photo: iStock/hocus-focus

As of this date, there is one, just one, deadline for ATM liability shift in the United States. That shift pertains to Maestro, the multi-national debit card from MasterCard. In April of next year, liability for fraudulent Maestro transactions will be assigned to the transaction's acquirer.

Other than this specification, MasterCard has said it will follow the Visa road map details and deadlines in all respects in order to minimize confusion during EMV migration.

For its part, Visa has said that merchants who conduct 75 percent of their transactions via chip-enabled POS terminals by October 2012 will be exempt from certain PCI DSS requirements. As of April 1, 2013, Visa will require all U.S. acquirers and sub-processors to support chip transactions. Then on October 15, 2015, Visa will implement its Global POS Liability Shift Policy in the U.S., which will apply to all card issuers and merchant acquirers.

Singled out for exclusion

In an August 9, 2011 bulletin, Visa specifically stated, "Note: This liability shift policy change excludes counterfeit fraud at U.S. ATMs. Visa will continue to evaluate the potential for an expansion to include ATMs."

And as for Maestro transactions, said Jerry McCarley, executive vice president and CIO of USA Payments Systems, "[Maestro] represents one ten-thousandth of one percent of our transaction volume. No ISO is going to pay someone to make his ATM EMV-compatible for this. They will simply elect not to take [Maestro cards] … so until there is a mandate that really affects them, no ISO will be spending any money on this."

Proactive Preparation for Self-Service Convergence
The coming months and years will be a critical time for self-service updates. It is time to consider how you might streamline these changes via one upgrade strategy. Learn more about Diebold's Operation 411 and plan for the future.

So what does this mean? It means that ATM owners would seem to have absolutely no incentive — or responsibility — to invest in a costly upgrade to chip card acceptance. After all, the card companies have said they will maintain backward compatibility, continuing to employ the mag stripe on cards.

FI advantages to opting in

However, financial institutions may see some benefit in making the change to chip, since they currently bear considerable risk for card fraud — and, if they do their own acquiring, will continue to do so under the liability shift.

And their risk can only grow. The increasing adoption of the EMV standard in other markets (including U.S. neighbors to both the north and south) will make U.S. banks an increasingly attractive target for sophisticated and prolific skimming gangs.

Even if the bank were not its own acquirer, it would still have costs, both real and perceptual, said Shaun King, VP of international sales at Triton Systems LLC. "[T]here's 35 or 150 cardholders that you then have to correct their statements, you have to apologize, you have to reissue cards. All of that hassle — and the brand erosion ... "

And then there's the customer relations angle. As EMV makes inroads at retail, customers will come to expect their bank to offer the technology, too. Banks that don't will run the risk of creating the impression among customers that they're backward and behind the times.

ISO advantages to opting in

ISOs that offer outsourced ATM fleet management for FIs may have their own incentive to make the chip upgrade, with or without pressure from their client banks. "In that situation it's probably going to be an ISO who is routing transactions for the bank," said James Phillips, VP of sales and marketing at Triton. That would mean that the ISO, not the bank, would be the liable party in the case of fraud, he said.

The situation in Canada can be instructive for U.S. ISOs, said King. "Even if the ISO says, 'Look, I'm not going to put an EMV chip card reader on this location, it's just not worth it … if there's risk, I'll just absorb it.' Most of the [Canadian] processors today are saying, 'Forget it, because if we get hit for $90,000, you might not have pockets deep enough to pay for this, Mr. ISO. We're on the hook. So we're not going to take any of that liability or any of that risk. And we're just saying as of this date, if you're not chip, we're not going to process these types of transactions for you.'"

This decision could also come from higher up in the payments chain. "In some jurisdictions the networks have said, 'If you as an ISO are not compliant, we're not going to transact with you,'" King said. "Because Visa's going to say, 'We don't have a relationship with that end ISO in Nebraska. We have a relationship with whoever the processor is."

The big advantage: time

While nobody knows when Visa will finish evaluating "the potential for an expansion to include ATMs," almost everyone is sure that such an expansion eventually will take place, whether inspired by a liability shift or simply by the competitive nature of the market.

Operators who dread the expense of converting a whole ATM fleet to smart card acceptance have one silver lining: If they're willing to start the ball rolling now, they can spread out the work and the cost over at least three-and-a-half years.

For more on this topic, visit the EMV research center.