Nonprofit Technology & Operational Advice

Payment Card Industry (PCI) Compliance refers to a set of security standards for protecting cardholder data. Here are some basic Dos & Don’ts for any organization that is accepting (or considering accepting) credit card payments.

Don’ts

1) Don’t think PCI doesn’t apply to you - Most non-profits process fewer than 20,000 transactions per year and are thus considered Level 4 Merchants. Currently this means that certifying PCI-compliance is not mandatory, however they are still responsible for the security of cardholder data and still subject to fines if the data is breached.

2) Don’t ever keep account verification data – This includes the 3 or 4 digit CVV security code on the card, PIN #s or data stored on the magnetic stripe of the card.

3) Don’t collect or send credit data via email – Email provides very little security and should not be used to transmit credit card data. This means discouraging donors from providing their account numbers via email, but also eliminating any “online forms” that collect card data and then send it via email. If you can’t justify the fairly minor expense to offer a truly secure online donation form, just don’t offer the option to make a gift online.

Dos

1) Do store cardholder data securely – In order to process monthly pledge payments via credit card or ACH, the account data must be stored somewhere. If it is stored in a spreadsheet, Word document or database on your computer or servers, it must be encrypted and password protected. It’s far easier to use processing software that allows you to store account data at a Level 1 PCI-certified hosting facility. For instance we recently adapted all our software to store only a unique ID “token” that allows processing of future pledge payments without the need to store credit card data on our or our client’s computers.

2) Do promote security for online donations – If you’ve made the effort to ensure that your online processes are secure, promote this fact on your online donation pages using appropriate text and security icons. This will increase donor confidence when providing their information and thus increase donations.

3) Do review handling & storage of paper records – Securing cardholder data does not only apply to electronic records. Any donation forms, pledge cards, reports or other paper records that contain credit card numbers should be destroyed (or at least stored in locked files) once they have been processed.

The bottom line is that protecting your donors’ credit card data is critical — not just because of PCI, but also to ensure their trust in your organization is maintained. Following these Dos and Dont’s is a really good way to begin.

Seem obvious? It is — but yet it’s really easy to get tempted into investing lots of time and effort in pursuit of the latest “hot idea.” A good example is all the buzz around using social network sites like Facebook and Twitter. They do offer intriguing potential to communicate and develop stronger relationships with supporters. But how much have you seen or read about nonprofits really achieving significant success? More typical are articles like this reporting a small return on investment. My advice – let others blaze a trail and instead focus on techniques where others have already demonstrated significant success.

Here are three ideas that are far more likely to provide a good return on your investment of time and effort:

Monthly giving program – Building your base of recurring givers requires significant work but has been proven to improve donor retention by as much as 40%. This can increase the life-time value of a donor by several times.

Friend-raising – Sponsored events like walkathons and other -thons have long been successful ways to use supporters to help raise money. The advent of software tools that make it easy for donors to create a personal fundraising/supporter page and then use email to solicit support for your cause, has significantly increase the efficiency of such campaigns. A growing number of nonprofits are now extending these techniques and tools for virtual-events, board-member fundraising or work-place campaigns.

Email – Despite the challenges of SPAM blockers and keeping email addresses current, email is still the simplest, quickest and best way to keep your donors well informed. I strongly recommend using a tool like Constant Contact which allows you to create and send professional looking e-newsletters, e-invitations and other communications. Broadcast email systems like this also provide really helpful reporting on open rates, undeliverable/blocking and click-throughs.

Remember, successful fundraising doesn’t have to be cutting edge, it just has to work. Relying on techniques that have worked well for other organizations or for you in the past is one of the best ways to increase your chances of meeting your goals.

Like everyone in the non-profit community, I’ve been horrified by the Bernie Madoff scandal and its impact on so many non-profits and foundations. Most of what I’ve read has focused on the magnitude of the fraud, how it could go undiscovered for so long, and the impact of this massive loss of resources on the nonprofits affected.

There’s no doubt that the charities and foundations that lost money will suffer in some immediate and unfortunate ways, but I’m worried that non-profit boards and investment committees could take the wrong lessons from this scandal and make decisions that will impose additional financial hardship on their organizations.

To me the lessons from the scandal are really these:

Use common sense – If something seems to good to be true (e.g. an investment strategy that always yields positive results), it probably is. Certainly there are a few (very few) talented investors like Warren Buffet, who have outstanding investment records, but unlike Madoff, Buffett makes no secret of his investment strategy and has results that are easily analyzed and validated.

Don’t invest in what you don’t understand – There is simply no good reason for a non-profit to incur the costs, risk, and liquidity associated with hedge funds, private-equity and money managers with complex investment strategies. I doubt their ability to consistently produce superior returns, particularly after fees, and its unlikely that non-profit boards have the time or expertise to evaluate and oversee such investments.

Diversify – The fact that some of these nonprofits had all or most of their investments with a single money manager and investment strategy violates the first principal of sound investing. Depending on the amount of assets, investment committees should try to not have more than 5% of their assets in a single investment, unless it is a mutual fund that is already providing a diversified portfolio — in which case it may be appropriate to have as much as 25% in such a fund.

Understand Risk – It’s ironic that the appeal of investing with Madoff was the idea that the investment would provide consistent & attractive returns — making it “safe” from periodic losses. The real and under-appreciated risk was from the possibility that these results would not continue or as it turned out weren’t real — and the resulting lack of diversification and due diligence.

Don’t over-react – My fear is that in the wake of this scandal (and the significant decline in the stock market), non-profit boards & investment committees will decide to keep all or most of their funds in “ultra-safe” investments like treasury bills, money market or bond funds. These are low-yielding investments and although they may reduce the risk of direct loss of asset value, they virtually guarantee a slow but steady loss in the buying power of the nonprofits savings due to inflation. Just review any long-term inflation-adjusted graph of investment returns such as this one and note the negative “real” (after inflation) returns for Treasury Bonds, and T-Bills during the 60’s & 70’s.

My view is that unless your non-profit has a near-term plan to use the money that is invested for a particular project, your objective should be to take a long-term view toward preserving the assets while providing income and/or appreciation that exceeds inflation by a realistic amount (historically 3.5% is pretty realistic). This income/appreciation can then be used to fund operations or larger one-time projects or saved to provide additional financial stability in case of financial crisis.

Achieving this doesn’t require much time, expertise, or cost. It can be as simple as investing in four or five no-load mutual funds like those offered by Vanguard. I favor index funds and would recommend that at least one of them be Internationally oriented.

My intent is not to criticize the decisions of non-profit boards or investment committees, but simply to share my observations from many years of successful investing. Non-profit boards have a real challenge — striking the right balance between risk and return. It is just important that they consider that being too cautious has the potential to hurt the organization as much as being too aggressive.