1. Define PCI Scope and Ownership Across Systems and Vendors

PCI compliance for your insurance agency starts with clearly defining scope and ownership. Finance teams must understand every system, workflow, and vendor involved in accepting, processing, refunding, or adjusting card payments, especially when payment activity extends beyond internal systems.

Finance leaders should inventory every touchpoint where card data could appear, including:

• Customer-facing payment portals and hosted checkout experiences.
• Embedded payment links used in emails, invoices, or AMS workflows.
• Internal systems that process, reconcile, refund, or adjust transactions.
• Reprocessed or corrected payments handled outside the original workflow.
• Third-party vendors involved in payment acceptance, processing, tokenization, refunds, chargebacks, or reporting.

Just as important as defining ownership, PCI compliance in insurance depends on documented internal accountability and clearly outlined third-party vendor compliance responsibilities. While technical controls may live with IT teams or vendors, finance remains responsible for oversight.

Finance leaders should document:

• Who owns PCI oversight internally, including validation of scope, controls, and ongoing compliance.
• Which vendors are responsible for PCI controls related to payment acceptance, processing, and tokenization.
• How PCI evidence is collected, reviewed, and stored for audits.
• Where escalation occurs when compliance questions or control gaps arise.

2. Verify How Card Data Is Handled and Stored

Understanding how card data is handled is essential for limiting compliance burden.

Key areas to review include:

• Where card data is captured.
• Whether tokenization occurs immediately.
• Whether any system stores raw card data.
• How long payment data is retained.
• How data is removed or invalidated.

Platforms that rely on tokenization and limit data exposure help finance teams reduce audit scope while maintaining reporting visibility. Less exposure means fewer controls to manage and fewer questions to answer later.

Finance teams should confirm these controls are applied consistently across collections, refunds, and payment adjustments, not only initial transactions.

Look for platforms such as AndDone that tokenize payment data at capture and avoid storing raw card information to reduce audit scope and limit risk.

3. Restrict and Review Access to Payment

Access control is both compliance and financial security.

Finance teams should regularly review:

• Who can view payment details.
• Who can initiate refunds or adjustments.
• Who can export transaction data.
• How role changes are logged and approved.

Role-based permissions and access logs protect against internal risk and support clean audit trails in platforms like the AndDone Portal.

4. Validate Daily Reconciliation and Audit Trails

Reconciliation is where compliance becomes operational.

Strong payment workflows support:

• Transaction-level detail.
• Time-stamped audit logs.
• Clear linkage between payments, refunds, and accounting entries.
• Visibility into paid, pending, failed, and reversed transactions.

Manual reconciliation increases compliance risk. Finance teams benefit from systems that support daily reconciliation.

When payment records are tied to policies and customers with time-stamped logs, reconciliation becomes faster and more accurate. 

5. Make Exceptions Easy to See and Prove

Refunds, chargebacks, and adjustments are part of every payment operation. But when they aren’t documented or visible, they become compliance risks.

Finance teams should ensure:

• All exceptions are tracked with complete transaction history.
• Refunds follow standardized and documented workflows.
• Chargebacks remain visible in reporting.
• Exceptions do not bypass approval or logging controls.

Auditors focus on the moments when processes break. That’s why visibility matters.

Exception workflows should stay connected to the original transaction and remain visible to the full team. This makes it easier to demonstrate control, even when workflows don’t follow the standard path.

6. Confirm Third-Party and Vendor PCI Compliance

Third-party vendors are part of your compliance footprint. As industry coverage regularly highlights, payment complexity in insurance often increases when responsibility for data handling and reporting is spread across multiple platforms and partners. Finance leaders should verify each vendor’s PCI status and document third-party service provider responsibilities across data handling, reporting, and audit support.

Key areas to confirm include:

• Each vendor’s current PCI certification and scope.
• Which party captures, processes, tokenizes, or stores card data.
• How vendors support audits, including access to evidence and documentation.
• Where responsibility shifts between internal teams and external partners.

When vendors manage payment data correctly, finance teams stay in control without taking on extra compliance work. The right platform provides visibility, reporting, and audit support without adding PCI scope to your internal systems. 

The right partner keeps finance in control without adding technical PCI risk. In this short video, Chase Courtney from AndDone shares how their team helps reduce audit complexity by managing tokenization, routing, and reconciliation in one system.

7. Maintain PCI Evidence and Audit Readiness

Audit readiness depends on evidence that reflects how your business actually operates.

Finance teams should centralize:

• PCI policies and procedures.
• Access logs and activity records.
• Transaction and reconciliation reports.
• Vendor compliance documentation.

Evidence should remain current and aligned with live workflows, because faulty or outdated records can directly lead to compliance problems and audit obstacles. When documentation matches real operating conditions, audits move faster. 

8. Schedule Ongoing PCI Reviews for the Year

PCI compliance in your insurance agency must remain current as systems, vendors, and workflows change.

Finance leaders should:

• Align PCI reviews with monthly close cycles.
• Reassess PCI scope whenever payment systems, vendors, or workflows change.
• Review vendor compliance on a regular cadence.
• Update documentation proactively as processes evolve.

Routine reviews prevent compliance drift and reduce last-minute remediation. Keeping PCI oversight tied to financial operations supports consistent audit readiness throughout the year.

The post The CFO’s Compliance Checklist: Key Insurance Requirements and Where PCI Fits appeared first on AndDone.

What Is Insurance Payment Processing?

Insurance payment processing includes the systems used to collect, route, track, and reconcile premium payments. It goes beyond simply accepting a payment. It covers everything from how funds are submitted to how they’re matched and confirmed.

A complete payment process answers several essential questions:

• How does the customer submit payment?
• Where do funds go after submission?
• How is the payment matched to the correct policy?
• When do teams receive confirmation?

Insurance payment processing includes:

• Payment methods, such as ACH and credit cards.
• Fund movement through banking or card networks.
• Payment matching tied to the correct customer and policy.
• Payment status visibility, including paid, pending, or failed.
• Accurate records for service, finance, and reporting.

Because insurance payments often involve binding deadlines, installments, and premium financing, this process carries more complexity than standard ecommerce transactions.

Why Insurance Payment Processing Matters for Service Teams and Owners

Payment processing affects every team in an insurance operation. Friction usually appears first in service interactions, then creates cash flow gaps and operational strain across the business.

Impact on Service Teams

Clear payment processes shape the daily workload for service teams.

When payment handling works well:

• Fewer steps make it easier to send payment links quickly.
• Clear confirmation reduces customer back and forth.
• Visible payment status prevents unnecessary follow ups.
• Faster payments help policies move forward without last minute pressure.

When payment status remains unclear, service teams spend time tracking, checking, and explaining instead of supporting customers.

Impact on Owners and Leadership

For business owners, payment processing influences both stability and reputation.

Reliable payment operations support:

• Better visibility into cash flow.
• Lower operational strain on staff.
• Consistent customer experiences that reflect professionalism.
• Modern payment options that meet customer expectations without disrupting familiar processes.

Delayed payments reduce visibility into cash flow, manual steps increase strain on staff, and inconsistent experiences can erode trust over time. As insurance operations become more data-driven and interconnected, operational efficiency plays a growing role in sustaining performance across billing, servicing, and financial oversight.

How Insurance Payment Processing Works

While specific tools may vary, insurance payment processing follows a predictable flow. Understanding each step helps teams identify where delays and confusion often begin.

Payment processing often operates behind the scenes, but it serves as the connective layer between payment collection, premium finance, and accounting. This foundational layer helps manage fund availability and ensures money moves in a way that supports both current operations and future growth.

What Slows Insurance Payments Down

Even small gaps in the payment process can create friction. These issues often appear repeatedly across service and finance teams.

Why do payments get delayed or returned?

Payment delays often stem from incorrect customer information, bank verification holds, or manual review that slows settlement. ACH returns from incorrect account details are one of the most common issues across the industry and frequently require additional follow up before funds can be posted correctly.

What happens when systems do not connect?

When systems don’t connect, teams face duplicate work and inconsistent updates. Disconnected tools lead to duplicate data entry, missed updates between service and finance, and unclear ownership of follow ups. Approaches that balance automation with human oversight help reduce these gaps by keeping processes aligned and communication clear.

Why do customers struggle to complete payments?

Customer friction often comes from unclear or complex steps. Too many screens, confusing instructions, and the lack of immediate confirmation can cause customers to assume something went wrong. This uncertainty increases inbound calls and slows payment completion.

How Modern Payment Platforms Support Insurance Payment Processing

Modern payment platforms designed for insurance focus on supporting existing processes while reducing manual effort.

With the right platform in place, teams can:

• Centralize payment collection.
• View payment status without switching tools.
• Reduce manual follow-ups tied to unclear or delayed payments.
• Provide service teams with intuitive tools.
• Give owners clearer visibility into payment activity.

Coverage from Digital Insurance highlights how insurance specific technology supports modernization without disrupting established operations.

Why Insurance Payment Processing Is Worth Getting Right

Insurance payment processing shapes service speed, staff workload, and customer confidence, and broader industry shifts toward technology that streamlines core operations reinforce why clarity and efficiency in payment workflows matter.

When payments move clearly and predictably:

• Teams stay focused on customer needs.
• Leadership gains stronger insight into cash flow.
• Customers feel supported throughout the process.

The right setup supports familiar processes while reducing friction across the business.

The post What is Insurance Payment Processing and Why Does it Matter? appeared first on AndDone.

• Release date: 2026-02-10
• Release status: Deployed to UAT
• Version: AN_EVTSPU_V2

Highlights

• Design changes to support bulk processing of events (AN-42017, AN-42018, AN-42019) – Data source changes; bulk settlement event publishing via event-bridge scheduler; schedule creation on incoming events.
• Processing Enhancements for downstream processing (AN-42020 et al.) – Transaction entity, event log, and status handler enhancements for Bulk OnSuccess events; Payment Link status handler updates.
• Dead Letter Queue implementation (AN-44108) – Retry mechanism for failed settlement event processing.

References

• AN-42017
• AN-42018
• AN-42019
• AN-42020
• AN-42545
• AN-42546
• AN-42547
• AN-44108

The post UAT Release Notes – Event Based Settlement Processing Upgrade (AN_EVTSPU_V2) appeared first on AndDone.

What’s New

A new System Notification management interface is now available in the admin portal. Admins can create, schedule, preview, edit, and cancel maintenance notifications through a guided wizard. Each notification supports a rich-text body, a defined maintenance window with start and end times, and two configurable lead-time alerts that trigger automated emails ahead of the maintenance event. Notifications have a lifecycle status (Pending or Active) that controls which actions are available.

Why it Matters

You can now communicate planned downtime to merchants at scale without manual intervention. Scheduling is handled by an automated job that fires emails at the configured lead times, reducing the risk of missed or delayed notifications during maintenance windows.

Adds Dedicated System Maintenance Notification Tab to the Merchant Portal

What’s New

The merchant portal’s notification section now includes a new “System” tab. This tab surfaces all maintenance notifications sent by the platform in a single, dedicated view. Each notification arrives as a formatted email containing the subject, body, maintenance timing, and all relevant details.

Why it Matters

Merchants now have a consistent, predictable place to review maintenance communications. Previously, platform-wide maintenance alerts had no dedicated display location in the portal; they now appear in a structured inbox-style view alongside the formatted email that was delivered to them.

Fixes Saved-Login Autofill Appearing on the Wrong Field in the Merchant Portal

What’s New

The browser’s saved-login suggestion popup was incorrectly appearing on the Password field rather than the Username field on the merchant portal login screen. This has been corrected so that the popup triggers on the Username field as expected. Selecting a saved username now also auto-fills the corresponding password.

Why it Matters

Before this fix, the autofill prompt appeared in the wrong place, causing confusion and potentially interrupting the login flow. Users relying on saved credentials can now select their username and have both fields populated automatically without extra steps.

Fixes Card Payment UI Overflow on Android Devices

What’s New

On certain Android devices, the card payment section within the embedded payment widget was rendering outside the widget’s boundaries on the Contact Information page. The layout has been corrected so the card payment UI is fully contained within the widget frame across all screen sizes.

Why it Matters

Merchants and their customers using Android devices will no longer encounter a broken or clipped payment UI. The widget now renders correctly regardless of screen size or device, ensuring a consistent checkout experience.

Enforces ACH Banking and Account Type Classification UI When Feature Flag is Enabled

What’s New

When the ACH classification enforcement feature flag is turned on for a merchant, the UI for selecting banking type (e.g., Business) and account type (e.g., Checking) was not rendering correctly. This has been resolved so the classification fields display and function as intended whenever the flag is active.

Why it Matters

Integrations that rely on ACH classification — particularly those requiring merchants to specify their banking and account type — can now correctly present the required fields to end users. This unblocks compliant ACH collection flows that depend on this classification step being visible and interactive.

UAT Release Notes – Support New Notification Type (AN_NOTTYP_V1)Release Date: UAT Jan 23, 2026Release Status: Deployed to UAT

New Platform Notification Type: Maintenance on admin portal [AN-34779]

A comprehensive system maintenance notification platform enabling admins to schedule and manage downtime communications to merchants at scale.

• New “System notification” submenu with listing table featuring pagination, search, and bulk actions (create, edit, cancel, preview)
• “New notification” wizard for maintenance events with title, rich-text body, maintenance window (start/end), and dual lead-time scheduling
• Real-time email preview with populated date placeholders
• Automated scheduler job orchestration with status tracking
• Cancel capability for Pending schedules (disabled for Active)
• Inline preview from listing view

Client Facing: Yes

New Platform Notification Type: Maintenance on merchant portal [AN-34780]

Adds a new “System” tab in the merchant portal’s notification section.

• Displays all System Maintenance notifications in one dedicated location
• Sends formatted email notifications to merchants about platform maintenance
• Includes proper email template with subject, body, timing, and necessary fields
• Provides maintenance details directly to merchant inboxes

Client Facing: Yes

[Merchant portal] Saved merchant login option getting displayed on password field [AN-43347]

Issue Description:The “saved username and password” suggestion popup was appearing on the Password field instead of the Username field.

Expected behavior/fix:The saved-login popup should appear when the user clicks on the Username field. When a saved username is selected, both username and password should be auto-filled.

Client Facing: Yes

Card payment method UI overflows outside payment widget frame on Android [AN-39045]

Issue Description:When using the payment widget on certain Android devices, the Card Payment section on the Contact Information page is not fully contained within the widget frame. The card payment UI overflows beyond the widget boundary, causing layout breakage.

Expected behavior/fix:Card payment method UI remains fully within the widget frame, responsive across all screen sizes.

Client Facing: Yes

ACH – classification: 2 new type → banking and account type: Expected UI is not getting displayed [AN-44026]

Issue Description:When the ach-classification-enforcement feature flag is turned ON for a merchant, the expected UI for selecting “banking” and account types (e.g., Business & Checking) does not display correctly.

Expected behavior/fix:The new classification UI should be visible and fully functional, allowing selection of the appropriate banking and account type values.

Client Facing: Yes

The post UAT Release Notes – Support New Notification Type (AN_NOTTYP_V1) appeared first on AndDone.