Community
Financial Institution
EMV™ Readiness
EMV™ is a trademark owned by EMVCo LLC
© Copyright 2014 | First Data Corporation
© 2014 First Data Corporation. All Rights Reserved.
EMV™ Timeline
2011: EMV technology was
introduced with a U.S. push for
adoption
2013: In the U.S., processors like
First Data were required to
accept EMV-based payments
from merchants
2014: First Data reaches
agreements with Visa® &
MasterCard® to utilize US
Common AID
2015: Pending fraud liability shift
to POS devices (excluding
Automated Fuel Dispensers)
2017: Fraud liability shift for
Automated Fuel Dispensers
By 2015, the total costs of fraud in the U.S. will be an
estimated $10 billion per year. In an effort to reduce fraud
exposure and the likelihood of customers becoming victims,
First Data has adopted EMV technology to provide more
secure transactions.
Starting in October 2015, the liability shifts to the entity with
the lesser technology, so when a fraud occurs and an
organization did not have EMV capability, that organization is
liable for the fraud loss.
Although adopting EMV is not a U.S. Federal mandate, these
shifts should motivate clients to act.
First Data has done a lot of work on our clients’ behalf, but
they will still need to make a series of decisions regarding
their card programs.
© 2014 First Data Corporation. All Rights Reserved.
2
To get started, here is a quick introduction
to EMV technology
EMV is a micro-chip payment standard created by Europay, MasterCard and
Visa over 10 years ago as a way to improve security of credit and debit
card transactions and reduce fraud.
The liability shift to the entity with the lesser technology will begin
October 2015. If the card is EMV and the merchant is not, the liability
will shift to the merchant. If the merchant is EMV enabled and the card
is not, the liability will remain with the issuer. If both the card and
merchant are EMV enabled, the liability will remain with the issuer.
The U.S. is the last member of the top 20 world economies to commit
to a domestic or cross border liability shift associated with chip
payments. By the end of 2015, it is forecast that the U.S. will have
166 million EMV credit cards and 105 million EMV debit and
pre-paid cards in circulation.
© 2014 First Data Corporation. All Rights Reserved.
3
Current marketplace
• The U.S. is set to transition more than 1.2 billion payment cards and 8 million point-of-sale
(POS) terminals to meet the requirements for EMV smart card payments to be ubiquitous.
• Physical EMV hardware (cards and POS terminals) will cost issuers and merchants more
than $6.8 billion in the U.S.
• By the end of 2015, it is forecast that 166 million EMV credit cards will be in circulation in
the U.S. (29% of the total), and 105 million EMV debit and prepaid cards (17% of the total).
• More than half of U.S. retail locations are projected to be EMV-capable by the end of 2015.
• The long tail of EMV migration will be small and
micro businesses.
• The EMV transition will help fix an important
loophole in card fraud: counterfeiting;
however, based on experiences in other
markets, card fraud is expected to migrate to the point
of least resistance - the card-not-present environment.
© 2014 First Data Corporation. All Rights Reserved.
4
Readiness Plan & Worksheet
© 2014 First Data Corporation. All Rights Reserved.
5
EMV Client Considerations
The Basics
• Familiarize yourself with EMV options
• Involve your marketing team and educate internal
staff
• First Data will provide cryptography services unless
otherwise instructed by the Issuer
• Online PIN only is supported at this time
• Offline transactions will be supported utilizing First
Data defined offline limits; limits may not be
modified once card is issued. Choosing a profile
that supports offline transactions is optional.
EMV Budget Considerations
•
•
•
•
•
•
BIN Setup Fee
BIN Certification
Chip/Plastics Procurement
Card Personalization
Authorization Transaction Processing
Application Transaction Counter
Processing
• EMV implementation timelines estimated at 6 – 9
months following assignment of a project manager
• Contact your Client Business Consultant to request
an EMV Agreement
• Complete the EMV worksheet and submit to your
Client Business Consultant
© 2014 First Data Corporation. All Rights Reserved.
6
EMV Worksheet
Use this worksheet to document your EMV rollout plan. Upon working through this plan, you will have a
working list of vendors and details you need to get started executing your EMV card rollout.
Card Programs
Which First Data processed programs do you plan to issue (debit and/or credit)?
___________________________________________________________________________________
___________________________________________________________________________________
Card Personalization
Who will be producing your EMV cards?
___________________________________________________________________________________
___________________________________________________________________________________
Networks
What networks will you be utilizing (i.e. MasterCard®, VISA®, STAR®)? Consider timing of launch plans with
availability of other networks.
___________________________________________________________________________________
___________________________________________________________________________________
Chip Expiration
How far in the future will your chip expiration dates be? This will affect your plastic orders.
___________________________________________________________________________________
© 2014 First Data Corporation. All Rights Reserved.
7
EMV Worksheet
Chips
What type of chip will be embedded into your plastic (type, format, memory size)?
___________________________________________________________________________________
___________________________________________________________________________________
Contact
Dual Interface
Cardholder Verification Methods
Which cardholder verification methods will you support?
___________________________________________________________________________________
___________________________________________________________________________________
Operating Systems
Which operating system will you be including on your chips (i.e. Java, Native, Multos)?
___________________________________________________________________________________
___________________________________________________________________________________
Core Processing
Changes to your batch maintenance and ISO file will be required by EMV to conform to industry standards.
___________________________________________________________________________________
___________________________________________________________________________________
© 2014 First Data Corporation. All Rights Reserved.
8
EMV Plan Explanations
Card Personalization
Chips
Who will be producing your EMV cards (First Data, Third
Party Provider or Instant Issuance)?
What type of chip will be embedded into your plastic (type,
format, memory size)? There are a large number of chip
manufacturers producing EMV chips of different memory
sizes, types and formats. In order to determine which chip to
include in your card, you will need to make some decisions:
Networks
What networks will you be utilizing? These may include
VISA®, MasterCard®, STAR® or others.
Chip Expiration
How far in the future will your chip expiration dates be?
While the chip card will not cease to function once issued,
chips due expire. It is recommended to keep that in mind
when ordering chips.
Chip card plastic stock differs from what is in place today
for mag-stripe cards. The chips embedded into EMV
plastics have an expiration date. Once the chips reach
their expiration dates, the expired chips will still work on
existing cards but new cards cannot be issued with an
expired chip. Therefore, in order to prevent having to
destroy plastic stock with expired chips, it is
recommended that you order only enough cards for a 1218 month supply. Card expiration dates are typically 3 to 4
years in the future.
• Will your EMV card operate by contact or dual
interface? Contact cards are inserted into the EMV reader.
Contactless capability allows the terminal to communicate
with the card using near field radio frequency by waving the
card near or tapping the card to the terminal. Some cards
have both contact and contactless technology built into
them. Dual personalization cards – those with both
contact only & contactless capabilities are still undefined in
the Industry. Currently, there is no published certified
specification for contactless support for the US Debit AID.
 FD supports 4, 12, 16 K
 The larger chips are for dual interface and are more
expensive
• How much memory do you need? The memory size of
the chip will be determined by the number of applications
and AIDs to be stored on the chip along with the
functionality.
© 2014 First Data Corporation. All Rights Reserved.
9
EMV Implementation Explained
Cardholder Verification Methods (CVM)
Core Processing
Cardholder verification methods (CVM) allow issuers to
prioritize which verification method they will support,
along with their order of preference. The terminal will also
have a CVM preference, but the card will determine
which methods are available for the transaction. The card
and terminal must have at least one matching CVM in
order for the transaction to proceed.
You will need to determine which cardholder verification
methods you will support: online pin, signature, or no
CVM. A selection should be made based on the profile
that fits your needs. FD has standard profiles to aid with a
quicker to market set up.
Online PIN – the encrypted PIN is verified online by the
issuer
Signature verification – compares the cardholder
signature to the signature on the card
No CVM – usually includes terminals used by low dollar,
quick serve, swipe and go merchants
If First Data is performing cryptography there are minimal changes
to the Core Processor.
Most U.S. credit and debit cards will support online,
signature and no CVM, with offline PIN remaining “offline”
to debit issuers. Issuers will need to determine their order
of preference for the CVM used on transactions.
Operating Systems
The most common operating systems are: Java, Native and Multos.
Java and Multos operating systems are both based on industry
standards, while Native systems are unique to the chip manufacturer
and are not necessarily dependent on industry standards. Pros and
cons should be weighed against availability and costs associated
with each operating system.
Cryptography
Cryptography authenticates information by using mathematics to
transform it (encrypt it) into an unreadable format. Cryptography is
used in EMV to authenticate the chip, and thus the card, which is
being presented. Though the issuer, the processor, or an Association
(Visa/MasterCard for example) can perform the cryptography needed
in an EMV transaction, most are electing to have First Data complete
this work. First Data has completed all of the work to perform
cryptography on every chip transaction. This will alleviate the
additional development time and expense on your organization from
having to receive additional information on every transaction
to perform cryptography.
© 2014 First Data Corporation. All Rights Reserved.
10