternative to online EBT systems going forward. Only two States have ever used an offline EBT system for SNAP. The last State to use an offline EBT system was Wyoming, which moved to an online EBT system in May 2007.

In addition to these developments away from offline EBT systems, 7 CFR 271.2 currently defines EBT as a system where benefits are “. . . issued from and stored in a central databank.” This also points away from an offline system where benefits are primarily stored on the cards. As a result of these factors, the Department is proposing to update the regulations by removing 7 CFR 274.1(b) and adding `online' to the definition of an EBT system in 7 CFR 271.2 “Electronic Benefit Transfer (EBT) system”. As noted, no States would be impacted by this change.

Related to this change, the Department proposes modifying regulations at 7 CFR 274.1(c) to note that when the Secretary, in consultation with the Office of Inspector General, determines that program integrity would be improved by changing the issuance system of a State, the alternative method would no longer be limited to one of the methods currently described in 274.1(b). This will allow States to utilize methods of payment issuance in the future that may not exist currently, as consumer payment technology continues to develop.

Implementation of Card Security Code (CSC) and Expiration Date

SNAP's existing Online Purchasing Pilot began in 2019 and quickly expanded to all States as a result of the COVID-19 pandemic. While much of the online shopping experience is consistent with online purchasing using credit/debit cards, a significant difference is the lack of printed card security codes, or CSCs, and expiration dates on EBT cards. The type of CSC that will be most familiar to users of debit and credit cards is the 3 or 4-digit code printed on the payment card, which is commonly entered by the customer when conducting card-not-present transactions with internet retailers (along with other information such as zip code and expiration date of the card).

Since the CSC and expiration date are not encoded in the data on the card but merely printed on the surface of the card and entered at the time of purchase, this information cannot be obtained by traditional electronic skimming methods that take data from a payment card's magnetic stripe. The addition of the CSC and expiration date significantly enhances security for card-not-present (online) transactions by requiring customers to enter these additional values which are not encoded in the data on the card and are not stored at any time by retailers.

The Department intends to revise regulations at 7 CFR 274.8(a)(2)(ii) and use the SNAP EBT Operating Standards document to require specific security measures for card-not-present (online) transactions, including primarily the use of a CSC and expiration date as part of these transactions. This will mirror best practices already established in the consumer payment industry.

While this will add an additional step to card-not-present (online) transactions, the Department considers this additional step worth the value provided in terms of reducing benefit theft. Many households will already be familiar with the entry of a CSC and expiration date while making online purchases, due to the prevalence of the requirement when using credit/debit cards, so this additional step is unlikely to cause confusion when encountered.

Interoperability and Interchange Fees

Existing regulations regarding interoperability including 7 CFR 274.8(b)(10) apply to all aspects of any changes resulting from implementation of the requirements of this rule. Benefits issued via EBT by any one State must continue to be able to be redeemed for food purchases in any other State. Therefore, no State should take actions in response to this rule which would prevent benefits issued from being redeemed in another State.

The Department also proposes adding a new section in the regulations at 7 CFR 274.3(a)(4) to clarify that interchange fees shall not apply to any EBT transaction, even if the retailer uses commercial equipment provided by an independent third-party processor to accept SNAP benefits. These changes will align regulations with the prohibition of interchange fees in Section 7(h)(13)(A) of the Food and Nutrition Act.

Mobile Purchasing Virtual EBT Card Provisioning

The SNAP Mobile Purchasing pilot remains in progress at this time. The Department looks forward to recommendations that will be made in the future resulting from the resolution of the pilot with regard to provisioning of virtual EBT cards on mobile devices for making SNAP payments. Outcomes from the pilot will be used to inform future rule making or updates to the SNAP EBT Operating Standards. Therefore, this rule does not propose any regulatory changes regarding virtual EBT cards on mobile devices at this time.

Procedural Matters

Executive Orders 12866 and 13563

Executive Orders 12866 and 13563 direct agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, distributive impacts, and equity). Executive Order 13563 emphasizes the importance of quantifying both costs and benefits, of reducing costs, of harmonizing rules, and of promoting flexibility.

This proposed rule has been determined to be economically significant under section 3(f)(1) of Executive Order 12866 and was reviewed by the Office of Management and Budget (OMB). ( printed page 66968)

Regulatory Impact Analysis Summary

As required for all rules that have been designated as Significant by the Office of Management and Budget, a Regulatory Impact Analysis (RIA) was developed for this proposed rule. It follows this rule as an Appendix. The following summarizes the conclusions of the regulatory impact analysis:

Need for Action: Required to reflect mandates within Section 501 of the Consolidated Appropriations Act of 2023 (Pub. L. 117-328, the Omnibus) to modernize Electronic Benefit Transfer (EBT) technology and improve EBT security measures required to prevent EBT benefit theft committed by electronically stealing EBT card information and similar methods.

Benefits: Reduces the amount of SNAP benefits electronically stolen from SNAP participants. In turn, these individuals may experience reduced psychological stress and financial insecurity. There may also be improved trust in government programs, improved fairness in payment security for low-income households, and improved access to information and knowledge.

Costs: This proposed rule would result in one-time burdens for State agencies, the Federal Government, households, and businesses at implementation (roughly $283 million combined in FY 2028-2029). There would also be ongoing costs to State agencies, the Federal Government, and businesses starting in FY 2030 ($12 million in that year, roughly $152 million in total FY2028-2037).

Regulatory Flexibility Act

The Regulatory Flexibility Act (5 U.S.C. 601-612) requires Agencies to analyze the impact of rulemaking on small entities and consider alternatives that would minimize any significant impacts on a substantial number of small entities. Pursuant to that review, it has been certified that this rule would have a significant impact on a substantial number of small entities.

Congressional Review Act

Pursuant to the Congressional Review Act (5 U.S.C. 801 et seq.), the Office of Information and Regulatory Affairs designated this rule as a `major rule' as defined by 5 U.S.C. 804(2).

Unfunded Mandates Reform Act

Title II of the Unfunded Mandates Reform Act of 1995 (UMRA), Public Law 104-4, establishes requirements for Federal agencies to assess the effects of their regulatory actions on State, local and tribal governments and the private sector. Under section 202 of the UMRA, the Department generally must prepare a written statement, including a cost benefit analysis, for proposed and final rules with “Federal mandates” that may result in expenditures by State, local or tribal governments, in the aggregate, or the private sector, of $100 million or more in any one year. When such a statement is needed for a rule, Section 205 of the UMRA generally requires the Department to identify and consider a reasonable number of regulatory alternatives and adopt the most cost effective or least burdensome alternative that achieves the objectives of the rule.

This proposed rule does not contain Federal mandates (under the regulatory provisions of Title II of the UMRA) for State, local and tribal governments or the private sector of $100 million or more in any one year. Thus, the rule is not subject to the requirements of sections 202 and 205 of the UMRA.

Executive Order 12372

This Supplemental Nutrition Assistance Program is listed in the Catalog of Federal Domestic Assistance under Number 10.551 and is subject to Executive Order 12372, which requires intergovernmental consultation with State and local officials. (See 2 CFR chapter IV.)

Federalism Summary Impact Statement

Executive Order 13132 requires Federal agencies to consider the impact of their regulatory actions on State and local governments. Where such actions have federalism implications, agencies are directed to provide a statement for inclusion in the preamble to the regulations describing the agency's considerations in terms of the three categories called for under Section (6)(b)(2)(B) of Executive Order 13132.

The Department has considered the impact of this rule on State and local governments and has determined that this rule does not have federalism implications. Therefore, under section 6(b) of the Executive Order, a federalism summary is not required.

Executive Order 12988, Civil Justice Reform

This proposed rule has been reviewed under Executive Order 12988, Civil Justice Reform. This rule is intended to have preemptive effect with respect to any State or local laws, regulations or policies which conflict with its provisions or which would otherwise impede its full and timely implementation. This rule is not intended to have retroactive effect unless so specified in the Effective Dates section of the final rule. Prior to any judicial challenge to the provisions of the final rule, all applicable administrative procedures must be exhausted.

Civil Rights Impact Analysis

FNA has reviewed the proposed rule, in accordance with the Agriculture Improvement Act of 2018, “2018 Farm Bill”, Section 12403, Civil Rights Analyses, to identify and address any major civil rights impacts the proposed rule might have on minorities, women, and persons with disabilities. While FNA expects that a relatively small share of SNAP participants may be wary of the changes to their EBT cards and a small number of retailers will need to adopt mobile POS technologies to end their reliance on manual vouchers, the implementation of mitigation strategies, such as plain-language communication and partnerships with outreach and retailer partners, will lessen these impacts. Additionally, the FNA Civil Rights Division will propose further outreach and mitigation strategies to alleviate any unforeseen impacts, if deemed necessary.

After a careful review of the rule's intent and provisions, FNA has determined that this rule is not expected to affect the participation of protected individuals in the Supplemental Nutrition Assistance Program.

Executive Order 13175

Executive Order 13175 requires Federal agencies to consult and coordinate with Tribes on a government-to-government basis on policies that have Tribal implications, including regulations, legislative comments or proposed legislation, and other policy statements or actions that have substantial direct effects on one or more Indian Tribes, on the relationship between the Federal Government and Indian Tribes, or on the distribution of power and responsibilities between the Federal Government and Indian Tribes.

This rule potentially has issues that require consultation. FNA consulted with Tribal leaders on March 15, 2024, and no feedback was received. If a Tribe requests consultation, FNA will work with USDA's Office of Tribal Relations to ensure meaningful consultation is provided.

Paperwork Reduction Act

The Paperwork Reduction Act of 1995 (44 U.S.C. Chap. 35; 5 CFR 1320) requires the Office of Management and Budget (OMB) approve all collections of information by a Federal agency before they can be implemented. Respondents are not required to respond to any collection of information unless it displays a current valid OMB control number. We are seeking a new OMB ( printed page 66969) Control Number for the new, existing, and changing provisions in this rule. These changes are contingent upon OMB approval under the Paperwork Reduction Act of 1995. Additionally, when the information collection requirements have been approved, FNA will publish a separate action in the Federal Register announcing OMB's approval.

In accordance with the Paperwork Reduction Act of 1995, this proposed rule contains information collections that are subject to review and approval by the Office of Management and Budget; therefore, FNA is submitting for public comment the changes in the information collection burden that would result from adoption of the proposals in this rule.

Please also send a copy of your comments to Food and Nutrition Administration, SNAP Innovation Policy and Issuance Division, Issuance Support Branch, 5601 Sunnyside Ave, Beltsville MD, 20705. For further information, or for copies of the information collection requirements, please contact FNA at the address indicated above.

Comments on this proposed rule must be received by December 22, 2026. Comments are invited on: (a) Whether the proposed collection of information is necessary for the proper performance of the functions of the agency, including whether the information shall have practical utility; (b) the accuracy of the agency's estimate of the burden of the proposed collection of information, including the validity of the methodology and assumptions used; (c) ways to enhance the quality, utility, and clarity of the information to be collected; and (d) ways to minimize the burden of the collection of information on those who are to respond, including use of appropriate automated, electronic, mechanical, or other technological collection techniques or other forms of information technology.

All responses to this notice will be summarized and included in the request for OMB approval. All comments will also become a matter of public record.

Title: Supplemental Nutrition Assistance Program: Electronic Benefits Transfer Card Security Measures.

OMB Number: 0584-NEW.

Forms: None.

Expiration Date: Not Yet Determined.

Type of Request: New.

Abstract: The Consolidated Appropriations Act, 2023, requires the Department to issue regulations establishing security measures to identify and prevent SNAP benefit theft. The measures must be consistent with industry standards for detecting, identifying, and preventing debit and credit card skimming, card cloning, and other fraudulent methods and must consider implementation feasibility for the States. This proposed rule modernizes Electronic Benefit Transfer (EBT) technology and brings EBT into alignment with consumer payment processing industry standards, improving the experiences of SNAP participants. FNA is requesting a new OMB Control Number for the requirements in this proposed rule.

The proposed rule includes numerous proposals to enhance EBT card security and account usability. Several of these proposals will result in an increase in reporting burdens for State SNAP agencies, Individuals/Households, Business-for-profit such as EBT host processors, and some SNAP retailers. There is no recordkeeping or third-party disclosure associated with this rulemaking.

First, the rule proposes creating SNAP EBT Operating Standards, which would be revised on a regular, ongoing basis. SNAP EBT Operating Standards would allow the Department to revise EBT requirements more dynamically in response to rapidly evolving payment technology and best practices in the consumer payment industry. Some of the SNAP EBT Operating Standards will create an information collection burden, as discussed below.

In this proposed rule, the Department will require State SNAP agencies to upgrade to EBT cards utilizing chip and NFC technology, as well as require that SNAP retailers accept EBT transactions via chip and NFC technology, within a certain time frame. Based on the experience of the consumer payment industry, the Department believes EBT cards utilizing chip and NFC technology will significantly reduce SNAP benefit theft due to the enhanced security features that mitigate skimming and cloning attacks. Households will be required to activate these new chip cards upon receipt, and households experiencing homelessness may need to travel to a local office to obtain their new card.

The proposal will also update the regulations at 7 CFR 274.2(e) on EBT household training requirements for SNAP participants. Under the proposed regulations, the EBT household training will inform households about security best practices that will reduce their chances of being affected by benefit theft, in addition to their rights and responsibilities and how to use their benefits.

The proposal will create new regulations at 7 CFR 274.8(b)(4)(i)(H) and 274.8(b)(4)(i)(I) to specify information that must be made available to all SNAP participants, including transaction dates, times, and amounts; retailer name and location; balance inquiry history; PIN change history; and history of other account management changes including address, email address, and telephone number. These changes will better equip SNAP households to review their account activity and detect potentially fraudulent activity.

The proposal makes two changes regarding balance inquiries. The SNAP EBT Operating Standards (see Appendix A to Part 274) will require verification for all SNAP balance inquiries, and the proposal will update 7 CFR 274.7(d)(1) to permit internet retailers to conduct business without offering balance inquiry, codifying a standard waiver the Department currently issues. Related to this, the Department proposes revising 7 CFR 274.7(d)(3) and 274.8(b)(7) to confirm that transaction receipts may be delivered via electronic means. As transaction receipts are required to be provided, eCommerce providers and internet retailers that do not use an eCommerce provider will need to modify their website purchasing pages accordingly.

The proposed rule revises 7 CFR 274.3(e)(4) and 274.8(b)(3)(v)(F), to clarify that State SNAP agencies, and by extension their contracted EBT vendors, both play a critical role in denying access to bad actors.

The proposed rule also revises regulations at 7 CFR 274.8(b) and 274.8(b)(10)(ii) to require all participants in the EBT system to update their systems in accordance with the X9.58 technical specification to ensure proper functioning of the system.

Finally, the proposed rule would revise 7 CFR 274.7(d)(3) and 274.8(b)(7) to confirm that transaction receipts for online purchases may be delivered via online cardholder accounts, confirmation invoices, other electronic communications such as email or text messages, or printed invoices upon delivery.

In addition to the changes discussed above, the proposed rule also includes changes that do not have an information collection burden. These include: updates to 7 CFR 274.8(b)(5)(vi) to specify that the primary account number shall be printed on the back of each EBT card; updates to 7 CFR 274.6(b)(3), 274.6(b)(5), and 274.6(b)(6) clarifying that EBT cards replaced as a result of their expiration date must not be counted towards the excessive card replacement threshold; updates at 7 CFR 274.6(b), 274.6(b)(2), and 274.8(b)(3)(ii)(C) to remove references to ( printed page 66970) magnetic stripes and to clarify that card replacement does not apply only to physical cards; updates to 7 CFR 274.3(a)(1)(i) ending the use of manual vouchers as a means to conduct ongoing business, except in certain limited circumstances; updates to 7 CFR 274.3(a)(2) to codify the 2014 Farm Bill amendment regarding non-exempt retailers' financial responsibility for EBT equipment, supplies, and related services; updates to 7 CFR 274.3(b) to remove outdated requirements regarding EBT terminal deployment; removal of 7 CFR 274.1(b) and updates to 7 CFR 271.2 “Electronic Benefit Transfer (EBT) system” to remove the option of offline EBT systems; updates to 7 CFR 274.3(a)(4) to clarify that interchange fees shall not apply to any EBT transaction; the creation of 7 CFR 274.2(f)(3) to require that EBT cards are issued in an inactive state; and updates to 7 CFR 274.8(b)(5)(vii) to require EBT cards to contain card security codes (CSCs). The proposed SNAP EBT Operating Standards and regulations at 274.7(k) will also require that all State SNAP agencies offer certain specific card security services provided by EBT vendors. States will be required to prohibit use of common PINs and offer participant-selected account options to manage and monitor their own account usage. Relatedly, the proposal creates new regulations at 7 CFR 274.8(a)(1)(ii) and modifies regulations at 7 CFR 274.3(f)(2)(i) to require PINs to comply with the specifications of the SNAP EBT Operating Standards.

First Year (One-Time) Burden

State SNAP Agencies

State SNAP agencies will have a one-time reporting burden of communicating to SNAP households about the implementation of EBT cards with chip and NFC technology. This burden comprises 53 responses totaling 424 hours. FNA expects that this communication will, at a minimum, take the form of a notice to each SNAP household. FNA estimates that each State Agency will need to draft a notice and set up an automated process to send communications out to each household. FNA estimates that it will take a State Agency 8.00 hours to draft a notice and set up the automated process for a total one-time burden of 424.00 hours (53 State Agencies * 8.00 = 424.00 total hours).

State SNAP agencies will also have a one-time reporting burden of revising household training materials to reflect the additional information required by the rule. FNA estimates that these revisions would take the equivalent of 80.00 hours per State SNAP agency, for a total one-time burden of 4,240.00 hours (80.00 hours per State SNAP agency * 53 State SNAP agencies = 4,240.00 hours).

State SNAP agencies will have a one-time reporting burden to revise all documentation and training materials to include information regarding chip card technology and anti-fraud measures that will be available to households. FNA estimates that these revisions would take the equivalent of 80.00 hours per State SNAP agency, for a total one-time burden of 4,240.00 hours (80.00 hours per State SNAP agency * 53 State SNAP agencies = 4,240.00 hours).

Finally, State SNAP agencies will have a one-time reporting burden related to conducting staff training on the various changes in the proposed rule and FNA estimates there will be 2,650 responses, with approximately 50 State SNAP agency staff receiving training per agency. FNA estimates that training would take approximately 4.00 hours per staff member, for a total of 10,600.00 hours (4.00 hours * 50 staff * 53 State SNAP agencies = 10,600.00 hours).

In total, the one-time reporting burden for State SNAP agencies would be 19,504.00 hours (424 chip card communications hours + 4,240.00 household training update hours + 4,240 anti-fraud documentation update hours + 10,600.00 staff training hours = 19,504.00 total hours).

EBT Host Processors

Although four EBT host processors are currently operating, FNA has been informed that one processor plans to end its EBT work soon, so we are only including the three EBT host processors that will remain in the market. Therefore, there will be 3 responses for this reporting burden.

EBT host processors will have a one-time reporting burden for making EBT system updates to provide detailed SNAP transaction history and account activity history, provide balance inquiry validation, comply with upcoming updates to the X9.58 technical specification for chip and NFC support, and monitor unauthorized EBT terminal usage.

FNA estimates that adding this functionality and implementing the updates would take approximately 160.00 hours per EBT host processor, for a total start-up reporting cost of 480.00 hours (160.00 hours per processor * 3 EBT host processors = 480.00 hours). Once the EBT host processors add the functionality to their systems, the reporting activities would be automated and would not impose an ongoing burden on processors.

EBT host processors will also incur a one-time reporting burden for developing a process to monitor and block potential unauthorized terminal usage. This will require 3 responses, one for each of the EBT host processors. FNA expects that developing a process to monitor terminals that exhibit certain patterns indicative of trafficking will take the equivalent of a three-week sprint for each EBT host processor, for a total of 360.00 reporting hours (40.00 hours * 3 weeks = 120.00 hours; 120.00 hours * 3 EBT host processors = 360.00 total one-time reporting burden hours).

Households

SNAP households will have a one-time reporting burden related to the activation of chip-enabled cards. FNA estimates that it will take households 5 minutes to activate a chip card, for a total reporting burden of 2,249,365.40 hours (22,493,654 households * 0.10 hours = 2,249,365.40 hours.)

FNA estimates that households will have a burden to review the State agency notice regarding chip card implementation. FNA estimates that 80 percent of households (22,493,654 households * 0.8 = 17,994,923) will review this notice. FNA estimates that it will take households 5 minutes to review. In total, FNA estimates this burden to be 1,799,492.32 hours (17,813,637 households * 0.10 hours = 1,799,492.324 hours.)

FNA estimates that there will be a burden for households experiencing homelessness to travel to a local office and to wait to obtain a new chip card. SNAP Quality Control data for FY 2022 estimated that 5.6% of the SNAP caseload experiences homelessness. FNA also estimates that not all households, approximately 50 percent, experiencing homelessness will not need to visit a local office to obtain a new chip card. As there are 22,493,654 households, 5.6% equals 1,259,644. Half of 1,259,6441 households equals approximately 629,822 households that may need to travel to a local office to obtain a chip card. FNA estimates the travel and wait burden for these households to be one hour, which would bring the total burden hours to households experiencing homelessness to 629,822 hours.

In total, FNA estimates that the total one-time household burden will be 4,704,463.72 hours (4,453,409.20 hours to review household training materials that now include chip card activation and anti-fraud measures + 2,249,365.40 hours to activate a chip cards and 629,822 hours for households experiencing homelessness to travel to a local office for a new card.). ( printed page 66971)

Retailers

Finally, online SNAP retailers will have a one-time reporting burden of removing capabilities for balance inquiry and receipts with account balances displayed from their online purchasing interfaces. To implement the change, internet retailers will need to update their ordering web page to remove the balance inquiry functionality and adjust the method of receipt. Currently, 116 SNAP retailers are, or are in the process to become, online SNAP retailers as direct integrators, operating their own online purchasing platform. There are currently 29 eCommerce providers total, including those that do not have a retailer who has gone live with SNAP Online Purchasing yet. FNA estimates that this one-time update to online purchasing will take both the direct integrators and eCommerce providers approximately 40.00 hours each, for a total of 5,920.00 hours ((116 direct integrators + 29 eCommerce providers) * 40.00 hours = 5,920.00 hours).

In total, the one-time startup burden of the proposed rule will be an estimated 41,121,359.20 responses for a total of 4,704,463.72 hours.

Ongoing Burden

EBT Host Processors

EBT host processors will also have an ongoing burden of monitoring EBT terminal usage and blocking unauthorized terminals to ensure that only authorized retailers can access the EBT system. Once the monitoring process is set up, the EBT host processors will need to monitor terminals on an ongoing basis and block unauthorized terminals that they discover throughout the course of the monitoring. The monitoring itself will be largely automated and not result in an ongoing burden for EBT host processors. FNA estimates that blocking terminals will take approximately one hour per month per EBT host processor, for a total of 12.00 hours per processor per year, or 36.00 hours total per year for all EBT host processors.

State Agencies

This rule includes a burden to account for the ongoing distribution of EBT related household training materials by each State agency. Per regulations at 274.2(e), household training includes content that will familiarize households with benefit issuance, benefit redemption, and rights and responsibilities. FNA did not previously account for this burden for the distribution of training to households and is including it in this new information collection. FNA estimates that each year, each household may receive some form of EBT training materials, which are most often provided as a pamphlet or brochure that accompanies their EBT card. FNA estimates that it would take a State three minutes to hand out information in an office or send via mail. FNA also estimates that this effort would take the equivalent of 626,862.90 total hours for State agencies (0.05 hours per State agency to distribute materials to a household * 12,537,250 newly certified households per year = 626,862.90 hours).

Households

FNA previously did not account for the ongoing annual burden on households to review EBT-related household training materials which are required to be provided by State SNAP agencies in regulations at 7 CFR 274.2(e). Per State-provided data, 12,537,250 households joined the program in Fiscal Year 2025. Based on that number, FNA estimates that each year eighty percent of households that join the program (10,029,806) will spend five minutes reviewing EBT household training notices in a year for a total ongoing reporting burden of 1,799,492 hours (10,029,806 * 0.10 hours = 1,799,492).

In total, the ongoing burden of the proposed rule will be an estimated 22,567,100.40 annual responses and 1,629,879.54 hours. Together, the one-time startup burden and ongoing burden are 63,688,459.60 responses and 6,334,343.26 hours.

One-Time Burden

State Agencies

Respondent Type: State Government.

Estimated Number of Respondents: 53.00.

Estimated Number of Responses per Respondent: 53.00.

Estimated Total Annual Responses: 2,809.00.

Estimated Time per Response: 172.00.

Estimated Total Annual Burden on Respondents: 19,504.00.

Businesses

Respondent Type: EBT Processors, Internet Retailers, and eCommerce Providers.

Estimated Number of Respondents: 148.00.

Estimated Number of Responses per Respondent: 1.02.

Estimated Total Annual Responses: 151.00.

Estimated Time per Response: 240.00.

Estimated Total Annual Burden on Respondents: 6,280.00.

Households

Respondent Type: Individuals/SNAP Households.

Estimated Number of Respondents: 22,493,654.

Estimated Number of Responses per Respondent: 1.83.

Estimated Total Annual Responses: 41,118,399.20.

Estimated Time per Response: 0.11.

Estimated Total Annual Burden on Respondents: 4,678,679.72.

Ongoing Burden

Businesses

Respondent Type: EBT Processors.

Estimated Number of Respondents: 3.00.

Estimated Number of Responses per Respondent: 12.00.

Estimated Total Annual Responses: 36.00.

Estimated Time per Response: 1.00.

Estimated Total Annual Burden on Respondents: 36.00.

Households

Respondent Type: Individuals/SNAP Households.

Estimated Number of Respondents: 10,029,806.

Estimated Number of Responses per Respondent: 1.00.

Estimated Total Annual Responses: 10,029,806.

Estimated Time per Response: 0.10.

Estimated Total Annual Burden on Respondents: 1,002,980.64.

State Agencies

Respondent Type: State Government.

Estimated Number of Respondents: 53.

Estimated Number of Responses per Respondent: 424,409.

Estimated Total Annual Responses: 12,537,258.

Estimated Time per Response: 0.05.

Estimated Total Annual Burden on Respondents: 626,862.90.

Total Reporting Burden

State Agencies

Respondent Type: State Government.

Estimated Number of Respondents: 53.00.

Estimated Number of Responses per Respondent: 424,462.

Estimated Total Annual Responses: 12,540,067.

Estimated Time per Response: 172.05.

Estimated Total Annual Burden on Respondents: 646,366.9.

Businesses

Respondent Type: EBT Processors, internet Retailers, and eCommerce Providers. ( printed page 66972)

Estimated Number of Respondents: 148.00.

Estimated Number of Responses per Respondent: 2.02.

Estimated Total Annual Responses: 187.00.

Estimated Time per Response: 241.00.

Estimated Total Annual Burden on Respondents: 6316.00.

Households

Respondent Type: Individuals/SNAP Households.

Estimated Number of Respondents: 22,493,654.

Estimated Number of Responses per Respondent: 1.83.

Estimated Total Annual Responses: 51,148,205.20.

Estimated Time per Response: 0.21.

Estimated Total Annual Burden on Respondents: 5,681,660.36.

Burden Table

( printed page 66973)

( printed page 66974)

E-Government Act Compliance

The Department is committed to complying with the E-Government Act, 2002 to promote the use of the internet and other information technologies to provide increased opportunities for citizen access to Government information and services, and for other purposes.

Accordingly, 7 CFR parts 271 and 274 are proposed to be amended as follows:

1. The authority citation for part 271 reads as follows:

Authority: 7 U.S.C. 2011-2036.

2. In § 271.2, revise the definition of Electronic Benefit Transfer (EBT) Card to read as follows:

3. The authority citation for 7 CFR Part 274 continues to read as follows:

Authority: 7 U.S.C. 2011-2036.

4. In § 274.1:

a. Revise and republish paragraphs (a) and (b);

b. Revise and republish paragraphs (c) and (d); and

c. Revise and republish paragraph (g)(1)

The revisions, removals, republications, and addition read as follows:

5. In § 274.2:

a. Revise and republish paragraphs (e)(1) through (7);

b. Add paragraphs (e)(8) through (18);

c. Revise paragraph (f)(2)(i);

d. Add paragraph (f)(3) and;

e. Revise and republish paragraph (g).

The revisions and additions read as follows:

6. In § 274.3:

a. Revise and republish paragraph (a);

b. Remove and reserve paragraph (b);

c. Revise the first sentence of paragraph (c)(3); and

d. Revise paragraph (e)(4).

The revisions read as follows:

7. In § 274.6:

a. Amend the introductory text of paragraph (b) by adding a sentence following the last sentence of the paragraph;

b. Amend paragraph (b)(3) by adding a sentence following the last sentence of the paragraph;

c. Revise paragraph (b)(4) by adding the words “including PIN requirements in the SNAP EBT Operating Standards (see Appendix A to Part 274)”;

d. Amend the introductory text of paragraph (b)(5) by adding a sentence following the last sentence of the paragraph;

e. Amend paragraph (b)(5)(i)(E) by adding the words “and information regarding any electronic contact methods available” to the end of the last sentence of the paragraph;

f. Amend the introductory text of paragraph (b)(6) by adding a sentence ( printed page 66977) following the last sentence of the paragraph; and

g. Revise paragraph (b)(6)(ii)(F) by adding the words “and information regarding any electronic contact methods available” after the words “including telephone number”.

The additions and revisions read as follows:

8. In § 274.7:

a. Revise and republish paragraph (d); and

f. Add paragraph (k).

The revisions and additions read as follows:

9. In § 274.8:

a. Revise and republish paragraphs (a) and (b);

b. Add “Automated Standard Application for Payments” before and parentheses around the word “ASAP” in paragraph (c)(1)(iii); and

c. Revise paragraph (d)(1)(ii).

The revisions and additions read as follows:

9. After 274.8.

a. Add the Appendix A to part 274 Supplemental Nutrition Assistance Program Electronic Benefit Transfer Operating Standards to read as follows:

Appendix A to Part 274: Supplemental Nutrition Assistance Program Electronic Benefit Transfer Operating Standards

(a) Supplemental Nutrition Assistance Program (SNAP) Overview

(1) The Supplemental Nutrition Assistance Program (SNAP) is the largest nutrition assistance program in the United States.

(2) SNAP is a means-tested program, which means low-income households must apply to participate and will only be accepted if they meet the Program's income and asset requirements. If they meet those requirements, their application is approved, and they become a SNAP household (a SNAP household can include one or more people). 7 CFR 273.1, 7 CFR 273.8-273.11.

(3) SNAP households receive a monthly benefit, which can (1) only be used to buy SNAP-eligible foods, and (2) only be used at SNAP-authorized retailers. 7 CFR 274.7(a), 7 CFR 278.2(a).

(4) SNAP benefits are provided to SNAP households via an Electronic Benefits Transfer (EBT) card. The EBT card is a method to access benefits issued to a household member or authorized representative (the SNAP household) through the EBT system by a benefit issuer (the SNAP State agency, through its EBT host processor). This EBT card may be a magnetic stripe card; a card with an integrated electronic chip capable of conducting contact or contactless payments, by either being inserted into a card reader or via wireless Near Field Communication (NFC) protocols; a digital wallet with a stored virtual EBT card; or any other similar benefit access technology approved by FNA.

(5) An EBT system is an electronic payment system that allows SNAP households to pay for food using their SNAP benefits via an EBT card when shopping at a SNAP-authorized retail store. When a ( printed page 66981) participant makes such purchases, their SNAP EBT account is debited to reimburse the store for the food they bought. SNAP benefits are issued from, and stored in, a central database, which is maintained and managed by a State or its contractor EBT processor. Such EBT systems use electronic funds transfer technology for the delivery and control of SNAP benefits and other public assistance benefits.

(6) EBT is used in all 50 States, the District of Columbia, Puerto Rico, the Virgin Islands, and Guam. EBT has been the sole method of SNAP issuance in all States since June of 2004.

(b) Operating Standards Purpose

(1) The purpose of this document is to provide Operating Standards for SNAP EBT systems. These standards have been published as an appendix to Part 274 of the Code of Federal Regulations.

(2) The SNAP EBT operating standards are the rules that govern SNAP EBT systems and EBT transaction processing methods. This includes establishing system requirements, establishing the systems themselves, maintenance, operation, and interaction with such systems, transaction processing, documentation, and reporting. The Operating Standards define the technical environment of EBT systems, define the responsibilities of each entity that interacts with a SNAP EBT system, and help to ensure those systems operate consistently, successfully, and securely; and provide a framework for mitigating errors and assigning liabilities.

(3) The SNAP EBT Operating Standards are modeled on operating rules used by debit, ATM, and credit card payment networks. Ultimately, the standards will ensure consistency in program experiences for all SNAP households and SNAP-authorized retailers, reflect ongoing advancements made in the consumer payment industry, and safeguard SNAP program integrity.

(4) Legislative and Regulatory Authorities for SNAP EBT Operating Standards

(i) All State Agencies and SNAP EBT systems must comply with all applicable SNAP legislation, regulations, policies, and guidelines, including this document.

(ii) This Operating Standards document is created under the rulemaking authority authorized in the Food and Nutrition Act of 2008, as amended (7 U.S.C. 2011-2036), and the Consolidated Appropriations Act, 2023 (Pub. L. 117-328).

(iii) SNAP legislative requirements can be found in the United States Code (U.S.C.), at 7 U.S.C. 2011-2036d (the Food and Nutrition Act of 2008, as amended).

(iv) SNAP regulations can be found in the Code of Federal Regulations (CFR), at 7 CFR 271-283 (Title 7, Subtitle B, Chapter II, Subchapter C). These Operating Standards focus primarily on EBT issuance regulations that can be found at 7 CFR 274.

(v) Additionally, Regulation E, at 12 CFR 1005 plays a role in governing SNAP EBT Operating Standards (Title 12, Chapter X, Part 1005 Electronic Fund Transfers).

(vi) FNA also issues SNAP policy memoranda, technical assistance, and other guidance on an ongoing basis on the FNA Documents & Resources page of the FNA website.

(vii) EBT transaction message specifications follow the X9.58 standard. That standard is established by ANSI's Accredited Standards Committee X9. ANSI is the American National Standards Institute, the accredited organization responsible for developing technical standards, including exchanging EBT financial transaction messages. The published standard is available on the American National Standards Institute (ANSI) website.

(c) SNAP EBT Processing Overview

(1) SNAP EBT Systems Roles and Responsibilities

(i) This section describes entities that operate or interact with SNAP EBT systems, including those involved in processing SNAP transactions. Relevant entities in this environment include:

(A) SNAP Households: The person(s) who apply and are approved to participate in SNAP, receive SNAP benefits, and use a SNAP EBT card to purchase SNAP-eligible food. A SNAP household may authorize people who are not part of the household to use its SNAP EBT card to purchase food on its behalf. 7 CFR 273.1, 7 CFR 274.8(f)(10).

(B) SNAP-Authorized Retailers: A merchant that applies and is authorized to accept SNAP benefits from SNAP households in exchange for SNAP-eligible foods. SNAP-authorized retailers (“retailers”) are the only places where SNAP households can use their benefits.

(C) The United States Department of Agriculture (USDA) Food and Nutrition Administration (FNA): The government agency that administers SNAP at the Federal/national level, in partnership with SNAP State agencies, EBT host processors, SNAP-authorized retailers, and other entities.

(D) SNAP State agencies: The governmental agency that administers SNAP at the State and local level. SNAP State agencies (State agencies or States) in all 50 States, the District of Columbia, the Virgin Islands, and Guam operate statewide EBT systems to issue SNAP benefits.

(E) EBT host processors: A contractor that builds and operates SNAP EBT systems on behalf of States. This includes:

(1) Initial creation, maintenance, upgrading of EBT systems.

(2) Processing EBT transactions, managing individual SNAP benefit accounts.

(3) Reporting and data management.

(4) Enabling and disabling retailers.

(5) End-of-day processing, settlement, reconciliation, and (in some cases) providing Point-of-Sale (POS) devices to SNAP-authorized retailers.

(6) Certification of Third-Party Processors.

(F) Gateway: An entity that routes EBT transactions from Third-Party Processors to an EBT host processor based on the BIN of the EBT card.

(G) Third-Party Processor (TPP): Financial institution that receives EBT transactions from SNAP-authorized retailers and acquirers and subsequently transmits those transactions to an EBT gateway for further routing or directly to an EBT host processor for transaction approval. SNAP State agencies and their contracted EBT host processors must allow retailers to use EBT services provided by TPPs and acquirers, and must provide interface specifications and certification standards, in order for the TPPs to participate in the EBT system per 7 CFR 274.3 (d).

(1) The TPPs have contractual agreements to connect to all existing EBT processor systems, either directly or via gateways, in order to facilitate the approval/denial transactions anywhere SNAP is operated. TPPs typically provide EBT services and POS equipment directly to larger retailers (such as those with many locations) who may utilize other non-EBT services that the TPPs offer. Smaller retailers who are unable to contract directly with a TPP instead may rely on an acquirer to provide EBT services and POS equipment.

(H) Acquirer: A financial institution (or the agent of a financial institution) that facilitates the authorization of SNAP transactions by acquiring transaction-related data from SNAP-authorized retailers and transmitting that data to a Third-Party Processor for further routing. An acquirer may only need to contract with a single TPP, as the TPP would handle subsequent routing to gateways and EBT host processors.

(I) POS Service Provider: A financial institution (or its agent) that provides retailers with the equipment and technology needed to process SNAP benefits.

(2) SNAP EBT Transaction Flow

(i) This section describes how a SNAP EBT transaction flows through the EBT system and related financial systems.

(ii) See Figure 1 for a visual representation of the SNAP EBT transaction flow as of FY 2026. Please note that this figure is not comprehensive, as there may be other participants not represented in this figure, or participants who go by other names.

(iii) The left half of Figure 1 illustrates the flow of an EBT transaction:

(A) After being approved to participate in the Program, a SNAP household wants to buy SNAP-eligible food at a SNAP-authorized retailer. To pay for the food, the SNAP household swipes, inserts, or taps their EBT card—or uses another payment method, such as a mobile wallet—at the retailer's POS device. This generates an EBT transaction message, that is sent to the retailer's contracted TPP. The EBT transaction message is electronic data that contains information needed to process a transaction. The information contained in the transaction message is defined by the ANSI X9.58 specification.

(B) The TPP receives the transaction message from the retailer's POS device and forwards it to either a Gateway or directly to the EBT host processor, depending on the capabilities of the TPP. If the transaction message goes to a Gateway, the Gateway forwards it to the correct EBT host processor, based on the BIN of the card.

(C) Upon receipt, the EBT host processor reviews the information contained in the transaction message to ensure the transaction is valid, as defined in the processor's Business Rules (which are approved by the State and FNA). This includes:

(1) The SNAP household's Primary Account Number (PAN), to ensure the card number is valid;

(2) The PIN; ( printed page 66982)

(3) Whether there are sufficient benefits in the household's account to cover the purchase;

(4) Whether the EBT card is statused/inactive;

(5) The retailer's FNA number, to ensure the retailer is authorized to participate in SNAP); and

(D) The retailer's store type, to determine whether it is a store type that has additional limitations/requirements (internet retailers, restaurants, etc.). The processor will impose such requirements as appropriate.

(E) The processor will then generate a transaction message response to send back to the retailer's POS device, approving or denying the transaction providing SNAP account balance information and, if applicable, the denial reason). The processor sends FNA the transaction data, per 7 CFR 274.4(b)(2) and the requirements outlined in their contract with the State.

(F) To get to the retailer's POS device, the transaction message response will follow the same path that was used to send the original transaction message ( i.e., through the TPP and then to the retailer; or through a Gateway, then a TPP, and then to the retailer).

(G) Once the transaction message response reaches the retailer's POS device, the retailer provides approval/denial information and a receipt to the SNAP household with the remaining account balance.

(iv) The right half of Figure 1 describes the settlement flow ( i.e., the transfer of funds which reimburses a SNAP-authorized retailer for a SNAP transaction):

(A) TPPs request reimbursement from either the Gateway or the EBT host processor (depending on how a particular transaction message was routed).

(B) If a transaction message was routed through a Gateway, the Gateway then requests reimbursement from the EBT host processor.

(C) Upon receipt of reimbursement requests from TPPs or Gateways, the EBT host processor sends its own reimbursement request to the Federal Reserve Bank (FRB), which authorizes reimbursement to the EBT host processor from the appropriate SNAP State agency's Letter of Credit.

(D) FRB then transfers the funds to the EBT host processor, and the reimbursement funds flow down the chain and are settled—from the host processor to the Gateway/TPP, and finally to the retailer.

Figure 1 Transaction Flow (as of FY 2026)

(d) SNAP-Authorized Retailer Requirements

(1) SNAP-Authorized Retailers: EBT Card Acceptance

(i) The following are rules for SNAP-authorized retailers regarding EBT card acceptance.

(A) SNAP EBT cards must be interoperable. This means that all SNAP-authorized retailers must be able to accept SNAP EBT cards from any of the 53 States and Territories that operate SNAP, in accordance with interoperability standards specified in 7 CFR 274.8(b)(10).

(B) SNAP EBT cards must be presented at the time of purchase, except for purchases from internet retailers.

(C) The SNAP household member (or their authorized representative) must enter the Personal Identification Number (PIN) associated with the card at the POS device.

(D) For SNAP online purchasing, the SNAP household member (or their authorized representative) must key-enter the card number and PIN. Once chip card technology is implemented, it will be a best practice for each retailer or eCommerce provider to update their online payment platform (website, app, etc.) to collect the card expiration date and Card Verification Value (CVV)/Card Security Code (CSC). PIN solution providers or others in the transaction flow may also need to update their systems. Ecommerce refers to an online sales platform that allows customers to make online purchases, such as a website or mobile app.

(E) SNAP-authorized retailers must never store ( i.e., maintain a record of) a SNAP household's card number (unless tokenized), PIN, expiration date, or CVV/CSC.

(2) SNAP-Authorized Retailers: EBT Training

(i) The following are the rules for SNAP-authorized retailers regarding effective EBT training for employees (7 CFR 278.6(i)(2)): ( printed page 66983)

(A) SNAP-authorized retailers must ensure that all managers and employees whose work brings them into contact with SNAP benefits—or who are assigned to a location where SNAP benefits are accepted, handled, or processed—are effectively trained on the correct acceptance and use of SNAP benefits.

(B) Such training must be designed to establish a level of competence that ensures compliance with federal requirements.

(C) Training must include written, program-specific material, such as SNAP regulations, relevant guidance issued pursuant to those regulations (policy memoranda, fact sheets, training presentations, etc.), and correct use of POS devices and related equipment.

(D) Training materials must clearly state that trafficking is prohibited, as it violates the Food and Nutrition Act of 2008 and SNAP regulations. Trafficking is the exchange or attempted exchange of SNAP benefits for anything other than SNAP-eligible food.

(E) Employees at previously authorized SNAP retailers must be trained within 30 days of being hired.

(F) After their initial EBT training, employees must periodically have refresher training.

(ii) SNAP State agencies are required to provide training that meets these requirements, including the provision of appropriate written and program-specific materials. However, retailers have the option to waive the State-provided training. In cases where a retailer waives the State-provided training, the SNAP State agency must direct retailers to confirm their waiver in writing (7 CFR 274.3(e)(7)).

(e) EBT Host Processor Requirements

(1) EBT host processors are contractors that build and operate SNAP EBT systems on behalf of States. Processors are also sometimes referred to as “card issuers” since they issue EBT cards to SNAP households on behalf of SNAP State agencies.

(2) EBT Host Processors: Processing Standards

(i) Card processing standards create and enforce a level of service for the SNAP EBT processing environment, ensuring that users receive a consistent level of service, regardless of the technology used or the entities involved. FNA establishes card processing standards, in cooperation with entities that operate in the SNAP EBT environment.

(ii) The following are card processing standards that all processors must adhere to, and which must be incorporated into contractual agreements with processors (or their agents) (7 CFR 274.8(b)):

(A) Processors must maintain computer hardware and software necessary to interface directly with data processing facilities required to accommodate transaction and file processing.

(B) Processors must establish direct or indirect telecommunications connections to route transactions and to retrieve and deliver files to/from other processors and TPPs.

(C) System uptime is required 99.9% of the time, 24 hours a day, 7 days a week. States may negotiate more rigorous uptime requirements in their contracts with processors.

(D) Processors may schedule downtime for system maintenance, repairs, upgrades, etc., provided the processor provides prior notice to all network participants, including FNA.

(1) Outages must be scheduled to occur during non-peak transaction periods.

(2) Scheduled outages must not be included when calculating whether the monthly 99.9% system uptime requirement has been met.

(3) In the instance of emergency downtime, the processor must promptly inform all network participants.

(E) Processors must initiate a response to a SNAP EBT transaction request within two seconds from the time such a request is received by the processor's system, 98% of the time, per month.

(1) Data transmission times between the processor and the acquirer must not be included when calculating whether the monthly 98% transaction request response requirement has been met.

(F) No more than two in every 10,000 transactions processed by a processor's system shall lead to an adjustment resulting from processor error.

(G) Processors must ensure that SNAP transactions originate from a SNAP-authorized retailer by validating the retailers against the Retailer EBT Data Exchange (REDE) file.

(H) Processors must ensure their International Organization for Standardization (ISO) message specifications are aligned with the most recent version of the ANSI X9.58 standards.

(I) Processors must provide all required data, such as redemption and transaction data, to FNA in accordance with the most up-to-date file specifications.

(J) When updates are made to the ISO 8583 or ANSI X9.58 specification, or other applicable specifications, State agencies shall ensure that EBT systems comply with the new version of the specification within 180 days from the publication of the updated specification.

(3) Issuer Identification Number (IIN)/Bank Identification Number (BIN)

(i) Issuer Identification Numbers (IIN), formerly called Bank Identification Numbers (BIN), are six-digit to eight-digit numbers that identify the bank, financial institution, or other entity that issued a card. IINs are issued by American Bank Association (ABA), and are placed on credit, debit, and other types of payment cards worldwide, including SNAP EBT cards. The ABA no longer issues six-digit IINs and is moving towards adopting eight-digit IINs.

(ii) The first digit in an IIN is the Major Industry Identifier (MII), which is determined according to the numbering scheme specified in the ISO 7812—Part 1 standard.

(iii) Each SNAP State agency via their EBT host processor must apply for and maintain its own IIN. The IIN is registered to the SNAP State agency rather than their EBT host processor.

(f) TPP and Acquirer Responsibilities

(1) Each acquirer or TPP shall enter into an agreement with an EBT Host Processor, gateway, or other relevant party, stating it will comply with FNA Regulations and EBT technical specifications, as outlined in ANSI X9.58. These EBT Operating Standards do not negate any terms or conditions of TPP or acquirer agreements, as long as the conditions of said agreement do not conflict with FNA regulations. A TPP or acquirer may enter into agreements with more than one EBT Host Processor, Gateway, or other connection point.

(2) Each acquirer must ensure that the POS terminals it owns, operates, controls, or for which it has signed an agreement to accept EBT transactions, must do so in accordance with FNA regulations.

(3) Each TPP and acquirer must settle all authorized transactions in accordance with FNA regulations and EBT Host Processor standards.

(4) Only a retailer that has received authorization from FNA to participate in SNAP may accept EBT cards for SNAP transactions. Each acquirer for a retailer that seeks such participation must make efforts to ensure EBT fraud is not occurring under their platform. Each acquirer must promptly ensure that it does not process SNAP transactions for a retailer following receipt of notice that authorization for that retailer has been revoked, rescinded or otherwise eliminated.

(g) Required EBT Transactions

(1) Minimum Transaction Set

(i) At minimum, every entity that interacts with the SNAP EBT system is capable of processing the following SNAP EBT transactions:

(A) Authorizations and denials,

(B) Refunds,

(C) Voids or cancellations,

(D) Key-entered transactions,

(E) Settlement or close-out transactions, and

(F) Balance inquiries (does not apply to SNAP-authorized internet retailers).

(ii) Each of these required transaction types is explained in more detail below. State agencies must ensure that their EBT systems are capable of completing this transaction set and be able to do so in every State nationwide, in accordance with interoperability standards specified in 7 CFR 274.8(b)(10).

(iii) Lastly, all SNAP EBT transactions are electronically processed and recorded. FNA has access to all SNAP EBT transaction records including the date, time, and dollar amount.

(iv) Authorization or Denial of SNAP Purchases: A SNAP household selects SNAP-eligible food at a SNAP-authorized retailer and goes to check out. The cost of the food items is totaled, and the purchase price is displayed by the POS device. The EBT card is presented to the POS device (inserted, tapped, swiped etc.), and the household must enter their PIN. The POS device then processes the transaction.

(A) If the purchase is approved, the retailer must provide the household with a receipt that shows the purchase and remaining SNAP balance. The purchase amount is deducted from the household's SNAP account and credited to the retailer's bank account generally within two banking days.

(v) Refunds: Refund transactions are when SNAP benefits are returned to a household's ( printed page 66984) account. Refunded SNAP benefits must only be returned to the household's SNAP card/account. Refunding SNAP benefits in any other form (cash, gift cards, etc.) constitutes trafficking and would subject both the retailer and household to sanctions.

(A) In-Person Refunds:

(1) In-person refund transactions are conducted on a retailer's POS device.

(2) The SNAP households must enter their PIN to authorize the refund.

(B) Internet Refunds:

(1) Internet refund transactions do not require SNAP households to enter their PIN.

(2) Whole or partial refunds may occur automatically for internet refunds. This may occur if an item is no longer in stock, if the order is cancelled, if the SNAP household does not receive all the items they ordered, or if an item is priced by weight and the final weight (and therefore the price) is different from the weight estimated at the time of purchase.

(3) If the original payment was a split tender transaction, the refund will be issued to the card that was used to pay for the refunded items.

(4) Refunds cannot occur after 90 days of the original transaction.

(C) Refund transactions differ from reversals because they are generally customer-initiated (except for automatic internet refunds) rather than retailer-initiated.

(vi) Void Or Cancellation: Void or cancellation transactions are used when an incorrect purchase amount is processed through a retailer's POS device. The void/cancellation must be done immediately after the purchase transaction and on the same POS device.

(vii) Key-Entered Transactions: If a POS device cannot read an EBT card, the SNAP household and retailer may conduct a key-entered transaction. To do so, the retailer must manually enter the EBT PAN into the POS device. Thereafter, the household must enter its PIN into the POS device, to authorize and process the transaction. Key-entered transactions must only be used as a last resort, when the POS device cannot read the EBT card.

(A) States may request a temporary waiver from FNA to prohibit some key-entered transactions as an EBT theft prevention measure.

(viii) Settlement: For SNAP-authorized retailers, this is the transaction where they are paid for the SNAP benefits redeemed at their store in exchange for food. Generally, SNAP-authorized retailers must receive payment for approved SNAP transactions within two business days of the transaction.

(ix) Balance Inquiries: Balance inquiries are used when a household wants to check the amount of benefits currently in its SNAP account.

(A) In-Person Balance Inquiries: In-person (or “brick-and-mortar”) SNAP-authorized retailers must provide SNAP households the ability to conduct balance inquiries. The SNAP household must present its EBT card to the POS device, enter their PIN, and follow the prompts to obtain the account balance.

(B) Online Balance Inquiries: SNAP-authorized internet retailers are not required to provide the ability to conduct balance inquiries, and FNA strongly recommends they do not do so (7 CFR 274.7(d)(1)).

(1) However, internet retailers are allowed to provide balance inquiries. If an internet retailer allows balance inquiries, FNA requires them to do the following to mitigate fraudulent inquiries:

(i) Remove the “guest checkout” option from its online sales platform (website, app, etc.).

(ii) Limit the number of times a SNAP household can change the EBT card they are using to make purchases within a specific time period.

(iii) Limit the number of balance inquiries a SNAP household can conduct within a specific time period. FNA recommends a maximum of two balance inquiries per hour.

(C) Balance Inquiries in Cardholder Portal/Mobile Apps: All SNAP households have the ability to log into their State's online SNAP cardholder portal to conduct balance inquiries. Processors in some States also offer households the ability to conduct balance inquiries in their mobile application. These platforms are protected with a User ID and password functionality.

(D) Interactive Voice Response (IVR) SNAP Balance Inquiry Requirements: Households can conduct balance inquiries by calling the EBT host processer's IVR number. Previously, households were able to conduct IVR balance inquiries by entering only their PAN. However, that practice has proven highly susceptible to fraud.

(1) To prevent fraudulent balance inquiries by unauthorized users, States must work with their processor to ensure that all telephonic methods for conducting balance inquiries utilize an approved form of verification (7 CFR 274.7(d)(4)). Verification methods must use information only available to the household, such as a CVV/CSC printed on the card, and must not use personally identifiable information (PII).

(2) Reversals

(i) A reversal, sent to an EBT host processor by a retailer, acquirer, or TPP, is a partial or complete nullification of the effects of a previous transaction which cannot be processed as intended, i.e., is undeliverable, is cancelled, or the previous transaction has timed out waiting for a response. The voiding of a transaction at the point of sale, when initiated by a retailer, is processed using a reversal message. Reversals should be processed per the ANSI X9.58 standards.

(ii) Reversals are a valid transaction type for internet transactions and must be processed according to the standard reversal specifications. Reversals must only be used in cases as described above, with one exception for internet transactions: in the event that a SNAP internet transaction occurs with mixed tender, and the additional payment type (cash/credit/debit) was rejected, the original SNAP transaction can be reversed so that the transaction can be attempted again. PINs are not required in reversal messages.

(iii) If the customer is unable to find a payment method with sufficient funds to cover the balance, and the website needs to cancel the original SNAP transaction, the retailer must submit a reversal to their processor.

(3) Adjustments

(i) An adjustment is a change to the balance of a household's SNAP benefit account, implemented by a State SNAP agency (and/or by their contracted EBT host processor) in response to an incorrect account balance caused by a system error during the redemption process (7 CFR 274.2(g)). Adjustments may increase the balance of a SNAP account (“credit adjustment”) or decrease the balance of an account (“debit adjustment”).

(ii) A system error is an error resulting from a malfunction at any point in the SNAP benefit redemption process, such as an error made by a retailer's host computer or POS device, a TPP, the Gateway, or processor. System errors should be rare. Adjustments must only be used to correct system errors and must never be used to correct a human error. Examples of system errors include:

(A) A State agency review of documentation shows that a household's benefit account was charged a different amount than the amount submitted by the retailer, or

(B) A charge submitted by a retailer to the EBT processor is erroneously deducted from the wrong household's benefit account.

(iii) When investigating a potential adjustment, the State should not rely solely on a retailer disputing a proposed credit adjustment as the sole evidence to for rejecting that proposal. The State must investigate the transaction(s) involved thoroughly, and determine if a valid system error occurred, regardless of the retailer's response to an inquiry.

(iv) Adjustments should not be utilized in response to household reports of retailer errors. Adjustments can only be used to correct system errors. Households must seek corrections to retailer errors (via refund and returns, for example) with the retailers themselves. Some examples of retailer errors (which are not true system errors) follow:

(A) Retailer Errors (must be done as returns, NOT as adjustments):

(1) A retailer clerk erroneously scans a single item multiple times,

(2) A clerk erroneously charges a household for one type of food item when a different type was purchased,

(3) A retailer charges a different amount for a SNAP item at the register than was advertised,

(4) A retailer attempts to input a refund to a household's benefit account, but erroneously charges a household a second time for the same amount,

(5) A SNAP internet retailer delivers SNAP items that a household has already paid for, but they arrive damaged or with items missing,

(6) A client returns items accidentally purchased with SNAP benefits, and/or

(7) A client is unhappy with the quality of the product they received.

(B) Additionally, adjustments should not be used to replace stolen SNAP benefits.

(v) SNAP Household-Initiated Adjustments

(A) In order to be timely, SNAP households must request adjustments to their benefit account within 90 calendar days of an alleged system error transaction (7 CFR 274.2(g)(2)(i)). Households most often request ( printed page 66985) credit ( i.e., upward) adjustments but may request debit ( i.e., downward) adjustments. Household-initiated adjustment requests that are made over 90 days from the date of an alleged error transaction must be denied as untimely.

(B) If a household-initiated adjustment request is timely, the SNAP State agency has 15 calendar days from the date the household reports the alleged error to investigate the transaction(s) involved, reach a decision, and either move funds into the household's account or issue a written denial of the request to the household (7 CFR 274.2(g)(2)(i)).

(C) Approvals:

(1) To approve a household-initiated adjustment request, the State agency must determine that a system error occurred and document that the system error was reviewed and verified. The State agency must make this determination prior to notifying the SNAP-authorized retailer involved and prior to adjusting the household's benefit account.

(2) For credit adjustments, States must not give a provisional credit to the household while the State is determining whether their claim should be approved or denied.

(D) Denials:

(1) If the State cannot verify the household's claim that a system error occurred, the State must deny the adjustment request.

(2) If the State denies a household-initiated adjustment request, they must send the household a denial notice. This notice explains the action being taken, the reason for the action, and fair hearing rights, so the household can appeal the determination. The denial notice must be sent by the 15th calendar day after the adjustment was requested by the household.

(3) Households must be granted a fair hearing if the request for hearing is submitted within 90 calendar days from the date of the denial notice. If the 90-day adverse notice period ends on a weekend or holiday, and a request for a fair hearing is submitted the next business day after the weekend or holiday, the State agency must consider the request timely.

(4) For credit adjustments, States must not give a provisional credit to the household pending a fair hearing for a denied adjustment request.

(vi) Retailer-Initiated Adjustments

(A) In order to be timely, SNAP-authorized retailers must submit adjustment requests no later than 15 calendar days after an alleged system error occurred (7 CFR 274.2(g)(2)(ii)). Retailers typically submit debit ( i.e., downward) adjustment requests to household benefit accounts, seeking additional payment (which they would receive upon settlement) related to an alleged system error, but it is possible they may request credit ( i.e., upward) adjustments as well.

(B) To proceed with a debit adjustment request, the State must first review relevant data/documents, maintain documentation of its investigation, and validate that a system error did occur.

(C) The State has 15 calendar days from the date the retailer reports the alleged error to investigate the transaction(s) involved and reach a decision. If the State cannot validate that a system error (not a retailer error) occurred, the State must deny the request. In addition, if the State cannot validate the requested debit adjustment within 15 calendar days of the request, the request must be denied. The State (or their EBT processor) is not required to notify households of adjustment requests that were initiated by the retailer and subsequently denied if no hold was placed on the household's account.

(D) States can choose between following the standard procedure for debit adjustments (274.2(g)(2)(ii)(A)) or an alternative no-hold procedure (274.2(g)(2)(ii)(B)):

(1) Standard procedure: If the State determines there is a timely and valid request for a debit adjustment, the State may choose to place a hold on the household's account in the amount of the requested adjustment. If the State validates the adjustment request and places such a hold, it must immediately notify the household that it has done so.

(i) If there are insufficient benefits in the account to cover the entire proposed adjustment, the State may also place a hold on all or part of the next month's issuance, to make up the difference (but only the next month's issuance).

(ii) If the household appeals the adjustment by requesting a fair hearing within 15 calendar days of being notified, the State must—within 48 hours—make a provisional credit to the household's account (by releasing the hold on the adjustment balance), pending resolution of the fair hearing. If no request for a hearing is made within 15 calendar days of the notice, the hold is released on the adjustment balance, and this amount is credited to the retailer's account.

(2) Alternative No-Hold Procedure: Alternatively, the State agency may instead choose to act on requests for debit adjustments without placing a hold on the household's account. Under this procedure, the State must first notify the household of the proposed adjustment and then allow the household 15 calendar days to appeal by requesting a fair hearing before implementing the adjustment. In such cases, the State must not take any further action until the 15-day window for appeal expires. If the household does timely request a fair hearing, the State should not adjust the household's account until the fair hearing decision is rendered.

(E) Household Notice: Household adjustment notices must:

(1) Clearly state the proposed full adjustment amount,

(2) The reason for the action, including documentation of the system error,

(3) If the State places a hold, it must give the household adequate notice regarding the details of the hold, and advise the household that any amount owed, above and beyond the hold amount, is subject to collection from the household's next month's benefits.

(4) Inform households that they have the right to request a fair hearing within 90 days of the date of the notice.

(vii) State-Initiated Adjustments

(A) In cases where the State agency identifies a possible system error, the State has 15 calendar days to investigate and, if appropriate, adjust the household's account (7 CFR 274.2(g)(2)(i)). If the State cannot validate that a system error occurred, they do not need to notify the household or the retailer because the adjustment was initiated by the State.

(B) If the State validates that a system error occurred and the adjustment results in a debit ( i.e., reduction) to a household's account, the State must notify the household and allow them to request a fair hearing.

(C) In cases where SNAP benefits are erroneously issued to a household, the State agency may adjust benefits issued to household accounts after the issuance process is complete, but prior to the availability date for household access (7 CFR 274.2(g)(1)).

(h) Clearing, Settlement, and Reconciliation

(1) In general, clearing, settlement, and reconciliation describe the processes through which different entities interact with each other to pay amounts owed to each other for conducting and processing EBT transactions.

(2) Clearing is when retailers send transaction information to the SNAP State agency or the EBT host processor to request payment. This can be done directly by the retailer or through their contracted TPP or acquirer.

(3) Settlement processing is when a State or processor creates and transmits a payment to a retailer's bank for approved, cleared SNAP transactions.

(4) Reconciliation is the process States must follow to account for all SNAP issuance and transaction activity. This is done to ensure accuracy and consistency, and to identify and rectify any discrepancies.

(5) Clearing EBT Transactions

(i) Retailers clear transactions by submitting SNAP claim files containing transaction information. The standards for SNAP claim file processing are as follows:

(A) Retailers must submit SNAP claim files each business day no later than 48 hours after the date and time of the oldest transaction in the file.

(B) Retailers may submit a single claim file for multiple store locations. The retailer must identify the specific store where each transaction occurred in the SNAP claim file using the numeric identifier assigned by FNA.

(C) If the State or processor approves a retailer to submit a corrected claim file or corrected transactions, the retailer must submit the correction within 60 days of the date of the original file submission, unless the State approves a longer timeframe.

(6) Settlement Processing

(i) The standards for settlement processing are as follows:

(A) The State must set a standard daily cut-off time for transaction processing and inform retailers and TPPs about this cut-off time.

(B) The State must ensure that retailers receive payment at their financial institution for approved, cleared EBT transactions, within two business days of the settlement day of the transaction. The State, processor, TPP, or acquirer must pay retailers as soon as payments are ready to be transmitted.

(C) The processor must request payment from the Federal Reserve Bank. Then, the Federal Reserve Bank verifies the request and ( printed page 66986) sends an Automated Clearinghouse (ACH) payment file to the State's bank account (which is managed by the processor) directing the bank to pay the processor for all settled transactions.

(1) On behalf of the State, the processor directs its bank to pay the first authorized downstream entity in the EBT system for all authorized transactions that were processed by the entity on first authorized downstream will be a processor. Downstream entities might include TPPs and acquirers, who then pay further downstream entities. The final downstream entity is the retailer.

(D) The processor is responsible for meeting the settlement cutoff timeframe established by the State. When submitting transactions for settlement to a TPP, the processor must provide a standard settlement cutoff timeframe to the TPP. Any differences in these settlement cutoff timeframes are the responsibility of the processor.

(7) Reconciliation

(i) SNAP State agencies must account for all SNAP benefit issuances and transactions through a reconciliation process. Reconciliation must be conducted and records kept as follows:

(A) Reconciliation of SNAP benefits issued to household accounts against benefits on the Issuance Authorization File;

(B) Reconciliation of individual household account balances against account activities on a daily basis;

(C) Reconciliation of each retail store's SNAP transactions, per POS terminal and in total to deposits on a daily basis;

(D) Verification of retailer's credits against deposit information entered into the ACH network;

(E) Reconciliation of total funds entered into, exiting from, and remaining in the system each day;

(F) Maintenance of audit trails that document the full cycle of issuance, from benefit allotment posting to the State issuance authorization file, through posting to POS transactions at retailers, through settlement of retailer credits.

(i) End of Day Cut-Off and Processing

(1) The following are the rules for SNAP State agencies, EBT host processors, retailers, and TPPs regarding end-of-day cut-off and processing:

(i) Each SNAP State agency must designate a standard daily cut-off time for SNAP EBT transaction processing by TPPs interacting with the State's EBT system.

(ii) That cut-off time must not be earlier than 12:00 p.m. (noon) local time at any POS device accepting SNAP EBT transactions for the TPP.

(iii) Transactions conducted during a business day must be settled on the next business day after the next cut-off time.

(iv) Most cut-off times are at 2:00 p.m. Central Time. For example, transactions that occur before 2:00 p.m. on a Wednesday will be settled on Thursday (the next business day). Transactions that occur after 2:00 p.m. on a Wednesday will be settled on Friday (the business day after the next cut-off time).

(2) If retailers, TPPs, and/or acquirers establish their own cut-off times, which are different from the State's, they must maintain appropriate suspense accounts for such purposes.

(j) Manual Vouchers

(1) Manual vouchers are paper forms completed by the retailer with information about the cardholder and the transaction. Manual vouchers should only be used when the POS system is down or cannot connect to the EBT processor ( e.g., no connection can be established, transactions are not processing; or when the POS device displays messages such as “No MSG from Host,” “Host Sent NAK,”: “Lost Carrier,” “No Answer,” etc.), or in certain situations where a POS terminal cannot be used ( e.g., remote delivery).

(2) Because manual vouchers do not require a PIN, they are highly susceptible to fraud. In addition, the Agricultural Act of 2014 (2014 Farm Bill) amended Section 7(f) of the Food and Nutrition Act to prohibit the use of manual vouchers for benefit redemption, except in specific cases where FNA determines they are necessary. For this reason, FNA prohibits the use of manual vouchers as a common day-to-day practice in SNAP (7 CFR 274.3(a)(1)(i)). FNA only grants exemptions/waivers to allow the use of manual vouchers as a regular business practice in the following situations:

(i) In rural areas where retailers do not have internet connectivity,

(ii) For retailers eligible for free State-provided EBT equipment (direct-marketing farmers and farmers' markets),

(iii) In designated Tribal areas.

(3) Retailers that wish to seek an exemption/waiver to conduct manual voucher transactions as a regular business practice must contact their TPP to confirm they have the capability to accept and clear vouchers and will be able to provide the retailer with the paper forms used for the voucher process. Once approved to accept manual vouchers, retailers must request a supply of paper forms to keep on hand.

(4) Retailers must adhere to the following procedure for processing manual vouchers:

(i) Manual vouchers require a customer signature. The clerk or manager must then call the State's retailer customer service line and enter the following data: the store's FNA authorization number, the card number, transaction type (purchase/refund), dollar amount and the pre-printed voucher number.

(ii) If approved, the EBT system places the funds on hold so that the customer cannot use them elsewhere and gives the retailer a six-digit authorization number to record on the form.

(iii) Retailers must clear vouchers using the method required by their TPP within ten calendar days. Some TPPs require the retailer to mail the original copy of the paper voucher to the TPP, and the TPP converts it to an electronic transaction themselves.

(iv) If the retailer fails to clear the voucher on time, they are not paid, and the system releases the held funds back to SNAP client.

(5) EBT host processors should process manual voucher transactions as follows:

(i) A voucher authorization is required when the retailer calls to validate that the amount of the transaction is available.

(ii) If the household account has the amount required for the transaction, the retailer will receive an approval code and confirmation.

(iii) For a purchase, the amount of the voucher will be placed on hold in the household's account.

(iv) The retailer must later call to clear the voucher.

(v) Once the voucher is cleared, the benefits will be removed from the household account.

(vi) In the case of a voucher return, the amount of funds to be returned to the household will not be credited to the household's account until the voucher is cleared.

(6) If a voucher authorization remains open without an associated voucher clear, the voucher authorization will be reversed no later than 30 days after the authorization.

(k) Store-and-Forward Processing

(1) Store-and-forward transactions are a very limited exception to the rule that retailers cannot store EBT card numbers and PINs, described in 7 CFR 274.8(e)(1). In cases where an EBT system is not functioning or is otherwise inaccessible ( i.e., during a power outage, natural disaster, etc.), SNAP-authorized retailers are allowed to temporarily store SNAP EBT transaction data (including EBT card numbers and PINs) and forward them for processing later, when EBT system functionality has been restored.

(2) Per 7 CFR 274.8(e)(1), only the SNAP State agency has the authority to allow retailers to accept store-and-forward transactions. The decision to accept store-and-forward is entirely the retailer's, and retailers assume 100% of the liability for such transactions.

(3) The standards for store-and-forward transactions are as follows:

(i) The retailer may choose to set a maximum amount that they will accept on a store-and-forward.

(ii) Store-and-forward transactions, when processed, must comply with regular rules for processing SNAP EBT transactions, including:

(A) Validation of card number,

(B) Validation of PIN,

(C) Validation of retailer, and

(D) Benefit balance availability.

(iii) The card acceptor is responsible for securely storing the transaction information with the encrypted PIN. The stored purchase information is later forwarded to the Card issuer for approval as a Financial Presentment transaction.

(iv) The retailer must forward such transactions for processing within 24 hours of the EBT system becoming accessible; and may only forward those transactions for processing one time.

(v) After the retailer forwards those transactions for processing, the retailer must delete all data regarding EBT card numbers and PINs.

(vi) A store-and-forward transaction may be partially approved, if the SNAP household's benefit account balances are insufficient to cover the purchase.

(vii) The retailer is liable for any portion of a store-and-forward transaction that does not comply with these rules.

(l) Transaction Data Retention

(1) The following are the rules for SNAP State agencies, EBT host processors, and SNAP-authorized retailers regarding ( printed page 66987) retention of data on SNAP EBT transactions. SNAP-authorized retailers must be able to comply with the requirements of this section at the time they become authorized.

(i) States must retain data on SNAP EBT transactions for at least three years.

(ii) SNAP-authorized retailers must maintain records of all SNAP EBT transactions for a minimum of seven calendar days.

(iii) Upon request from the State's SNAP agency or EBT host processor, retailers must provide records of such transactions within seven business days.

(2) Transaction Response Codes and Declined Transactions

(i) The EBT transaction response code is a sequence of letters and numbers that indicate whether a transaction was approved or denied. EBT transaction response codes display on a retailer's POS device after they attempt to conduct an EBT transaction. All transactions must be date- and time-stamped (using the retailer's location) and must be settled in U.S. dollars currency.

(ii) EBT transaction message specifications follow the X9.58 standard. That standard is established by ANSI's Accredited Standards Committee X9. ANSI is the American National Standards Institute, the accredited organization responsible for developing technical standards, including exchanging EBT financial transaction messages. The published standard is available on the American National Standards Institute (ANSI) Notice of Proposed Rulemaking (NPRM) Review Area. ANSI NPRM Review Area's landing page is accessible at www.surveymonkey.com/​r/​DQVJYMK.

(iii) A successful transaction will return a code of “00—Approved.” The following response codes indicate a declined transaction.

(iv) Values that are not included in Table 1 below are reserved for future use. Information in Table 1 is adapted from the X9 Standards at www.surveymonkey.com/​r/​DQVJYMK. In addition, please note that the exact wording displayed on the POS device or receipt for each code may vary:

(m) SNAP Data Security Requirements

(1) SNAP Data: For purposes of this document, SNAP data means any data generated as a result of a household's or retailers' participation in SNAP and application to participate in SNAP. This includes:

(i) Information in household and retailer applications, including personally identifiable information, such as name, address, Social Security number, etc.

(ii) Information regarding individual SNAP transactions,

(iii) SNAP card/account numbers,

(iv) Retailers' FNA numbers,

(v) Retailer SNAP redemption data.

(2) The following are the data security rules for SNAP State agencies, EBT host processors, SNAP-authorized retailers, TPPs, acquirers, Gateways, and any other entity that handles SNAP data:

(i) Such entities may exchange data other than the PIN for the purposes of processing transactions if they enter agreements to do so and if they follow transaction processing specifications and requirements.

(ii) SNAP EBT transactions must generally conform to the Payment Card Industry (PCI) Data Security Standard. The only exception is that processors must comply with federal requirements for sharing PAN data.

(n) Electronic SNAP Benefit Theft

(1) Electronic SNAP benefit theft occurs when criminals use electronic methods to steal a SNAP household's benefits and/or take control of their benefit account.

(2) To provide context for FNA requirements regarding EBT card security, this section summarizes the most common electronic SNAP theft and/or EBT fraud schemes currently in use by criminals.

(i) Card skimming: Card skimming is when a criminal places a card reading device on a retailer's POS equipment. The reader collects key card information—such as the PAN and PIN—when a client swipes or inserts their card during a transaction. Criminals then use this card information to steal a household's benefits.

(ii) Algorithmic attacks: Criminals can use bots or artificial intelligence (AI) to exploit internet vulnerabilities, by conducting a high number of rapid and repeated inquiries to steal key card information. For example, criminals have used this technology to exploit balance inquiry features of SNAP internet retailers and Interactive Voice Response (IVR) systems, to identify valid PANs and PINs and determine whether accounts have positive balances.

(iii) Phishing scams: Criminals use scams on text, email, phone, and social media to deceive households into providing key EBT card information. For example, in some States, scammers have spoofed, or imitated, the phone number of a government agency or the EBT processor customer service number to obtain key card information from households.

(iv) Card cloning: After key card information has been stolen through methods like skimming or phishing, criminals can use equipment to encode stolen card information onto blank magnetic stripe cards. Criminals then use cloned cards to steal SNAP benefits, after the SNAP State agency reloads benefits to the household accounts.

(A) While some cloned cards are physical cards, criminals can also use stolen information to complete transactions without an actual physical card (such as internet purchases, also known as “card-not-present” transactions).

(3) Required EBT Theft Prevention Options

(i) This section summarizes the EBT theft prevention account options that State agencies must offer to SNAP households, in order to protect their SNAP benefits from electronic theft and fraud.

(ii) States are required to educate SNAP households about how these options work (7 CFR 274.2(e)(15), must ensure all households have the ability to use these options, and are not excluded from using these options based on a disability or because they speak a primary language other than English (7 CFR 274.8(b)(4)).

(iii) Households must be able to opt in or opt out of using these options through each of the following interfaces (7 CFR 274.7(k)):

(A) EBT cardholder internet portal

(B) Mobile application

(C) Telephone request

(D) In-person request

(iv) EBT Card Blocking

(A) States must provide households with the ability to block and unblock ( i.e., freeze/unfreeze, lock/unlock) their EBT card from processing transactions, which protects benefits while the card is not in use. Households must be able to turn these options off and on instantaneously, as needed. For example, households should be able to unblock their card while they are checking out at a cash register and re-block it immediately afterwards.

(B) Currently, there are three types of blocks: card freeze, out-of-State transactions block, and internet transaction block. When any of these three blocking types are activated, purchases and balance inquiries will be blocked, but benefits can still be loaded onto the card and returns/refunds must still be processed.

(C) States must offer households the option to use each of the following types of blocking:

(1) Card Freeze: Households must have the option to “freeze” their EBT card, which prevents it from being used for purchases (either online or at brick-and-mortar retailers) or balance inquiries.

(2) Out-of-State Transactions Block/Freeze/Lock: When criminals obtain EBT card information, they often make unauthorized transactions outside of the household's home State. Households must have the option to block some or all out-of-State transactions ( e.g., blocking all transactions that do not occur in the household's home State, blocking transactions in certain States with high rates of theft).

(i) When implementing out-of-State blocking, States should be aware that internet transactions may appear to be out-of-State transactions, if the internet retailer is located or headquartered outside of the household's home State. For example, when out-of-State blocking is activated, a SNAP household who lives in one State should not be blocked from buying food on a large retailer's website, even though that retailer's headquarters is in another State, as long as the purchase is delivered or picked up in the household's home State.

(ii) States may choose to consider internet purchases that are delivered or picked up out-of-State to be “out-of-State transactions” ( printed page 66989) for the purposes of this card block. For example, when out-of-State blocking is activated, a State agency may choose to block a household's transaction on a large retailer's website if they set the purchase or delivery address to one within a neighboring State.

(3) Internet Transactions Block/Freeze/Lock: Households must have the option to block their EBT card from being used for internet (“card-not-present”) transactions. Specifically, households must be able to unblock their card before making an internet purchase and re-block it afterwards.

(i)Note: This option should block all internet purchase transactions and balance inquiries, regardless of where the internet retailer is located or where the delivery/pickup address is located.

(D) Currently, States are not allowed to completely freeze EBT cards by default, due to interoperability requirements at 7 CFR 274.8(b)(10).

(E) States are allowed to implement a default block on out-of-State transactions and/or internet transactions. States are only permitted to implement these default blocks if they comply with relevant statute and regulations and provide a way for households to unblock transactions. States that implement default transaction blocking must ensure that all SNAP clients maintain access to their benefits, including those clients with disabilities.

(v) Maximum Amount Per Transaction Limit

(A) States must provide households with the option to set a maximum purchase amount per transaction limit, so that transactions over that limit are automatically blocked.

(vi) Limits on Returns

(A) States may choose to provide households with the option to set a limit on the number of returns that can be conducted within a period of time ( e.g., no more than five returns per day) or a maximum dollar amount per return.

(B) States may choose to enable this option as the default setting for all SNAP households for brick-and-mortar purchases only. States should not enable this option for internet purchases. States do not have to allow households to remove returns limits.

(vii) Alerts

(A) States must provide households with the capability to receive transaction alerts, similar to alerts that are standard in the commercial banking industry. Households must be able to opt into these alerts, which will be delivered via email and/or text message. The required alerts are the following:

(1) Purchases on the account, including rejected purchases ( e.g., insufficient funds purchases, blocked purchases due to card restrictions). These alerts should include information on the purchase method ( e.g., point-of-sale transaction, internet transaction) and date and time of the purchase.

(2) Specific account activity, including PIN changes and balance inquiries. These alerts should include information on the activity method ( e.g., point-of-sale transaction, internet transaction, IVR) and date and time of the activity.

(3) Changes to personal account information such as address, email address, and telephone number.

(B) States may choose to enable this option as a default setting for all SNAP households. States must allow households to turn off the alerts if desired.

(viii) Transaction History

(A) For purposes of preventing EBT benefit theft, households must have up-to-date information on their account activity. To that end, States must provide SNAP households with access to 12 months of transaction history for their EBT account through an online account management system and mobile account information system (7 CFR 274.7(d)(2), 7 CFR 274.8(b)(4)(i)(H), 274.8(b)(4)(i)(I)). This must include the following information:

(1) EBT transaction dates, times, and amounts. This must include information on whether the transaction was approved or rejected, and why ( e.g., insufficient funds purchases, blocked purchases due to card restrictions).

(2) Type of transaction (card-not-present or card present).

(3) Identifying information for retailer, excluding FNA numbers.

(4) History of balance inquiries made.

(5) Dates and times of PIN changes.

(6) History of other personal account information changes including address, email address, and telephone number.

(7) Other account changes such as enabling or disabling specific account options.

(B) This information must be made available to SNAP households in real time.

(ix) CAV Validation

(A) States must work with their processors to require Cardholder Authentication Value (CAV) validation (7 CFR 274.8(5)(vii).

(B) CAVs are encoded in the magnetic stripe of EBT cards and are not printed on the card. Criminals can obtain CAVs through card skimming, but not through other methods ( e.g., phishing, algorithmic attacks). Thus, CAV validation can prevent benefit theft from cards that are cloned via methods other than skimming, since they will not be encoded with the correct CAV information.

(4) PIN Security

(i) The Personal Identification Number (PIN) is a number that is connected to a particular SNAP EBT card and is assigned to or chosen by a SNAP household. The PIN is used as a password, to verify a household's identity, granting them authorization to conduct SNAP transactions and otherwise access the SNAP account.

(ii) This section describes the requirements for PINs used with SNAP EBT cards/accounts. SNAP State agencies—working through their EBT host processor—must ensure these requirements are met.

(iii) Blocking Easy-to-Guess PINs

(A) States must prohibit SNAP households from having PINs that are easy for criminals to guess (7 CFR 274.2(f)(2)). Specifically, States must prohibit PINs that are comprised:

(1) Entirely of sequential digits (with zero considered sequential to both one and nine),

(2) Entirely of reverse sequential digits (with zero considered sequential to both one and nine),

(3) Entirely of one repeated digit,

(4) Of the last four digits of the associated EBT card's PAN,

(5) Entirely of alternating digits ( e.g., 1212, 8989, or 5454),

(6) Of a number that has 19 or 20 as the first two digits,

(7) Of the sequential digits 2580, 8520, 0852, or 0258 (these sequences are commonly chosen for PINs because they reflect the vertical digits of a numeric keypad in order).

(iv) Activation of Newly Issued EBT Cards

(A) States must ensure that new and replacement EBT cards are issued to households in inactive status (7 CFR 274.2(f)(3)). This means the EBT card is not functional until the SNAP household activates the card ( e.g., by calling into the IVR). After activation, households can select their own PIN.

(v) PIN Security Requirements

(A) The following standards apply to PIN security:

(1) PIN security and management must conform to the most current version of technical standards at ANSI X9.8 and ISO 9564.

(2) When selecting or changing their PINs, SNAP households must do so at the State agency office or via a secure electronic process approved by FNA and the State agency ( e.g., an online cardholder portal, a mobile application, a phone or interactive voice response [IVR] process),

(3) EBT cards must not contain any data which could be used to identify PINs.

(4) POS devices used for SNAP must:

(i) Accept and securely encrypt a PIN of at least four digits,

(ii) Not display PIN in plain text,

(iii) Not print, electronically record, or otherwise create or maintain a record of PINs.

(5) PINs must be encrypted at minimum from the point of entry, in accordance with requirements at 7 CFR 274.8(b)(3)(ii)(C). This protects PINs, both when the household is initially selecting a PIN, and afterwards, when using it to make a purchase at a retailer's POS device.

(i) PIN data must be encrypted and represented as packed binary data, ( i.e., eight binary bits shall be represented as 16 hexadecimal characters). The PIN must be formatted into a PIN block consistent with the most current version of standards at ANSI X9.8/ISO 9564-1 before encryption.

(6) SNAP households commonly choose their PIN by calling into an Interactive Voice Response (IVR) telephone system. The IVR PIN-selection process is not as secure as an encrypted in-office PIN selection device, but aligns with common practice in the commercial banking industry (7 CFR 274.2(f)(2)). States and their processors must adhere to the following requirements, to ensure the IVR PIN-selection process is as secure as possible:

(i) The IVR PIN-selection process must be completely automated, without involving any customer service representatives,

(ii) When households select their PIN via IVR, they must enter two elements of their personally identifiable information (PII), such as birth date, last four of the social security number, zip code, case number, etc., to confirm their identity,

(iii) States are 100% liable for losses resulting from the IVR PIN-selection process, ( printed page 66990) including the replacement of the stolen SNAP benefits due to unauthorized transactions, security breaches, or incorrect identification of the person setting a PIN via IVR.

(7) States may request exemptions to these PIN encryption methods by proposing an alternative that is at least as effective, which FNA may consider and grant on a case-by-case basis.

(vi) Online PIN Entry Method

(A) SNAP regulations at 7 CFR 274.8(b) require that PINs be entered only through ANSI-compliant POS devices. 7 CFR 274.8(b)(3)(ii)(C) and 274.8(b)(6)(iii) require that PINs must be encrypted, at a minimum, from the point of entry.

(B) FNA has waived those requirements for internet retailers, instead, they must comply with the following requirements:

(1) Secure, implement, and enforce a contract for secure PIN-entry services to be used on their SNAP online purchasing website.

(2) Online SNAP transactions must go through a secure PIN-entry TPP. Currently, the only approved TPPs for SNAP online are Fiserv, WorldPay, and Forage. FNA is willing to work with any TPP an applicant chooses to partner with, assuming they meet the technical requirements for securely processing EBT payments online.

(3) Retailer's website and mobile application must conform to all PIN-entry requirements and standards required by FNA regulations and applicable industry standards.

(4) The website, mobile application, and/or any other intermediary service provider(s) responsible for use of SNAP EBT card numbers must continue to maintain PCI certification.

(5) Retailers must maintain a secure system that ensures the security and privacy of EBT customer data.

(vii) Transactions that do not require a PIN

(A) Manual Voucher Clear (previously known as “Voice-Authorized Manual Voucher”): This is a request to clear a previously voice-authorized manual voucher, where a voucher clear, voucher number, and a voice approval code were assigned, and the SNAP household is no longer present. To clear a voucher, the retailer must use the same voucher number and card number that was used on the voucher authorization, and the approval number that was given for the voucher authorization.

(B) PIN-less Refunds for SNAP-Authorized Online Retailers: Because SNAP households—and therefore their PINs—will typically not be present when a SNAP-authorized online retailer processes a refund, such retailers have a blanket waiver from the 7 CFR 274.8(a)(2) requirement that PINs be present for refunds. The following conditions apply:

(1) All PIN-less refund transactions must be processed by a secure PIN-entry TPP.

(2) Retailers must maintain a secure method for entering and authorizing PIN-less refunds.

(3) While a PIN is not required for an internet return, if the household does enter a PIN it must match the card PIN.

(4) PIN-less refunds for internet transactions must return the funds to the household's account, even if the card has been “statused” ( e.g., cancelled, de-activated, or reported as lost).

(5) Retailers must use the PIN-less refund process when items are out of stock or to refund an amount that was overestimated for weighted items.

(6) Due to the PIN-less refund functionality, internet retailers must not use manual adjustments for this purpose.

(o) SNAP EBT Chip Cards

(1) EBT Chip Card Requirements

(i) EBT chip cards are payment cards that have a computer chip embedded in them, providing security features that are superior to payment cards which only utilize a magnetic stripe. An EBT chip card can be insert-only or dual interface. A dual-interface card can be inserted (a.k.a., “contact” payment) or “tapped” (a.k.a., contactless payment) at a point-of-sale device. The contactless payment technology in an EBT chip card utilizes Near Field Communication (NFC). NFC is a protocol that enables wireless communication over short distances (a few inches) between payment cards and POS devices. Chip cards that are capable of conducting NFC contactless transactions are generally considered more secure than chip cards that must be inserted into POS devices.

(ii) All States must issue SNAP benefits via NFC-enabled chip cards (7 CFR 274.1(a)). Generally, States will begin implementation by piloting chip cards in limited geographic areas. States must provide adequate notification to households and retailers before making this transition. States must ensure that chip cards continue to include a magnetic stripe to ensure that SNAP households have a fallback payment option in case the chip card does not work at a certain retailer.

(iii) FNA recommends that States issue new EBT chip cards in phases, in order to minimize disruption for SNAP households, and to provide an opportunity to troubleshoot any issues that arise. Retailers, processers, TPPs, and Gateways must work with their SNAP State agencies to conduct testing as soon as possible, to ensure the new chip cards work as intended. If retailer POS systems have not yet been programmed to accept EBT chip cards, retailers (or their acquirer or TPP) must conduct testing to confirm the card will “fallback” to use the magnetic stripe on the card until the retailer's POS system can process chip card payments. Retailers should contact their POS service provider or TPP for help conducting the fallback testing.

(2) Retailer Upgrades to Support SNAP EBT Chip Cards

(i) The following are the requirements for SNAP-authorized retailers to support NFC-enabled SNAP chip cards.

(A) SNAP chip cards will include a new service code (220), informing the POS terminal that the card has a chip.

(B) The payment application on the chip will use a new Application ID (AID): A0000000044542. POS providers, acquirers, and TPPs must assist retailers in updating their POS devices and systems accordingly.

(C) The application identifier (AID) encoded in the chip indicates to the POS terminal what type of card is being used. POS terminals are also coded to accept specific AIDs. For a chip card transaction to be successful, the card and the terminal need matching AIDs, meaning that all POS terminals must be updated with the new EBT chip AID in order to process EBT chip card transactions.

(D) The AID is composed of two parts, the registered application provider identifier (RID) and the proprietary application identifier extension (PIX). EBT chip cards will include the unique AID A0000000044542. The unique AID will allow POS terminals to support SNAP processing rules ( e.g., PIN entry required, fallback rules) via standard terminal action codes (TACs).

(3) Empty Candidate List Fallback Process

(i) Most retailers currently accept other NFC-enabled chip cards ( e.g., credit and debit cards issued by a bank or credit union), but their POS devices do not yet support the new AID for SNAP EBT. In such cases, when a SNAP household tries to use a SNAP chip card at the POS device, the device will recognize that the card has a chip but will not recognize the SNAP AID. When this occurs, the POS device must allow the card to proceed with a magnetic stripe transaction. The technical name for this process is Empty Candidate List (ECL) fallback. The specific steps for an ECL fallback transaction are as follows:

(A) If a household with an NFC-enabled SNAP chip card attempts a magnetic stripe transaction before attempting a chip transaction, the POS device will direct the household to insert or tap the card instead.

(B) If the retailer's POS device has been updated with the new chip card AID, the chip transaction will process successfully.

(C) If the POS device has not been updated, attempts to conduct EBT chip card transaction will fail. The POS device will then prompt the client to swipe their card.

(D) It is important that retailers train all employees working at checkout on this new ECL fallback process.

(ii) Magnetic stripe EBT cards that do not contain a chip have a service code (120) in the magnetic stripe indicating that they are magnetic stripe only and should continue to function as usual.

(iii) SNAP households should follow the same process to select the tender type ( e.g., SNAP or cash) and enter their PIN, regardless of whether they process the transaction by swiping, inserting, or tapping their EBT card.

(4) Household Notification for Changes in Payment Technology

(i) States must notify SNAP households before they implement a new payment method, including integrating electronic chips into EBT cards. This may include notifications about an upcoming transition issued via press releases; updates to their websites, apps, or client portals; posters in certification and issuance offices; through outreach partners; and/or notices mailed to households in advance of a payment technology transition. States must also send households detailed individual notifications containing the information necessary to make the transition without suffering loss of access to their benefits ( e.g., directing households to activate their new EBT card).

(ii) FNA also expects States to notify and work with SNAP-authorized retailers and ( printed page 66991) retailer associations to ensure that as many SNAP retailers as possible prepare to accept EBT transactions via new methods before States begin the process of replacing existing SNAP cards. This will simplify the transition for SNAP households, who might otherwise face confusion over which transaction methods they should use at individual retailers. States should also educate households about the security benefits of new transaction methods, so that households understand the benefits of selecting retailers who have made the necessary upgrades to accept more secure payment systems.

(5) Key Management

(i) State master keys utilized for EBT chip card personalization and transaction processing must be transferable in the event of a state conversion to another EBT processor. EBT processor contracts for EBT chip card services must include a transition plan detailing how master keys for EBT chip card personalization and transaction processing will be transferred to an incoming EBT processor in the event that services from the incumbent EBT processor are discontinued. Impacts to and preservation of EBT chip card stock for over-the-counter issuance should also be considered and detailed in the transition plan.

(p) SNAP EBT Card Design and Requirements

(1) SNAP EBT cards issued by States must comply with the requirements of this section, which reflect the requirements in 7 CFR 274.8(b)(5).

(i) Required (printed on the card):

(A) Address of the office where the card can be returned if it is lost or no longer in use.

(B) Text that says “[a]ny user with valid PIN can use SNAP benefits on this card and need not be pictured . . .” or similar text approved by FNA.

(ii) Prohibited:

(A) EBT cards—as well as their sleeves, jackets, buck slips, and the like—must not contain the name of any State or local official.

(B) EBT informational materials must not indicate any political affiliation (with a party or otherwise).

(iii) Allowed: State agencies may require that EBT cards include photographs of household members. However, if the State agency does so, it must establish procedures to ensure that all appropriate household members and authorized representatives are able to access benefits from the account.

(iv) FNA reserves the right to require State agencies to place a Department logo on the EBT card, sleeves, jackets, buck slips, and the like.

(2) SNAP regulations at 7 CFR 271.2 define the various types of EBT cards:

(i) Magnetic stripe,

(ii) Integrated electronic chip capable of conducting transactions by either being inserted into a card reader or via wireless Near Field Communication (NFC) protocols,

(iii) Contactless digital wallet with a stored virtual card, and

(iv) Any other similar benefit access technology approved by FNA.

(3) Newly issued EBT cards can no longer rely solely on a magnetic stripe as a method to conduct transactions (7 CFR 274.1(a)). The primary method of conducting EBT transactions must be a physical card with an integrated electronic chip that is capable of conducting transactions both by being inserted into a card reader and via wireless NFC protocols.

(4) EBT cards may continue containing magnetic stripes to conduct transactions as a fallback method and must not permit a transaction to be conducted via magnetic stripe until there has been at least one failed attempt to conduct the transaction via electronic chip.

(5) Card Verification Value/Card Security Code

(i) Validation of a Card Verification Value (CVV)/Card Security Code (CSC) is a method used to confirm that an internet transaction is being conducted by a SNAP household in possession of their physical/actual SNAP EBT card. For the purposes of this document, we will refer to these as CSC. All EBT cards must have a three-digit number for the CSC, printed or stamped onto the back of physical SNAP EBT cards, which must not be electronically stored on the card itself in any form (7 CFR 274.8(b)(5)).

(ii) The CSC must be input by the SNAP household when they conduct an internet SNAP transaction, thereby proving that the person conducting the transaction has possession of the actual/physical card.

(iii) SNAP internet retailers must ensure that their EBT systems are capable of requiring input of a card's CSC and verifying the content of the input along with verification of other transaction details. Retailers must not store the CSC in any form.

(6) Card Expiration Date

(i) EBT cards must utilize an expiration date (7 CFR 274.8(b)(5)). The card expiration date is specifically related to the physical card and does not refer to the expiration of client benefits. The expiration date must be set for a length of time that ensures the card must be replaced before degradation of electronic components in the EBT card which would affect the use of the card begins. The card expiration date is also an important fraud prevention strategy, as it relates to internet purchases, as it is another data point that households must input when making a purchase.

(ii) State SNAP agencies must establish an effective replacement procedure for expiring EBT cards in order to ensure that SNAP clients do not experience interruption to the continued use of their EBT cards.

(iii) States must not charge a fee for an EBT card that is being replaced due to expiration, or an EBT card being replaced due to a change in benefit delivery method ( e.g., a move to chip cards). States also must not count these card replacements toward the excessive replacements threshold as described in 7 CFR 274.6(b)(6).

(iv) See Section (t) on household training requirements regarding the card expiration date.

(q) SNAP Online EBT Processing

(1) The Agricultural Act of 2014 directed FNA to implement a pilot to allow the use of SNAP benefits to purchase SNAP-eligible food from SNAP-authorized internet retailers. Today, SNAP online purchasing is available in every State. For households to make online purchases, the SNAP online shopping and payment process must be secure, private, easy to use, and provide similar support to that found for SNAP transactions in a physical “brick-and-mortar” retail store.

(2) EBT Processing Requirements for Internet Retailers

(i) Retailers that want to accept SNAP benefits for online purchases must apply to become a SNAP-authorized internet retailer. Such authorizations are separate from the authorization that brick-and-mortar stores must submit.

(ii) To be approved, retailers must already have an existing online eCommerce presence. In other words, they must have an online sales platform that allows customers to make online purchases. Retailers' online sales platform ( e.g., website, mobile app, etc.) must meet the requirements for SNAP online purchasing, including functionality for:

(A) Securely integrating online PIN-entry through a TPP's Application Programming Interface (API).

(B) Handling errors with appropriate codes.

(C) Processing SNAP payments and refunds.

(D) Processing variable and estimated item pricing ( e.g., buying items that are priced by weight, meaning that the final weight and cost may vary).

(E) Allowing only one SNAP EBT card to be saved to a household account.

(F) Ensuring only SNAP-eligible foods can be purchased with SNAP benefits.

(G) Allowing split-tender transactions.

(H) Collecting and transmitting the EBT card's CVV/CSC and expiration date when conducting an internet transaction.

(I) Preventing fraud either by not allowing balance inquiries or doing all of the following:

(1) Remove the “guest checkout” option from its eCommerce platform.

(2) Limit the number of balance inquiries a SNAP household can conduct within a specific time period. FNA recommends a maximum of two balance inquiries per hour.

(3) Limit the number of times a SNAP household can change the EBT card they are using to make purchases within a specific time period.

(J) Ensuring that API information is secure and protected from unauthorized access. If a retailer has blocked balance inquiries from its website and balance inquiries are still occurring, it could mean that the retailer-side API connection to its secure online PIN solution may have been hacked.

(iii) SNAP-authorized internet retailers must be capable of conducting many of the same EBT transactions as other SNAP-authorized retailers: authorizations/denials, refunds, cancellations, and settlement.

(3) Internet Shopping Customer Fees

(i) The 2014 Farm Bill prohibits the use of SNAP benefits to pay for any fees for delivery, pickup, shipping, ordering, convenience, handling, or other charges related to a SNAP online purchase. When households conduct a SNAP internet purchase, retailers must provide clear notification that these fees cannot be paid with SNAP benefits. The notice must display as soon as the household selects SNAP EBT ( printed page 66992) as the payment method. The household must also be given the opportunity to terminate the purchase or select a different form of payment before the sale is finalized.

(4) Internet Purchases

(i) Purchases from SNAP-authorized internet retailers do not generate a printed receipt at the time of sale. However, internet retailers must still comply with regulations on receipts per 7 CFR 274.8(b)(7).

(ii) For all approved purchases, internet retailers must:

(A) Display a confirmation screen that appears immediately after the purchase, which the household can print, screenshot, or download, and

(B) Email or text an order confirmation within 24 hours of the purchase time.

(iii) In addition to the receipt requirements applicable to all SNAP-authorized retailers, internet retailers must also include the following items in the purchase confirmation screen and email/text confirmation:

(A) Retailer phone number (or other contact information),

(B) Pickup location or delivery address, and

(C) Actual or estimated delivery/pickup date (and time, if known)

(iv) Alternatively, instead of the emailed or text message order confirmation, the retailer may maintain a secure online order history for customers to easily see their orders.

(5) Internet Refunds

(i) Internet refund policies differ by retailer. Internet retailers can only process returns/refunds up to 90 days after an internet purchase. FNA does not require that PINs be present for SNAP internet refund. Retailers must have the capability of initiating a refund without a direct request or input from the SNAP household being refunded.

(ii) For internet refunds, retailers must issue an electronic notice to the customer within 24 hours, containing, at a minimum, the transaction date and time, retailer name, retailer phone number (or other contact information), pickup location or delivery address, actual or estimated delivery/pickup date (and time, if known), EBT program type ( e.g., SNAP, Summer EBT, or cash EBT), SNAP purchase amount, remaining EBT balance(s), and the truncated PAN (last four digits).

(iii) Instead of an electronic receipt for refunds processed after the initial purchase ( e.g., refunds for out-of-stock items), the retailer may choose to provide a paper refund receipt containing the above information with the order ( e.g., in the box with the delivered items). This may be combined with the final itemized order listing or on a separate paper receipt.

(iv) Shipping costs, including fees for returns, may not be paid for using SNAP benefits. The full value of any returned item purchased with SNAP benefits must be refunded back to the household's SNAP account. Internet retailers must cover return shipment costs themselves or ask the household to pay those costs with an alternate form of tender ( e.g., EBT cash, credit/debit card).

(v) Internet retailers must ensure that refunds for internet purchases are returned to the account associated with the internet retailer's FNA number rather than the brick-and-mortar retailer's FNA number, even if the return physically takes place at the brick-and mortar location.

(vi) Refunds for returned items or other customer-initiated events must be processed within two company business days.

(6) Denied Internet Transactions

(i) EBT host processors must ensure that internet transactions are properly received, processed, transmitted, and settled. Processors must ensure that internet transactions are denied in the following situations:

(A) Internet purchases from any internet retailer not authorized by FNA,

(B) PINless refunds from any internet retailer not authorized by FNA, and

(C) Purchases from an internet retailer that are being made from a POS device.

(ii) If an internet transaction is denied, the internet retailer must provide a reason for the denial ( i.e., a denial code). Specifically, the platform (website, app, etc.) must immediately provide the household with an onscreen explanation of the denial reason, so they have a chance to correct the issue. The most common reasons for denial are invalid card number, invalid PIN, and insufficient funds.

(iii) The customer must be offered the opportunity to perform the transaction again, select a different payment method, or opt out of the sale.

(iv) If a transaction is denied for insufficient funds, the household should be given the opportunity to perform the transaction for a lesser amount or select different tender. The website may opt to:

(A) Provide a message indicating to the client that they do not have sufficient funds to complete the transaction, but the balance does not need to be included in this error message display.

(B) Use the remaining SNAP account balance to pre-fill the amount entered for the new transaction attempt.

(C) Require the household to delete individual items from their purchase cart or move items to a non-SNAP cart for payment with another tender ( e.g., cash), until they reach a subtotal less than or equal to the remaining SNAP balance.

(7) Prepayment and Deliveries

(i) FNA regulations at 7 CFR 274.7(b) prohibit retailers from accepting SNAP “prepayment” ( e.g., payment before an EBT card is presented to the retailer). This regulation is waived for internet retailers. However, internet retailers must comply with the following prepayment and delivery timeframe standards:

(A) Internet retailers must not allow households to use multiple delivery addresses for a single SNAP EBT transaction.

(B) Internet retailers are required to deliver and/or prepare all orders for pickup within seven calendar days, unless the household specifically selects a later delivery or pickup date.

(C) If a retailer allows split orders ( e.g., multiple separate deliveries for a single SNAP EBT purchase), all portions of the order must be received by the household within the mandatory timeframe.

(D) Prior to submitting the transaction for authorization, internet retailers must clearly explain the delivery process and timeframe to the household.

(E) Internet retailers that do not allow households to select their own delivery or pickup time must provide the estimated delivery/pickup date and allow the household to cancel the transaction before the sale is finalized.

(F) Retailers must not allow the use of EBT cards for standing-subscription orders ( e.g., automatic monthly food deliveries).

(G) If, by the fifth day after the transaction, it is clear the seven-day delivery/pickup limit will be exceeded, the retailer must notify the household of the new expected delivery/pickup date—by email, text, or phone—and offer the opportunity for an immediate and full refund instead.

(H) Refunds that result from overestimated weighed products, substitutions, or out-of-stock items must be made to the client immediately after fulfillment of the order.

(8) Payment Card Industry Compliance

(i) All SNAP-authorized internet retailers must be compliant with the Payment Card Industry (PCI) Data Security Standards. PCI standards address the secure encryption and handling of sensitive data, such as card numbers and PINs while “at rest” ( i.e., being stored temporarily or permanently). Before a retailer can be authorized to accept debit or credit transactions, they must be certified as PCI-compliant by their acquiring institution. This certification is performed annually and covers a wide spectrum of security and privacy issues. FNA requires that every SNAP-authorized internet retailer be PCI-certified and maintain that certification on an ongoing basis.

(ii) Because there is no single way to become PCI compliant, the payment security industry uses several best practices to safeguard sensitive data and customer privacy. The PCI Security Standards Council offers a variety of standards which can be used to achieve PCI compliance. Ultimately, the specific methods used by any given organization to achieve compliance will vary. Each organization must identify and document the methods they will use to achieve PCI compliance, and must continually upgrade and improve their methods.

(iii) Generally, best practices to achieve PCI compliance include:

(A) Tokenization (replacing sensitive data like card numbers with unique, random strings of digits to protect against data breaches during transactions).

(B) Device fingerprinting (comparing current hardware/software characteristics to a user's previous usage, including comparing their physical device, browser version, internet Protocol [IP]) address, app vs. browser usage, etc.).

(C) Use of secure sockets layer (SSL) technology or other strong firewall configurations.

(D) Minimum browser standards (requiring certain browser versions, 128-binary digit (bit) encryption, etc.).

(E) Required use of login IDs and passwords for internal and external access to website. ( printed page 66993)

(F) Strong policies for ID and password format and handling of forgotten IDs and passwords.

(G) Establishing system user roles that restrict users from updating or extracting PII and card data, based on whether they legitimately need to access such information.

(H) Use of sitekeys or other customer site authentication (a security system that verifies both the user and the website itself, and displays a unique image or phrase when users attempt to log in).

(I) Use of commercial security and encryption products for both data in transit and at rest.

(J) Trust seal certification (a visual stamp or badge displayed on a website or data repository to indicate that it has undergone security and verification checks by a trusted third party, demonstrating a commitment to data protection and compliance).

(K) Stringent information security policies for all company and contractor personnel.

(L) Regular use and update of anti-virus software or programs.

(M) Restricted physical access to personal data stored on the system.

(9) Card Must Be Present

(i) In regular brick-and-mortar transactions, the EBT card must always be present when a household performs a transaction, whether the card is swiped, tapped, inserted, key-entered, or processed by manual voucher. However, it is not possible for internet retailers to determine if households have their EBT card in hand when they enter the card number to make an internet purchase. Therefore, FNA automatically waives the “card must be present” requirement for all approved internet retailers. The following conditions apply:

(A) Internet retailer payment systems must always code internet transaction messages as “card not present” transactions.

(B) The internet retailer must notify FNA whenever significant changes are made to its online shopping/payment platform policies and practices regarding refunds, customer complaints, privacy, or security. Retailers must provide FNA with a copy of or link to the revised information.

(10) Equal Treatment

(i) FNA regulations at 7 CFR 274.7(f) and 278.2(b) require that SNAP-authorized retailers treat SNAP households equally to other customers. This is generally referred to as the equal treatment rule. In other words, retailers may generally not treat SNAP households differently (either positively or negatively), in any way.

(ii) There are some exceptions to the equal treatment rule: First, retailers must never charge sales tax on eligible foods purchased with SNAP benefits. There are some additional exceptions that automatically apply to SNAP-authorized internet retailers:

(A) Internet retailers may offer to waive or discount delivery and in-store pickup fees for SNAP households.

(B) Internet retailers may offer to waive or discount fees in their membership or discount clubs for SNAP households.

(r) Mobile Payments

(1) A digital wallet (or electronic wallet) is a software-based system or an application that runs on any connected device. It stores your payment information and passwords of numerous payment methods and websites. Digital wallets run primarily on smartphones, but may be accessible from a computer—mobile wallets, which are a subset, are primarily used on mobile devices.

(2) Mobile payments require the use of a Token Service Provider (TSP) that manages and issues payment tokens, which are unique identifiers that replace the PAN with a Device Primary Account number (DPAN) which is a token that is stored on the device after the card is provisioned ( i.e., added, saved, or stored) to the wallet.

(3) Mobile payments work using similar technology as “contactless” or “tap” cards ( i.e., NFC-enabled chip cards). The same AID will be used for chip cards and mobile payments.

(4) Adding a Card

(i) When a card is added to Wallet, a digital representation (token) of that card is created and linked to a single device. Tokenization masks the underlying card number, helping to protect the cardholder from data breaches and criminals trying to steal benefits.

(ii) The wallet provider performs cardholder verification in conjunction with the EBT host processor, allowing the card issuer to verify that the individual provisioning the card matches the identity of cardholder/household before a card can be added to the wallet. This may be through the use of the processor's client portal or other means.

(s) EBT System Project Implementation

(1) The implementation of new State EBT systems and updates/modifications to existing EBT systems require thorough testing by States prior to implementation ( i.e., “go-live”). As part of this testing, each State must successfully pass a Federal Acceptance Test with FNA prior to implementation, in accordance with FNA policy. Federal Acceptance Testing is required for changes caused by updates to the X9.58 standards; implementation of new programs, projects, or pilots; and the addition of significant new features or tools for the State or households. FNA will decide the level of its involvement in system testing based by conducting a risk assessment. When there is minimal risk—for example, there is no host processor or platform change and no major changes in functionality—FNA oversight of testing is likely not required.

(2) User Acceptance Testing (UAT) is the testing performed by the State ( i.e., the system user). Testing may take several weeks. Typically, States require the EBT contractor to provide them with test equipment (POS terminals) and software (access to a test environment for the administrative terminal and POS simulator), sufficient for performing preliminary testing prior to a UAT. This section discusses UAT specifically as it relates to SNAP EBT.

(3) System changes that require User Acceptance Testing (UAT) include:

(i) State's initial implementation of EBT

(ii) Change in a State's contracted EBT host processor (database conversions)

(iii) Transition to EBT chip cards

(iv) Nutrition incentive program implementation

(v) Mobile Payment Pilot implementation

(vi) Any modifications to the system due to updates to the X9.58 standards; implementation of new programs, projects, or pilots; and the addition of new features or tools for the State or households.

(4) UAT must include end-to-end testing, conducted by the SNAP State Agency, in conjunction with their EBT host processor and FNA, in order to ensure that system changes work as expected throughout every component of the EBT system.

(i) The processor is responsible for conducting preliminary performance testing to simulate large transaction volumes, to determine how the system responds to various conditions, to gauge response time, and identify processing errors.

(ii) The remaining functional areas are tested by the State, processor, and FNA during the UAT.

(iii) UAT can be hosted by the State or the processor.

(iv) FNA must be involved with UAT planning and attend all testing, either in person or virtually. Additionally, FNA may have a technical assistance contractor participate in the UAT as well.

(v) Before the UAT:

(A) The State should provide the test plan and test scripts for review and comment before finalized. These documents should be made available to FNA at least 60 days before testing begins.

(B) FNA will also provide suggested “what-if” tests to the State before the UAT.

(5) Conversion is the movement of data from an old EBT system to a new EBT system. Most typically, it is necessary when a State awards an EBT contract to a processor that is not their incumbent. If the State selects a new EBT contractor, the transition process is very complex, because it usually involves both database and retailer conversion. Database conversion involves the movement of data from one system or platform to another and implementation of a new administrative terminal system. Retailer conversion involves the State's new EBT host processor issuing new EBT-only POS equipment to retailers who previously received EBT-only POS equipment from the State's outgoing EBT host processor, since that existing equipment connects directly to the outgoing EBT host processor.

(i) The incumbent processor must cooperate fully with the State and the new processor.

(ii) During conversions (which generally take months to complete), States must continue using their outgoing processors' system while the incoming processor is building a new EBT system.

(A) As discussed in the sub-section above, the State, new processor, and FNA will conduct UAT prior to implementing the new EBT system.

(iii) States are responsible for communication regarding EBT Database Conversion to households and retailers. FNA will often assist the State in sending out retailer notifications.

(iv) The final steps in a conversion are typically conducted during a weekend (conversion weekend).

(v) During conversion weekend (and in the days leading up to that weekend), ( printed page 66994) participants follow an hour-by-hour schedule of events.

(A) The incoming processor is responsible for creating that schedule, with input from the State, incumbent contractor, and FNA. Preparation of this schedule typically takes several weeks, so incoming processors must plan accordingly.

(B) The completion of tasks in the hour-by-hour schedule typically begins several days before conversion weekend and runs through the Monday after conversion weekend.

(C) The conversion weekend schedule must include all tasks required for the conversion and their estimated timeframes that were based on the mock runs. The schedule must also include all conversion conference call and the required attendees for those calls. The status of each task on the schedules is updated as conversion weekend progresses, which informs participants about next steps to be taken.

(t) Household Training on EBT

(1) States are required to educate SNAP households on SNAP participation including use of the EBT system (including all elements listed in 7 CFR 274.2(e)). Household training must be incorporated into the SNAP household certification process. States may choose various methods to convey this required information, as long as households receive training on all required. States should design their household education to ensure that SNAP households are not overwhelmed with information that prevents them from absorbing the most important knowledge.

(2) States may use a variety of training materials including:

(i) EBT card brochure

(ii) SNAP policy manual

(iii) Information available on the State agency's web portal

(iv) Information available through the State agency's mobile application

(v) Training videos posted online or displayed in State field offices

(vi) Verbal information provided during initial interview or re-certification

(A) If this method is used as a household training method, it should be documented in the State agency's eligibility system.

(3) The following sub-sections provide more detailed information on two important topic for elements household training.

(4) Household Training: EBT Theft Prevention

(i) States must provide household training that informs SNAP households about EBT card security best practices that will reduce their chances of being a victim of benefit theft.

(ii) FNA recommends that household training include the following elements:

(A) The appropriate utilization and security of the EBT card's PIN. Specifically:

(1) Households should change their PIN frequently (at least monthly), ahead of benefit issuance dates.

(2) Households should be informed that they are not allowed to choose simple or easy-to-guess PINS ( e.g., 1111, 1234).

(3) Households should not share their PIN or card number with anyone outside your household.

(4) Households should cover the keypad when they enter their PIN on a machine.

(5) Cardholders should avoid writing their PIN on their card or anywhere that could easily be found.

(B) Common methods of EBT theft and how to avoid them. States should keep this training material up to date as fraud methods change.

(1) This training should include education on card skimming and phishing schemes. States should inform households that neither the State nor EBT processors will ever call or text to ask for their PIN or card number.

(C) Households should check their EBT account regularly for unauthorized charges.

(D) States must educate households on how to report unauthorized use of their EBT card or unauthorized use on their EBT account, including suspected fraudulent activity.

(1) If a household suspects that their account has been compromised by EBT theft, they should change their PIN, contact the State, and request a replacement card.

(E) States must inform households about all EBT theft prevention tools available to them. This includes options to freeze their account, block out-of-State or internet transactions, set up purchase and PIN change alerts, or set up transaction limits.

(F) States must educate households on the benefit of freezing and unfreezing their EBT card to prevent benefit theft, and inform them that benefits can still be loaded to an account that is frozen.

(G) States must inform households about any EBT theft prevention features that the State has enabled by default ( e.g., default block on out-of-State or internet transactions).

(H) States should educate households about transaction and return limits. This should include training on any limits the State puts in place by default and any options for the household to enable or disable for themselves.

(I) If a household's EBT card includes a chip, the household should always attempt to tap or insert their card and should only swipe their card if the retailer's POS device is not capable of conducting a chip transaction. Households should minimize their risk of EBT theft by choosing retailers that can process more secure payment methods.

(J) Household should inspect ATMs, POS terminals, and other card readers before using. Look for anything loose, crooked, damaged, or scratched. Do not use any card reader if you notice anything unusual.

(1) Pull at the edges of the keypad before entering your PIN. Then, cover the keypad as fully as possible when you enter your PIN to prevent cameras from recording your entry. Keep in mind that a pinhole camera may be present anywhere on or around the terminal.

(2) Households that access TANF benefits via ATM should use ATMs in a well-lit, indoor location whenever possible. These may still be compromised but are less vulnerable targets.

(3) Be especially alert for skimming devices in tourist areas, since these are popular targets.

(5) Household Training: Expiration Dates on EBT Cards

(i) As States implement chip card technology, they must add an expiration date to the new EBT cards. States must educate household on the difference between the expiration date on the card, timelines for benefit expungement, and certification or recertification end dates.

(ii) States must ensure that household training includes the following elements:

(A) The expiration date on the new EBT cards is a new feature, indicating when the card will need to be replaced.

(B) Card expiration date has no relation to benefit expungement.

(C) Card expiration date has no relation to certification or recertification end date.

(1) When a household receives an EBT chip card, this does not mean they do not have to certify or recertify for benefits upon receipt of the card.

(D) State agencies should work with their EBT host processor to update the card sleeve mailed with the EBT card. The new card sleeve should explain:

(1) The expiration date on the card and where it is located.

(2) The CVV/CSC digits on the card and where it is located.

(3) Any additional new items listed on the card.

Definitions

For the purposes of this appendix, the following additional terms and definitions apply.

Acquirer: A financial institution (or the agent of a financial institution) that facilitates the authorization of SNAP transactions by acquiring transaction-related data from SNAP-authorized retailers and transmitting that data to a Third-Party Processor for further routing. An acquirer may only need to contract with a single TPP, as the TPP would handle subsequent routing to gateways and EBT host processors.

Adjustment: A change to the balance of a household's SNAP benefit account, implemented by a SNAP State agency and/or by their contracted EBT host processor in response to an incorrect account balance caused by a system error during the redemption process. Adjustments may increase the balance of a SNAP account (“credit adjustment”) or decrease the balance of an account (“debit adjustment”).

Algorithmic Attacks: Attacks that use bots, artificial intelligence (AI), or similar automated electronic means to exploit internet and IVR vulnerabilities. For example, some criminals use algorithmic attacks to conduct a high number of rapid and repeated balance inquiries to steal key card information.

Application ID (AID): The application identifier (AID) encoded in the chip indicates to the POS device what type of card is being used. POS devices are also coded to accept specific AIDs. For a chip card transaction to be successful, the card and the device need matching AIDs, meaning that all POS devices must be updated with the new EBT chip AID in order to process EBT chip card transactions.

The AID is composed of two parts, the registered application provider identifier (RID) and the proprietary application identifier extension (PIX). EBT chip cards will include the unique AID ( printed page 66995) A0000000044542. The unique AID will allow POS terminals to support SNAP processing rules ( e.g., PIN entry required, fallback rules) via standard terminal action codes (TACs).

Application Programming Interface (API): A set of rules or protocols that enable software applications to communicate with each other to exchange data, features, and functionality.

Automated Clearinghouse (ACH): A financial network that is part of the Federal Reserve banking system and is used to process electronic funds transfers. Funds are credited to the receiving financial institution on the morning of the next business day after submission of the ACH file; the ACH does not operate on weekends or Federal holidays. The ACH network is used by the EBT processor to disburse credits for both food and cash programs from their own bank accounts to the various financial institutions holding the retailer and TPP bank accounts. The EBT processor/State may also request that funds be transferred between ASAP and their disbursement account through the ACH network. The EBT processor may hold its disbursement accounts at different banks for different States. Only financial institutions may submit ACH files to the FRM. Therefore, EBT processors must contract with a concentrator bank for this service. The concentrator bank may or may not be the same bank which holds the EBT processor's disbursement account.

Balance Inquiries: When a household checks the amount of benefits in its SNAP account. There are four types: In-person, via brick-and-mortar retailers; internet, via internet retailers; internet, via each State's cardholder portal/mobile app, and; Phone, via EBT host processors' IVR systems.

Brick-and-Mortar: In the context of SNAP retailers, this means a physical retailer (as opposed to an internet retailer).

Card Cloning: After key card information has been stolen through methods like skimming or phishing, criminals can use equipment to copy stolen card information onto blank magnetic stripe cards. Criminals then use cloned cards to steal SNAP benefits.

Card Issuer: Financial institution or agency (or their agent) that issues the card to the cardholder.

Card Skimming: A method of electronically stealing SNAP EBT benefits. Card skimming occurs when a criminal places a card reading device on a retailer's POS equipment. The reader collects key card information—such as the PAN and PIN—when a client swipes or inserts their card during a transaction. Criminals then use this card information to steal a household's benefits.

Card Verification Value (CVV)/Card Security Code (CSC): A three-digit number that is printed or stamped onto the back of all SNAP EBT cards, and is not electronically stored on the card, and is a method of mitigating the electronic theft of SNAP EBT benefits. Specifically, when a SNAP household is conducting an internet transaction, they are required to enter the CVV/CSC to complete their transaction, thereby confirming that they are in possession of the physical/actual SNAP card.

Cash Benefit/Cash Benefit Program: A Federal or State government benefit program that provides households with benefits on an EBT card in the form of cash. Unlike SNAP benefits, cash benefits can be used to purchase items other than SNAP eligible food. Examples of cash benefit programs include Temporary Assistance for Needy Families and Aid for the Aged, Blind, and Disabled.

CAV (Card Authentication Value): A security component used by card associations to authenticate the validity of cards during transactions. It is embedded in the magnetic stripe of the card.

Chip Cards: Payment cards that have a computer chip embedded in them. Such chips provide security features that are superior to payment cards which only utilize a magnetic stripe. A chip card can be insert-only or dual interface. A dual interface card can be inserted (a.k.a., “contact” payment) or “tapped” (a.k.a., contactless payment) at a POS device. The contactless payment technology in an EBT chip card utilizes Near Field Communication (NFC). NFC is a protocol that enables wireless communication over short distances (a few inches) between payment cards and POS devices. Chip cards that are capable of conducting NFC contactless transactions are generally considered more secure than chip cards which must be inserted into POS devices.

Clearing: Clearing is when retailers send information to the SNAP State agency or the EBT host processor to request payment. This can be done directly by the retailer or through their contracted TPP or acquirer.

Database Conversion: The movement of data from an old EBT system or platform to a new EBT system or platform, and implementation of a new administrative terminal system.

Electronic Benefit Theft: This occurs when criminals use electronic methods to steal a SNAP household's benefits.

EBT Transaction Message: EBT transaction messages are comprised of the electronic data needed to process a transaction as defined by the ANSI X9.58 specification. Transaction messages flow from the retailer's POS to a TPP, (possibly) to a Gateway, and finally to the EBT host processor.

EBT Transaction Response Code: A sequence of letters and numbers that indicate whether a transaction was approved or denied. EBT transaction response codes display on a retailer's POS device after an attempted EBT transaction.

Empty Candidate List (ECL) Fallback: Most retailers currently accept other NFC-enabled chip cards ( e.g., credit and debit cards issued by a bank or credit union), but do not yet support the new AID for SNAP EBT chip cards. In such cases, a SNAP household will try to use a SNAP chip card in the POS device, and the device will recognize that the card has a chip but will not recognize the SNAP AID. When this occurs, the POS device must allow the card to proceed with a magnetic stripe transaction. The technical name for this process is Empty Candidate List (ECL) fallback.

End-to-End Testing: A part of the UAT process, conducted by the SNAP State Agency, in conjunction with their EBT host processor and FNA, in order to ensure that system changes work as expected throughout every component of the EBT system.

Equal Treatment: FNA regulations at 7 CFR 274.7(f) and 278.2(b) require that SNAP-authorized retailers treat SNAP households equally to other customers. This is generally referred to as the equal treatment rule. In other words, retailers may generally not treat SNAP households differently (either positively or negatively), in any way.

Federal Acceptance Test: The implementation of new State EBT systems and updates/modifications to existing EBT systems requires thorough testing by States prior to implementation ( i.e., “go-live”). As part of this testing, each State must successfully pass a Federal Acceptance Test with FNA prior to implementation, in accordance with FNA policy.

Federal Reserve Bank (FRB): The central bank of the United States, responsible for implementing and adjusting monetary policy, overseeing the largest U.S. banks, and providing financial services to the U.S. government. In the context of SNAP, FRB operates the ACH, which is a crucial component in reimbursing SNAP-authorized retailers, EBT processors, and TPPs for redeemed SNAP benefits.

Gateway: An entity that routes EBT transactions from TPPs to an EBT host processor based on the BIN of the EBT card. A Gateway is a combination of hardware and software which allows transactions to be supported between and among network switches, TPPs, EBT processors, and/or retailers driving their own terminals.

Inactive Status: An EBT card that is not functional upon receipt. To be made functional, the household has to take additional steps. Most often, those steps involve interacting with the State's processor IVR, and inputting a password, PIN, etc.

Interactive Voice Response (IVR): An automated phone system—operated by a State's EBT processor or their contracted entity—that allows SNAP households to navigate a menu of options using their voice or by pressing numbers to access information, complete tasks ( e.g., change their PIN), or be routed to other phone numbers.

Issuer Identification Number: A 6-8 digit number that identifies the bank, financial institution, or other entity that issued a card.

Key-Entered Transaction: A transaction when the card number is manually entered into a POS device, as opposed to tapping, inserting, or swiping an EBT card. Typically, key-entered transactions occur when a POS device cannot read an EBT card.

Letter of Credit: The document by which an official of FNA authorizes a State agency to draw funds from the United States Treasury to reimburse SNAP-authorized retailers for SNAP benefits they redeem (through their TPPs, EBT processors, etc.).

Near Field Communication (NFC): Protocols that enable wireless communication over short distances (a few inches) between payment cards and POS devices, which allows the use of contactless payments (also called “tap-to-pay”). ( printed page 66996)

Packed Binary Data: PIN data must be encrypted and represented as packed binary data, ( i.e., eight binary bits shall be represented as 16 hexadecimal characters). The PIN must be formatted into a PIN block consistent with the most current version of standards at ANSI X9.8/ISO 9564-1 before encryption.

Payment Card Industry (PCI) Data Security Standards: Security standards that address the secure encryption and handling of sensitive data, such as card numbers and PINs while “at rest” ( i.e., being stored temporarily or permanently). Before a retailer can be authorized to accept debit or credit transactions, they must be certified as PCI-compliant by their acquiring institution.

Phishing Scams: Scams on text, email, phone, and social media to deceive households into providing key EBT card information.

Point-of-Sale Service Provider: A financial institution (or its agent) that provides retailers with the equipment and technology needed to process SNAP benefits.

Processing Code: A series of digits used to describe the effect of a transaction on the SNAP household's account and identify the accounts affected ( e.g., SNAP benefits, cash benefits, or regular cash).

Reconciliation: The process States must follow to account for all SNAP issuance and transaction activity, in accordance with 7 CFR 274.4(a). This is done to ensure accuracy and consistency, and to identify and rectify any discrepancies.

Refund/Return: In this context, a transaction where SNAP benefits are returned to a household's account. Most often (but not always), these are the result of an error at the POS device being corrected on-the-spot or the customer returning a purchased item to the store.

Service Code: A code encoded in EBT cards that communicates information to the POS terminal (including informing the POS terminal whether the card has a magnetic stripe or a chip).

Settlement: When a State or processor creates and transmits a payment to a retailer's bank for approved, cleared SNAP transactions.

Settlement Day: The day when a SNAP-authorized retailer gets reimbursed for an approved, cleared SNAP transaction.

Settlement Flow: The transfer of funds through different accounts held by different parties involved in processing SNAP transactions that ultimately reimburse a SNAP-authorized retailer for a SNAP transaction.

SNAP Online Purchasing: The Agricultural Act of 2014 directed FNA to implement a pilot to allow the use of SNAP benefits to purchase SNAP-eligible food from SNAP-authorized internet retailers. SNAP online shopping and payment processes must be secure, private, easy-to-use, and provide similar support to that found for SNAP transactions in a physical “brick-and-mortar” retail store.

SNAP-Authorized Internet Retailer (also referred to as “internet retailer”): A store that accepts SNAP benefits in exchange for SNAP-eligible foods on their website. A separate FNA authorization is required in order to participate in SNAP online purchasing.

SNAP Data: Any data generated as a result of a household's or retailers' participation in SNAP and application to participate in SNAP.

SNAP Household: The person(s) who apply and are approved to participate in SNAP, receive SNAP benefits, and use a SNAP EBT card to purchase SNAP-eligible food.

SNAP State Agency: The governmental agency that administers SNAP at the State and local level.

Split Tender Transaction: When a household chooses to pay for its purchase of SNAP-eligible food partly with SNAP benefits and partly through some other means (cash, credit card, etc.).

Statused: An EBT card is referred to as “statused” if it is not active ( e.g., it has been cancelled, de-activated, or reported as lost, stolen, or damaged).

Store-and-Forward: The process where a retailer electronically stores a SNAP EBT transaction with an encrypted PIN when an EBT system is not functioning or is otherwise inaccessible ( i.e., during a power outage, natural disaster, etc.). The retailer then forwards the transaction for processing later, when EBT system functionality has been restored.

System Error: An error resulting from a malfunction at any point in the SNAP benefit redemption process, such as an error made by a retailer's host computer or POS device, a TPP, the Gateway, or processor.

Third-Party Processors (TPPs): Financial institution that receives EBT transactions from SNAP-authorized retailers and acquirers and subsequently transmits those transactions to an EBT gateway for further routing or directly to an EBT host processor for transaction approval. SNAP State agencies and their contracted EBT host processors must allow retailers to use EBT services provided by TPPs and acquirers, and must provide interface specifications and certification standards, in order for the TPPs to participate in the EBT system per 7 CFR 274.3(d). The TPPs have contractual agreements to connect to all existing EBT processor systems, either directly or via gateways, in order to facilitate the approval/denial transactions anywhere SNAP is operated.

TPPs typically provide EBT services and POS equipment directly to larger retailers (such as those with many locations) who may utilize other non-EBT services that the TPPs offer. Smaller retailers who are unable to contract directly with a TPP instead may rely on an acquirer to provide EBT services and POS equipment.

Token: A digital representation of sensitive data (such as a PAN on an EBT card), most often created and linked to a specific device. Tokens replace sensitive data with unique, random strings of digits to protect against data breaches during transactions.

Token Service Provider (TSP): Entity that manages and issues payment tokens.

Transaction Message Response: Upon receipt of an EBT transaction message, the processor reviews the information contained in the message to ensure the transaction is valid. The processor will then generate a transaction message response to send back to the retailer's POS device, approving or denying the transaction and (if applicable) providing the denial reason and SNAP account balance information. The processor sends FNA the transaction data, per 7 CFR 274.4(b)(2) and the specifications as outlined in the State's contract.

User Acceptance Testing (UAT): Testing of new State EBT systems and updates/modifications to existing EBT systems performed by the State ( i.e., the system user).

Voucher Clear: The process where a POS transaction is completed by obtaining a voice authorization and manually processing a pre-numbered voucher that is later forwarded to the card issuer electronically.

Void: Void or cancellation transactions are used when an incorrect purchase amount is processed through a retailer's POS device. The void/cancellation must be done immediately after the purchase transaction and on the same POS device.

( printed page 66997)

91 FR 66958