Accepting cards online in Barbados

Hopscotch recently started accepting cards online. Accepting non-cash payments in Barbados is trickier than in larger countries, so I figured I’d tell you about my experience in case it might be useful.

Do you need to accept anything other than cash?

Barbados is still largely a cash-based society, and there are several businesses that don’t take payment in any other way. Hopscotch was cash-only for 8 months (more, if you count our pilot), and we did pretty well.

Still, we probably got one or two questions a day about when we would start accepting cards. Some people assumed they’d be able to pay for their order by card on delivery, and cancelled once they realized they couldn’t. It was obvious we were losing business, and that we had to do something about it.

What other non-cash payment methods are available?

Aside from cheques — because, you know, it’s not 1995 — the simplest way to accept non-cash payments from customers in Barbados is to get a portable card reader from your bank. If you’re running any kind of brick-and-mortar business, this is probably the way to go.

We decided not to do this partly because they carry a monthly fee of about $100-$150 per reader. We’d have to give one to each driver, so the costs would quickly add up.

Besides, in-person card payment would have made drop-offs less seamless. We wanted the driver to just hand the food to the customer and drive off, not force the customer to stick their card into a machine, enter a pin, then sign a piece of paper, possibly in the rain. Online payment also gives customers the option to have the driver leave the food with someone else if they’re unavailable (for example, with the receptionist at their office).

So for us, online payment was the way to go.

If you’re going to accept payment online, there are a few options.

1. Wire transfer

A very basic way to accept payment is to put your bank account number on your website and ask people to wire money to the account. There are a few obvious problems with this approach:

i) Many people in Barbados — especially older people — haven’t set up online banking;

ii) Nobody wants to navigate away from your site, log into their bank’s website, and initiate a transfer; and

iii) Wire transfers are expensive, unless the payer also holds an account at your bank in Barbados.

We never seriously considered this approach, but it isn’t ridiculous. If you can count on a large proportion of your customer base being local and internet savvy, and if you hold accounts at two or more banks in Barbados, it’s likely the simplest way to accept funds online.

2. PayPal (local bank account)

For people with a local bank account, the most popular turnkey solution seems to be PayPal. Our main concern was that PayPal holds your funds for 30 days or more at first, until they get more comfortable with you and your business. This was definitely too long for us. PayPal’s fees of 5.4% + $0.30 USD per transaction also seemed high.

3. Stripe (foreign bank account)

If you have a U.S. (or European) bank account or are willing to get one, accepting payments is relatively easy. You plug in a payment processor like Stripe or Braintree, and you’re good to go. These processors don’t work with Caribbean-based banks.

But sending your funds through a foreign bank account brings its own set of problems. A big one is that customers with local bank accounts would be paying with foreign currency for a transaction in Barbados. As of this year, the government has set a 2% tax on all foreign currency transactions, meaning that locals would end up paying a surcharge on every order. That seemed weird and unfair.

Opening a corporate U.S. bank account say, also involves some work, and carries U.S. tax obligations. This isn’t the end of the world, but it seemed like an additional administrative headache and expense that we didn’t want to deal with.

Finally, we would have needed to remit funds from the U.S. back to Barbados regularly, to disburse money to our partner restaurants. It seemed like that could end up getting pretty expensive and that such transfers might take a while.

4. Bitt

Bitt is a locally-founded company that has used blockchain technology to digitize the Barbadian dollar, cutting out the credit card companies altogether. This allows people to set up digital wallets and send payments to each other and to businesses through a mobile app. We’ve already signed up with them, and I hope they do well.

But at the time we were looking into accepting payments, Bitt’s online merchant solution wasn’t ready yet. (I don’t know if it is now.) But even if it were, we could only ever have treated Bitt as supplemental to card acceptance, not as an alternative. It just isn’t used widely enough yet in Barbados.

5. Integration with a Caribbean-friendly payment processing gateway

If you want to accept credit cards online in Barbados, with the funds deposited into a local bank account in a business day or two, there are no ready-made solutions that I’m aware of. You have to roll your own, by integrating with a so-called “payment processing gateway” that works with Caribbean-based banks. It’s the hardest and most expensive option, but we thought it might give us flexibility in the future. So we went with this.

There are at least three parts of this process worth discussing: a) Choosing a bank; b) Choosing a payment processing gateway; and c) Complying with the Payment Card Industry Data Security Standard (PCI DSS).

a) Choosing a bank

The paperwork that banks in Barbados require to set up an e-commerce facility differs, but there are two bits of information they all seem to ask for: your projected average transaction size, and your projected annual credit card volumes. The bank will plug these numbers into an internal model that spits out the commission rate they will charge on each transaction and the collateral amount they will require you to hold against chargebacks.

A chargeback is what happens when a customer contacts their bank or card issuer to challenge a charge on their statement — commonly, if they don’t think they made the purchase. After investigation, the issuer may refund them their money, and recoup the funds from the bank of the merchant who charged them. The merchant’s bank will then recoup the funds from the merchant. Banks require merchants to hold funds in reserve for this possibility.

A big part of choosing a bank for e-commerce processing is shopping around for the lowest commission and collateral requirement. The lowest commission you can expect seems to be about 2%, but only businesses doing huge volumes will get that. If you’re just starting out, yours may be a percentage point or two higher.

Banks typically set your collateral requirement as a percentage of your projected annual online sales. This means that any incentive you might have to inflate your forecasted sales to secure a low commission rate will be offset by the opposite incentive to reduce the projection to lower the collateral reserve.

The collateral requirement turned out to be the deciding factor for us. Banks quoted us between 5% and 20% of projected annual volumes, figures that seemed preposterous. If you think you’ll do $100,000 in online sales in the next 12 months, a relatively modest figure even for a small company, the bank might ask you to set aside $20,000 that you can’t touch. What small business has that kind of money lying around that they don’t need to run their operations?

Frustratingly, none of the bank employees I spoke to could explain why the figures were so high. The chances that one out of every five customers, or even one out of ten, will challenge their transaction seem very small. But even if identity theft is rampant in the Caribbean, no business will suffer a year’s worth of fraudulent transactions in one day. Banks could require collateral amounts pegged to projected monthly chargebacks, then increase the requirements over time if losses exceed their expectations.

Forcing businesses to instead set aside huge reserves against potential losses that could never occur in practice doesn’t demonstrate wise financial conservatism. It shows a disconnect from and an apathy towards the small companies trying to accelerate the growth of a digital economy in Barbados.

In any case, we got lucky. Possibly because of our existing relationship, our bank quoted us a much more sensible figure of $1000.

b) Choose a payment processing gateway

Having chosen a bank, you’ll need to pick a payment gateway. A gateway is the intermediary between the customer’s card issuer, the credit card networks like Visa and Mastercard, and your bank. Each local bank works with one or more payment gateways. Your software development team will need to write code to integrate with the gateway.

As far as I can tell, gateways seem to be fairly interchangeable in terms of the functionality they provide, at least for common use cases. We ended up going with Plug’n Pay for a few reasons. Several local banks work with Plug’n Pay, so if our bank were to say, leave the Caribbean — a possibility worth taking seriously — we wouldn’t have to integrate with a different gateway from scratch. I also found them to be very responsive and helpful. And their charges — between $0.10 and $0.15 USD per transaction — were competitive with those of other providers.

c) PCI DSS compliance

Once you opt to accept cards online, the credit card networks oblige you, through the Payment Card Industry Data Security Standard, to take certain measures to prevent theft and misuse of card data. The measures you have to take depend on the extent to which you handle credit card information.

One possibility is that you outsource all credit card handling to a PCI-compliant third party (that is, the payment gateway). This means that your system doesn’t process, store, or transmit any credit card data. Instead, when a customer is about to buy something, you send them to web page controlled by the gateway, which handles the transaction processing and redirects the customer back to your site. The gateway will let your site know whether or not the transaction succeeded. The following business day, the funds from successful transactions appear in your bank account.

Or, you can opt to process the credit card information yourself. There’s also a middle path, where the gateway handles and stores credit card data, but you control the payment page where customers enter it.

Unless you have nearly limitless resources, you will want to fully outsource credit card handling. Touching credit card data brings a laundry list of security requirements, as a glance at this 82-page document makes perfectly clear. Everything from maintaining a firewall to network testing and periodic penetration site testing land at your doorstep. You’ll probably want to leave this heavy lifting to the professionals. This is what Hopscotch has done.

Initially, as a naive young lad, I wanted to handle credit card information in-house. The main reason was that almost all the payment pages controlled by third parties that I had ever seen were hideous. I thought the only way to have a professional payment interface was to handle payments yourself, and I didn’t know about the onerous security implications.

But it turns out that gateway-controlled payment pages are ugly mainly because the sites using them don’t care enough to make them pretty. Gateways allow you to comprehensively style these pages to conform with your brand. I’d bet good money that most people who have used a credit card on Hopscotch haven’t noticed that the URL of the payment page points to someone else’s domain, and that they wouldn’t care if they did.

So that’s it, in a nutshell. Coding the integration with the gateway took our software development team 6 weeks, but it took us months before that to decide on a bank. This was mainly because it’s hell to get companies in Barbados to reply to your emails or return your calls, even when you’re trying to buy what they’re selling. Everyone is far too busy, you see.

I hope this short note gives you some idea of what online credit card acceptance entails, but I can’t promise it will spare you much of the hassle.