Digital Payments Asia-Pacific Pte Ltd 7B Jalan Wangi, Singapore 340353 info@digitalpaymentsasiapacific.com

Digital Payments Training Curriculum Version 1.4, 18 May 2017

2

Digital Payments Asia-Pacific offers a series of training courses on different business and technical

aspects of digital payments. We understand that digital payments technology can be complex and its

concepts are difficult to understand. A good grounding on the basic underlying concepts is essential if

one’s business is to keep up with the ever evolving technology specifications

While training on specific topics might be available there are not many courses that help one

understand the concepts and the considerations from the inception of a digital payment strategy to its

eventual implementation. There considerations are not all technical a huge factor in a successful

program implementation is the changing of consumer payment behavior.

Our courses are designed to walk participant through from introductory digital payment technology

concepts through the industry specifications to putting a project plan for a successful program

implementation. The courses are developed by practitioners of these technologies where the best

practices and practical experiences are embedded into the course materials.

We currently offer training in three areas, which are EMV, EMV Contactless and Tokenization.

Our courses are delivered through two channels:

1. Classroom Training

The training can be conducted at a customer’s site following the curriculum outlined in the

appendix of this document. If there is a specific and immediate need, we can tailor the program

to address your requirements and training can be conducted on-site at your premises.

2. On-line Training

It is our experience that one needs frequent revision of the technology concepts. Therefore, we

will be developing the curriculum into a series of videos where one may view at one’s own pace,

and review the materials as often as is required in the course of one’s digital payments journey.

These videos are accessible via the internet through a paid subscription service.

3

Supporting you in your Digital Journey

We recognize that training alone is not sufficient to give one the confidence in implementing a digital

program. Perhaps certain concepts and industry or scheme rules need clarifying. Digital Payments

provide a 6 months support service together with the training program, where we will help answer

questions that you may have during your program implementation.

The support service can be bundled with your training program and you may choose to subscribe to it as

a separate service.

4

Credit Card – Foundation Courses

Course Name CC_1 : Credit Card Acquiring – Foundations and Considerations This one-day course provides an understanding of the fundamentals of the

credit card acquiring business for both card present transactions at point of sale (POS) terminals, and card not present for ecommerce. Attendees will gain an appreciation of the opportunities, risks, challenges, and global best practices by working through the business model, the components, the technology, operational requirements, and future directions for credit card acquiring. The knowledge would be useful for anyone involved in business planning and strategy, implementation and operations of a credit card acquiring business.

Audience This training is intended for both business and technical personnel who would like an introduction to the merchant acquiring aspects of the credit card business.

Course Modules:

Module CC1_1 Introduction and Overview Define the fundamentals that serve as the basis for the more detailed subsequent modules, including: the 4-party model; the role of the acquirer; card present versus card not present; components; definitions; roles and responsibilities

Module CC1_2 Acquiring Business Model Describe the business model in terms of acquirer revenues, costs and profits based on the 4-party model. Define the opportunities and the risks and explore some of the challenges.

Module CC1_3 Payment Technology – Card Present Describe the underlying technology for credit card payment – EMV, and explain how the EMV rails serve as the basis for future evolution at the point of sale.

Module CC1_4 Payment Technology – Card Not Present Describe the underlying technology for card not present acceptance and global best practices for achieving a better customer experience, and addressing the increased risks of fraud.

Module CC1_5 Operations Requirements Acquirer processes that are required to operate in the 4-party model including: merchant support services; back office processes; risk management; disputes and chargebacks; fallback processes.

Module CC1_6 Compliance and Risk Management Describe the various requirements for compliance on the acquiring business. Define the minimum risk management processes that an acquirer needs in place to safeguard the business.

Module CC1_7 End User Considerations Define some of the best practices and innovations for a card acceptance environment to satisfy usage requirements.

Module CC1_8 Future Directions, Challenges and Threats The evolution of payments in terms of the journey from where we are today –

5

contact EMV chip cards through to NFC contactless mobile with tokenization as substitutes for card payment credentials. This will include exploring disruptive threats to the 4-party model and alternative payment technologies.

Course Name CC_2: Credit Card Issuing – Foundations and Considerations This one-day course provides an understanding of the fundamentals of the

credit card issuing business for both card present transactions at point of sale (POS) terminals, and card not present for ecommerce. Attendees will gain an appreciation of the opportunities, risks, challenges, and global best practices by working through the business model, the components, the technology, operational requirements, and the exciting new platform offerings in credit card issuing. The knowledge would be useful for anyone involved in business planning and strategy, implementation and operations of a credit card issuing business.

Audience This training is intended for both business and technical personnel who would like an introduction to the business of issuing credit cards.

Course Modules:

Module CC2_1 Introduction and Overview Define the fundamentals that serve as the basis for the more detailed subsequent modules, including: the 4-party card payment model; the role of the issuer; card present versus card not present; components; definitions; roles and responsibilities

Module CC2_2 Issuing Business Model Describe the business model in terms of issuer revenues, costs and profits based on the 4-party payment model. Define the opportunities and the risks and explore some of the challenges.

Module CC2_3 Payment Technology – Card Present Describe the underlying technology for credit card payment – EMV and Contactless Payment, and explain how the EMV rails serve as the basis for future evolution at the point of sale.

Module CC2_4 Payment Technology – Card Not Present Describe the underlying technology for card not present acceptance and global best practices for achieving a better customer experience, and addressing the increased risks of fraud.

Module CC2_5 Operations Requirements Processes that are required for an issuer to operate in the 4-party model including: consumer support services; back office processes; risk management; disputes and chargebacks; fallback processes.

Module CC2_6 Compliance and Risk Management Describe the various requirements for compliance on the acquiring business. Define the minimum risk management processes that an acquirer needs in place to safeguard the business.

6

Module CC2_7 End User Considerations Define some of the best practices and innovations for a card issuing environment to satisfy usage requirements.

Module CC2_8 Future Directions, Challenges and Threats The evolution of payments in terms of the journey from where we are today – contact EMV chip cards through to NFC contactless mobile with tokenization as substitutes for card payment credentials. This will include exploring disruptive threats to the 4-party model and alternative payment technologies.

7

EMV Training

Course Name EMV_1 : An Introduction to EMV This module gives the background and the reasons for being of EMV. It further

describes the benefits that can be derived by implementing the EMV specifications and finally some of the new digital payments platforms that are delivered through channels that are built on the EMV foundation.

Audience This training is intended for both business and technical personnel who would like an introduction to EMV and its importance to the payments industry.

Course Modules:

Module EMV1_1 EMV : What is it and Why is it Important? Introduces EMV, EMVCo and the importance of payment industry specifications. A high level look at the EMV specifications and how it is implemented by different international payment schemes.

Module EMV1_2 The 7 Benefits of EMV A summary of the key benefits that can be derived by implementing the EMV specifications.

Module EMV1_3 New EMV-based Digital Payments Methods A look at some of the current and emerging digital payments technology that are built on the EMV Contact Chip foundations.

8

Course Name EMV_2 : The 7 Steps in EMV Processing This module gives a semi-technical description of the interaction between a

card and a terminal leading to the authorization or decline of a transaction. Audience This training is intended for anyone who would like a deeper understanding of

contact smart card processing. Technical information will be introduced only to the extent of assisting the participant make the required business decisions. There are other courses that describe the technical information in detail.

Course Modules:

Module EMV2_1 Introduction to EMV Transaction Processing This module previews the key interactions between the card and the terminal and the intended objectives in each processing step. Completing this module lays the groundwork for a more detailed discussion of what ensues within each step and the considerations in designing an EMV based payment product.

Module EMV2_2 Multiple Applications The smart card allows multiple payment applications to be provisioned. This module describes how EMV specifications facilitate this and how a common payment application is selected.

Module EMV2_3 Selecting Payment Attributes The EMV specifications allow an issuer to determine where a card may be used and what kinds of payment services may be performed. This module describes the key payment attributes that an issuer should consider and can set up.

Module EMV2_4 Verifying a card : Data Authentication – Online and Offline This module looks at the mechanisms specified by EMV that checks if a card is genuine. The specifications provide for this check to be performed online or offline.

Module EMV2_5 Authenticating a cardholder EMV specifications have a very extensive Cardholder Verification Methods (CVM) list with a verification priority order that an issuer can specify. This module provides a description of the CVM list and how an issuer may set up its own CVM list to suit its risk requirements.

Module EMV2_6 Limit Compromise Exposure This module describes the different types of keys used and through this mechanism the exposure, if any card is compromised, is limited to just one card.

Module EMV2_7 Transaction Authorization This module describes the use of a cryptogram to authenticate an on-line or offline transaction leading to its eventual completion.

Module EMV2_8 Changing Payment Attributes The EMV specifications provide for the parameters already provisioned in a card to be changed. For example, the issuer may wish for the card to be blocked. This module gives a description of this feature.

9

Course Name EMV_3 : The 7 Key Considerations in Setting Up a Card Profile The card personalization profile or commonly shortened to just “card profile”

determines what kinds of payment services may be transacted, the risk assessment to be performed and the preferred actions depending on the outcome of its checks. While there are many EMV data elements or tags, this training looks at the key ones that an issuer should consider. This training would begin to introduce and use the different EMV data elements or tags.

Audience This training is for technical staffs who work with their business teams in building the contact chip card profiles and anyone whose responsibility is chip technical support.

Course Modules:

Module EMV3_1 7 Key Considerations in Setting Up a Card Personalization Profile This module introduces the 7 key things that an issuer should consider when setting up the card profile.

Module EMV3_2 Where can the card be used and do they share the same characteristics This module looks at how a card can be set up so that its use can be restricted to just domestic transactions, or it has no geographic restrictions on its usage.

Module EMV3_3 What Payment Services can a card transact? An issuer may set up a card product to be used at different acceptance channels like POS or ATMs and this module describes the EMV tag settings to enable this.

Module EMV3_4 Will the card be offline preferring or online only? This module describes how a card can be set up so that a transaction can be authenticated and authorized offline or if the issuer prefers, only online transactions are allowed.

Module EMV3_5 Setting up Cardholder Verification Methods (CVM) Describes how an issuer may set up a CVM list for each payment product and the priority order in which the verification is performed.

Module EMV3_6 Scheme Mandates and Best Practices This module brings awareness that each international payment scheme may have its own requirements that are mandated, and these must be implemented on top of the issuer’s preferences. A review of some of the common best practices will be part of the discussion.

Module EMV3_7 Type of Cards to Buy This module provides guidance on how to verify if a card is approved for use by the schemes.

Module EMV3_8 Validating Your Personalized Cards After the card profile is designed and a batch of cards has been provisioned, the issuer should include a step in its project plan to validate the cards. This module describes how card personalization can be done.

10

Course Name EMV_4 : Types of Keys Used in EMV Processing EMV processing employs both symmetrical DES keys as well as asymmetrical

public keys in its processing. In this module, descriptions are given of how public keys are used and where the respective keys are used during EMV processing.

Audience This training is for technical staffs who work with their business teams in building the contact chip card profiles and anyone whose responsibility is chip technical support.

Course Modules:

Module EMV4_1 The 2 categories of keys used in EMV processing This module outlines the two types of keys and where they are used in EMV processing..

Module EMV4_2 Public Key Cryptography This module introduces public key cryptography as a concept and how they are employed in EMV processing. This module is meant for those who have no prior knowledge of public keys.

Module EMV4_3 Public Key Cryptography in EMV This module introduces public key cryptography and how they are employed in EMV processing. Operational considerations in the use of public keys will also be discussed.

Module EMV4_4 DES Keys – Issuer Master Key and ICC Master Key This module introduces DES keys and the key that is used to generate the online application cryptogram that is used for card authentication. A description of how the master key in each ICC is derived from the issuer master key is also given.

Module EMV4_5 Cryptograms – Different Types of Cryptograms and How are they generated A description will be given in this module of the various types of cryptograms and the parameters that are used as seed values to generate them.

Module EMV4_6 Setting up Cardholder Verification Methods (CVM) Describes how an issuer may set up a CVM list for each payment product and the priority order in which the verification is performed.

11

Course Name EMV_5 : Cardholder Verification Methods (CVM) EMV offers considerable cardholder verification methods and also the flexibility

in the circumstances where they apply. This course describes the range of CVMs and how an issuer can set up a hierarchy of CVMs to meet its risk requirements.

Audience This training is for technical staffs who work with their business teams in building the contact chip card profiles and anyone whose responsibility is chip technical support. It can be useful to the business and product teams who want a deeper understanding of the CVM mechanics.

Course Modules:

Module EMV5_1 Cardholder Verification Methods (CVM) in EMV This module describes how CVM is implemented in EMV with a detailed discussion on setting up a CVM hierarchy.

Module EMV5_2 Commonly Used CVM Lists Review of commonly used CVM lists in Asia-Pacific and the expected cardholder experience when a particular CVM is applied.

12

Course Name EMV_6 : EMV – Acquiring Considerations This course looks at the key considerations when implementing EMV from an

acquiring perspective. Audience This training is for technical staffs who work with their business teams in

determining the correct EMV terminal configuration. It is also useful to anyone whose responsibility is chip technical support.

Course Modules:

Module EMV6_1 Configuring an EMV terminal This module describes the steps that have to be taken leading to the configuration of a terminal.

Module EMV6_2 EMV type approval process and User Acceptance Testing A description of the EMV specification levels and the type approval testing that a terminal goes through before it is approved by EMV. A further discussion on the User Acceptance Tests that are mandated by the international payment schemes before the EMV terminals are deployed in the field.

13

Course Name EMV_7 : EMV – Additional Considerations This course looks at some of the other features and best practices that should

be put into considerations when implementing EMV. Audience This training is for technical staffs who work with their business teams in

determining the correct EMV terminal configuration. It is also useful to anyone whose responsibility is chip technical support.

Course Modules:

Module EMV7_1 Cardholder Verification Value (CVV) in EMV This module looks into the alternative CVV values that are provisioned in the chip and how they may be used as a mitigating mechanism against skimmed cards.

Module EMV7_2 Issuing Cards for use in the USA and Europe There are different levels of EMV adoption maturity around the world. Some markets have mandated additional requirements. This module looks at some of these and what an issuer should consider if they have a sizeable cardholder portfolio transact in the USA and Europe.

14

Course Name EMV_8 : Putting it All Together – Implementing an EMV Program With all the information from the other EMV courses, this series of modules

describe how to put a project plan together for a successful EMV program. Audience This training is for any business and technical staff who are involved in

managing an EMV implementation project. There will be business as well as technical considerations discussed but there will not be any in-depth technical or business discussions.

Course Modules:

Module EMV8_1 An EMV Issuer Project Plan This module reviews the steps involved in an EMV issuing project.

Module EMV8_2 An EMV Acquiring Project Plan This module reviews the steps involved in an EMV acquiring project

15

Contactless Training

Course Name CL_1 : EMV Contactless Processing This course gives an introduction to EMV Contactless payments. It is assumed

that the audience has already completed the EMV training (Modules EMV_1 through EMV_8) and have understanding of EMV and its specifications

Audience This training is intended for both business and technical personnel who would like an introduction to EMV Contactless.

Course Modules:

Module CL1_1 An Introduction to EMV Contactless transaction processing This module gives a high level description of the EMV Contactless

Module CL1_2 Multiple Application – Selecting a Common Payment Application This module looks how a payment application is selected for processing

Module CL1_3 Payment Attributes – Some differences from EMV Contact This module looks at the how the card and terminal negotiates the EMV Contactless features that are commonly supported by the card and the terminal

Module CL1_4 Verifying if the card is genuine – data authentication This module looks at the data authentication options and how some of them are applied in certain industries like transit.

Module CL1_5 Authenticating the Cardholder – Cardholder Verification Method (CVM) Cardholder verification as it is applied to contactless will be described in this module.

Module CL1_6 Completing the transaction This module reviews the transaction completion process

16

Course Name CL_2 : Key Considerations in Setting Up a Contactless Card Profile There are additional data elements to the EMV contact data tags to need to be

provisioned. This training course looks at the additional data elements. Audience This training is intended for technical personnel who needs to set up a

contactless card personalization profile.

Course Modules:

Module CL2_1 5 Key Considerations in Setting Up a Contactless Card Profile One does not need to review every single EMV tag to set up a card profile. However, there are 5 key areas that an issuer must pay attention to.

Module CL2_2 Payment Attributes and Geographic Restrictions Geographic restriction is one key consideration and this module reviews these considerations

Module CL1_3 What Services can a Card Transact While the terminal will let the card know what it is capable of, the card will also have its own set of parameters in negotiating with the reader. This module looks at how this is achieved.

Module CL1_4 Cardholder Verification – When is it required in a Contactless Transaction This module looks at how a card is set up with transactional limits to require a CVM whenever these thresholds are reached.

Module CL1_5 Scheme mandates Cardholder verification as it is applied to contactless will be described in this module.

Module CL1_6 Completing the transaction This module reviews the transaction completion process

17

Course Name CL_3 : Cardholder Verification in a Contactless Payment Transaction There are some differences in how CVMs are applied in a contactless payment

transaction. This training demonstrates the mechanics of setting up a CVM and the kinds of things one need to consider.

Audience This training is suitable for both business and technical personnel who needs an understanding to set up a contactless payment product.

Course Modules:

Module CL3_1 Cardholder Verification in a Contactless Payment Transaction. There are some differences in how CVMs are applied in a contactless payment transaction. This training demonstrates the mechanics of setting up a CVM and the kinds of things one need to consider.

18

Course Name CL_4 : Implementing a Contactless Payment Program This training reviews the high level tasks that form a contactless payment

project plan and some of the key activities that one needs to consider. Audience This training is suitable for both business and technical personnel who needs an

understanding to set up a contactless payment project plan. It is assumed that the audience has attended the other contactless training modules and has an understanding of contactless payment concepts. While a large part of plan are technical in nature, there will be discussions of non-technical activities.

Course Modules:

Module CL4_1 Implementing a Contactless Payment Issuing Project Plan This module reviews the key tasks and activities for implementing a contactless issuing project.

Module CL4_2 Implementing a Contactless Payment Acquiring Project Plan This module reviews the key tasks and activities for implementing a contactless acquiring project.

19

Tokenization Training

Course Name TK_1 : An Introduction to Tokenization This course provides an introduction to tokenization and some of its key

concepts. Audience This training is intended for both business and technical personnel who would

like an introduction to EMV Contactless.

Course Modules:

Module TK1_1 An Introduction To Tokenization This module gives the background behind tokenization and some of the key concepts and components that make up a tokenization service. New roles in the tokenization service such as the token service provider (TSP) will be discussed.

20

Course Name TK_2 : Tokenization in Payment Authorizations Tokenization applies only to designated use cases. This module reviews the

payment transaction use cases that are commonly used today; some of them expands or augments existing use cases and there are also new use cases.

Audience This training is intended for both business and technical personnel who would like to have an understanding of tokenization.

Course Modules:

Module TK1_1 Tokenization in Payment Authorizations This module provides a high level overview of how tokens are used in payment transactions. The variations to this will be discussed in specific payment transaction use cases. Additional modules will be added as new use cases are added by the industry.

Module TK1_2 Use Case 1 : Contactless Point of Sales (POS) payments This module provides a description of how tokens are used at an NFC POS terminal.

Module TK1_3 Use Case 2 : Mobile In-App Transaction Mobile Apps are becoming popular for a lot of things, and there are apps that have been created to work with mobile wallets as a method of payments. Some of these have disrupted current norms in cardholder payment experience.

21

Course Name TK_3 : Provisioning a Mobile Phone with Tokens The EMV tokenization framework introduces a process for provisioning tokens

into a mobile device. This course looks at the steps leading to the provisioning of a token.

Audience This training is intended for both business and technical personnel who would like to have an understanding of tokenization.

Course Modules:

Module TK2_1 The Identification and Verification Process Commonly referred to as ID&V; This is the process of verifying a cardholder before a token is generated and provisioned in the mobile device. There are typically 3 steps involved in this process. The mobile handset and “wearable” devices are the ubiquitous form factor for tokens and this module looks specifically at this form factor.

Module TK2_2 Step 1: Checking if a card account is eligible for tokens This module reviews one of the first step in the ID&V process where a card account is checked for its eligibility to participate in tokenization.

Module TK2_3 Step 2: Provisioning the token This module looks at the authentication and checks that occur before a token is generated and provisioned in the phone.

Module TK2_4 Step 3: Additional Cardholder Authentication There will be markets or instances where additional cardholder authentication is required by local regulations or due to existing industry practices. This module reviews the additional steps required to effect this.

22

Course Name TK_4 : Implementing a Tokenization Project This course looks at the key project activities in implementing a tokenization

project. Modules for common use cases will be available and additional modules added in the future when new use cases become common in Asia-Pacific.

Audience This training has a technical bias since tokenization is a relatively new technology.

Course Modules:

Module TK4_1 Implementing an Issuer Wallet This module looks at the high level activities in implementing an issuer mobile payment wallet.

Module TK4_2 Implementing an Third Party Wallet This module looks at the high level activities in implementing a third party mobile payment wallet such as Apple Pay, Android Pay or Samsung Pay.

Module TK4_2 Acquiring Project Considerations in Tokenization for Issuer and Third Party Wallets While acquirers are not expected to change their systems, this module looks at some activities that acquirers need to consider and when they would need to actively undertake technical work.