EMV® UPDATE
October 2014
© 2014 Fiserv, Inc. or its affiliates. 2
Discussion Topics
Hear important information regarding Fiserv support for the transition to the EMV standard. Fiserv deployment plans and support initiatives will be announced to provide you with insight into our approach for addressing impending payment card changes.
• Market landscape overview• What actions should financial
institutions be taking• What is the Fiserv Solution• What is the time line to
transition your card and ATM program to EMV
© 2014 Fiserv, Inc. or its affiliates. 3
Improved security
Better experience
for international
travelers
Worldwide interoperabilit
y
Positioning the industry
for future forms of
payments and security (tokenizatio
n)
EMV Adoption in the U.S. Why It Makes Sense
© 2014 Fiserv, Inc. or its affiliates. 4
Liability Shift Dates
P.O.S. October 2015 October 2015
ATM October 2017
April 2013 Specific to cross border Maestro transactions where the issuer is
Non-U.S. at a U.S. ATM
October 2016All transactions on any
MasterCard network
Pay at Pump/Gas
October 2017 October 2017
© 2014 Fiserv, Inc. or its affiliates. 5
State of the Union2013 in Review
Debit Issuers Credit Issuers ATM Deployers Merchants
• “Wait and See approach”
• Progress dependent on legal outcomes around Reg II and PIN network engagement in EMV
• Visa reports 3.5M EMV cards issued in US as of 1Q13. 0.5% of all US issued cards.
• Large credit issuers have begun issuance mostly to business, commercial traveler segments (Bank of America, Citibank, JPMorgan Chase, US Bank)
• Some credit unions have begun issuance (Andrews FCU, United Nations FCU)
• Handful of US based ATMs accept EMV
• Most terminal owners deploying readers but not enabled through kernel software
• Windows 7 convergence driving some movement to “single dip” manufacturer costs
• Big box retailers are beginning EMV deployment
• Wal-Mart terminals EMV enabled but en masse lack the software kernel to process EMV transaction
• Best Buy and Home Depot announced plans to be EMV compliant
• Most smaller retailers taking a wait and see approach
• Impact of compromise and threats of future ones
© 2014 Fiserv, Inc. or its affiliates. 6
• Scale and depth of recent merchant compromises influencing the market view on EMV• Debit issuers desire a path forward to mitigate Card Present fraud• Merchants fear being “next”• EMV has entered the consumers conscience• Visa and MasterCard commitment to announced liability shift dates
• A regulatory compliant path for debit issuers• Accel™ Debit Payments Network from Fiserv
agrees to license the MasterCard and Visa offering UAID (Universal Application Identifier)
• EMV Migration Forum developed an EMV specification that future proofs regulatory requirements
EMV Landscape
© 2014 Fiserv, Inc. or its affiliates.
EMVAnswering the Top Compromise Questions
• Did the fact that the US was not EMV-enabled influence the breach?• Yes. Fraudsters will focus on the payment system of least resistance.
• Would EMV have prevented the data being compromised?• No. EMV would not have thwarted the fraudsters’ efforts. In these situations the data
compromised was card data housed on merchant systems.• Would EMV have mitigated the compromise impact?
• Yes. EMV would prevent the fraudsters from creating new plastic with the stolen information. The chip on an EMV card has certain information programmed to the chip that would make counterfeiting of that particular card very hard to do. Each EMV transaction creates data that is unique to that transaction. Replication is virtually impossible.
• Does EMV protect against all forms of fraud? • No. EMV cards do not protect/prevent Card Not Present (CNP) fraud.
• When will EMV prevent counterfeit fraud? • It is a journey. In reality EMV would need to be broadly deployed in the US across
cards issued, merchant devices and ATM machines to materially combat Card Present fraud.
7
© 2014 Fiserv, Inc. or its affiliates. 8
Consumers Are Drawn to the Enhanced Security of ChipFeatures and Benefits Offered by Chip Cards
Source: Harris Interactive, EMV Chip Card Research, June 2013, commissioned by MasterCard
© 2014 Fiserv, Inc. or its affiliates.
Fiserv, MasterCard reach EMV debit routing agreement March 12, 2014
MasterCard, Fiserv Partner on Debit EMV for Accel Network March 12, 2014
MasterCard, Fiserv Enter Pact on EMV Debit Routing March 12, 2014
MasterCard EMV debit cards to run over
Accel network March 12, 2014
9
Fiserv, MasterCard Agreement Advances Debit EMV Adoption in the U.S.
March 12, 2014
Fiserv to Advance Debit EMV Adoption in the U.S. through Visa’s Common Solution
March 17, 2014
How Fiserv's Long, Rigorous EMV Path Led It to
MasterCard March 13, 2014
Bowing to EMV’s Urgency, Accel Adopts MasterCard’s Common
Debit Solution March 12, 2014
© 2014 Fiserv, Inc. or its affiliates. 10
Fiserv in the News
© 2014 Fiserv, Inc. or its affiliates. 11
EMVAnswering the Top AID Questions
• What is an AID?• An identifier instantiated within terminal kernel software and personalization in the payment
application. A matching AID must exist between the card and terminal to enable an EMV transaction (e.g. Visa, MasterCard have defined AIDs distributed globally).
• Does the AID control routing? • No. Bin-level routing will continue in an EMV environment, preserving merchants’ right to least cost
route.• What is the UAID?
• It is a unique identifier that has been created specifically to represent debit in the US Market. It is not brand-specific. This identifier will enable all players in the payment landscape to utilize a single identifier to associate any debit network they issuer or accept. This identifier must be broadly deployed in all debit accepting devices and personalized on all debit card products for licensed networks.
• Why is the Accel announcement so significant? • Accel is the first debit payments network to license both the Visa and MasterCard UAID, offering its
merchant and issuer communities a path forward to transition to EMV. These agreements provide a regulatory compliant solution for all stakeholders in market.
• What if my unaffiliated network is not Accel? • Fiserv is not in a position to speak to what the other debit networks in the US markets plans are to
support the transition to EMV nor their status relative to licensing the Visa and MasterCard solutions.
© 2014 Fiserv, Inc. or its affiliates. 12
Recommendations for EMV Deployment
• Migrate card portfolios and ATMs to EMV enablement over timeTransitional approach
• Deploy EMV with the capabilities required for security benefits/compliance protection; extras can come later
Go with a compliant strategy
• Time to plan for action is nowPlan on a course of action
• International traveler segment Focus on cardholder expectations
• Focus on credit first.• Issue debit cards personalized with the UAID to
avoid reissuancePrioritize
• ATM upgrades as part of a larger initiative to upgrade ATM relative to end of life of Windows XP operating systems
Evaluate investments as part of a larger initiative
© 2014 Fiserv, Inc. or its affiliates. 13
What Can/Should You Be Doing
Understand your card personalizationoptions and associated expenses
• Contact vs. Dual Interface• Online vs. Offline• Chip Size (12k vs. 16k)
Address how you assign PAN numbers• EMV requires each cardholder to utilize
a unique PAN for application transaction counter (ATC) increment authentication
© 2014 Fiserv, Inc. or its affiliates. 14
What Can/Should You Be Doing
Review Your Card Designs
© 2014 Fiserv, Inc. or its affiliates. 15
What Can/Should You Be Doing
Analyze your portfolio -Identify international travelers that may likely want/need to be early adopters
Evaluate current reissuance cycles - Consider reducing the
duration to more closely align with liability shift dates
Budget, plan and educate - Create internal awareness and engage your partners
© 2014 Fiserv, Inc. or its affiliates. 16
EMV Return on Investment?
Expense Current State Future EMV State
Fraud Cost3BPs*
8BPs**
• An EMV chip card is only authenticated in a card present transaction. Chip cards do not offer security benefits for CNP transactions.
Program Implementation Cost
N/A
• One time fee from all vendor and partner engagements
• Visa and MC fees est. $1000 per BIN• Cardholder education, internal training
Per Card Cost <$1.00 • Est. $3.00 for contact, single application card
Incremental Transaction Authentication Fee
N/A • $.005 - $.009 per transaction
Device Upgrades• POS• ATM
N/A• $30-$300 depending on device type• $2000-$5000 (Fiserv solution requires ATMs utilize a
Windows 7 OS)
Instant Issuance Equipment Upgrade Cost
N/A• Varies per supplier• As high as $25,000 per branch location
*Fiserv Risk Office client best-in-class average** Federal Reserve Board published card fraud average
© 2014 Fiserv, Inc. or its affiliates. 17
EMV Deployment Timeline
2014Accel Network Announcements
2Q14-4Q14*UAID Proliferation
Multi-AID Deployment in Market
3Q14-4Q15 (and beyond)*FI and Merchant EMV Deployments
October 15Initial Network POS Liability Shift Commences
* Timelines estimates based on forecasted market readiness
© 2014 Fiserv, Inc. or its affiliates. 18
The Fiserv Solution
• Offer a streamlined, compliant, and cost effective path to EMV debit card issuance
• Align EMV solution with the front of card brand (Visa and MasterCard) while driving value and growth of Accel PIN and No PIN transactions
• Integrated and standardized card personalization with Fiserv Output Solutions
• Best Practice authorization processing to mitigate transaction risk
• A transitional approach to EMV card issuance
• Assist in internal and cardholder awareness and education
© 2014 Fiserv, Inc. or its affiliates. 19
Recommended Issuer Guidelines
EMV Options Visa MasterCard Fiserv Solution
Card Interface Issuer choice
Dual-interface or contact chip card with companion contactless mobile application
Issuer choice
Dual-interface recommended for best cardholder experience
Contact Only
Card Authentication
Online Online DDA/CDA if offline is supported (issuer choice)
Online Only
TransactionAuthorization
Online Online Offline if issuer opts to support
Online
Cardholder Verification
Issuer choice Signature, online PIN (debit), no CVM
Issuer choice Signature, online PIN, offline PIN, no CVM
Credit Card: Signature preferredDebit: Issuer Choice
Source Smart Card Alliance: Card Payments Roadmap in the United States: How Will EMV Impact the Future Payments Infrastructure? 1/23/2014
© 2014 Fiserv, Inc. or its affiliates.
ATM VendorATM Operating
SystemATM Application
Software
EMV Supported
MasterCard (MChip)
Visa (VSDC)
Universal Application Identifier (UAID)
American Express (AEIPS)
Discover/ Diners (DPAS)
Other(US
Regional Networks
Non UAID)
Diebold Windows 7 Agilis 3.0 Yes Yes TBD No No TBD
NCR Windows 7APTRA Edge 5.0
SMIYes Yes TBD No No TBD
NCR* Windows 7APTRA Advance
4.01No No No No No No
Nautilus Hyosung*
Windows 7 MoniPlus2s No No No No No No
Nautilus Hyosung (retail)*
Windows CENautilus Hyosung
Triton NativeNo No No No No No
Wincor-Nixdorf* Windows 7 ProCash Flex 3 No No No No No No
GRG* Windows 7 YDC 3.1.3 No No No No No No
Triton (retail)* Windows CE Triton Native No No No No No No
Fiserv SolutionATM EMV Enablement
EMV is not supported on ATMs using Windows XP or OS2 operating systems.* Dates for EMV enablement support to be determined for 2015 or 2016 delivery
20
© 2014 Fiserv, Inc. or its affiliates.
EMVAnswering the Top Fiserv Readiness Questions
• Are Fiserv EMV solutions ready?• Yes. Fiserv payment systems and personalization capabilities have been enhanced and
readied for EMV issuance and acceptance. However, general availability of a standardized solution requires pilot issuers and terminal owners to certify the standard solutions with Visa and MasterCard for all card program types and terminal deployments. These certifications are in process or need to commence.
• What is the timeline to implement EMV solutions?• As EMV deployments in the US Market are still in their infancy, early adopter
implementation timelines are expected to take at least 6 months.
• Can cards be issued and can terminals accept the UAID?• The proliferation in market of the UAID is still a work in progress. The business
agreements to accept this EMV solution took nearly 2 years to materialize. The specifications and standards that define the UAID implementation have been developed by the EMV Migration Forum but there is still work to do by all payment players including ATM and POS software vendors, card manufacturers etc. to enable the technology to support these defined standards.
• Can I submit projects to get in the queue? • Yes. Although pilot and certification activities are still in process, projects can be
submitted so that initial milestones both at Fiserv and at your bank can commence.
21
© 2014 Fiserv, Inc. or its affiliates. 22
Additional Resources and Next Steps
• Resources
• Fiserv EMV Website: www.fiserv.com/emv
• Contact your Fiserv Card Services or Fiserv Output Solution Account Executive
Thank you