EMV migration is underway in the U.S., as card processors and associations begin the work of conforming their systems to EMV standards. But many IADs are still deciding whether it makes sense to get involved this early — and if not now, when?

To help them begin to put their choices into a clearer perspective, the ATM Industry Association last week sponsored a one-hour webinar to address EMV considerations at the industry level. (The full presentation is available at the ATMIA website under "conference presentations.")

EMV rationale

ATMIA CEO Mike Lee opened the session with a review of the card associations' three primary objectives of EMV migration:

• Global interoperability. "I'm sure many people in the audience have seen global maps that show how many countries have converted to EMV or are in the process of doing so," Lee said. "And on those global maps, the U.S. does look a little bit lonely." Lee said interoperability would be an important aspect in weighing migration to EMV.
• Reduction of fraud. Lee cited MasterCard statistics indicating a double-digit increase in inter-regional fraud at U.S. ATM terminals as the rest of the world changed over to more secure chip technology.
• Opportunity to innovate. The migration from static to dynamic data creates potential synergies between ATMs and the mobile channel, Lee said. "How the mobile channel can link into ATMs is obviously an important technological consideration — especially as the ATM evolves into the most critical of customer touchpoints."

On the IAD side, Lee said, the ATMIA would be working to develop EMV implementation tools to address specific needs for industry members:

• A survey conducted this month that will help gauge industry readiness for EMV and identify the main issues around EMV migration in the U.S. "It will help us get a feeling and idea of what the issues are in getting ready for EMV," Lee said. The survey will also help to shape two following projects:
• An ATM best practices guide to be published this October, incorporating information from EMVCo, as well as lessons learned from EMV migrations in Europe and Canada.

• An ATM operator roadmap to help IADs develop a capital investment plan to cover the costs of migration and investigate technology opportunities.

EMV risk mitigation

Lyle Elias, chairman of the International Payments Forum, took up the question of safeguards against the shift of liability from MasterCard to non-EMV compliant acquirers of Maestro card transactions, which will take effect in April of 2013.

ATMIA Canada Conference 2013: Sessions to Inform & Educate
Payment industry leaders will offer insights on how to succeed in today’s evolving landscape. Topics include best practices, fraud/security, future trends, new products, potential partnerships, and a regulatory update. Register today!

"And not just with Maestro, but also [eventually] with the other card products that are out there," Elias said. "So the idea was floated about whether this risk could be mitigated, particularly in the short term as companies and ATM operators develop their strategies to migrate toward EMV."

Elias focused on captive insurance — a formal self-funding mechanism on an industry-wide basis that would involve forming a company to pool risk and manage the fund. Elias outlined the pros and cons of such an arrangement.

pros:

• Pooling risk generally enables entities to reduce their overall premiums
• Self-funding allows entities to capture underwriting profits and invest incomes, so that the insurance becomes an investment, rather than an expense
• A pooled fund can encourage the establishment and enforcement of industry-wide risk management requirements.

cons:

• The owners' capital in a captive fund can be eroded by aggregated or catastrophic losses
• The fund would have to operate as its own company — with all costs and risk that entailed
• Group policies with multiple owners can be difficult to put together. "The cliché 'herding cats' comes to mind," Elias said.

EMV repercussions

Donna Embry, senior vice president of strategic development at Payment Alliance International, offered a deeper look at the impact of EMV installation on industry stakeholders.

"I did a survey of a few of the processors and asked them about what their concerns are with EMV … And what they basically came back with is that their development resources and time frames are dramatic," Embry said.

Processors must complete three levels of certification before the first EMV deadline falls this October:

• Certify card readers with EMVCo. This must be done with EMVCo. and specs can be unique to each ATM manufacturer and model. Manufacturer and processor must agree on standards and message formats before they can even begin to size up the development effort.
• Certify the application with EMVCo. The software that operates with the card reader must also be certified. Again, this can be a manufacturer-by-manufacturer, model-by-model process. The EMVCo. website maintains a list of specs by manufacturer, as well as a list of manufacturers that have certified and at what level.
• Certify payment applications with the card association. MasterCard provides processors with test cards and scripts to certify that they are network- and processor-capable of accepting EMV.

"When I questioned [manufacturers] about how would they compare this to the effort they faced with triple-DES or even ADA, they said this effort is larger than both combined," Embry said. "And their biggest concern is how do they recoup the cost of all of the development effort that they have to put in to make this work in the U.S."

Embry said IADs could expect processors and manufacturers both to pass their costs along to their customers. IADs can expect to pay anywhere from $250 to $1500 for card reader upgrades, plus $100 to $600 for the kernel software to run EMV on an ATM (plus installation labor for both). Ultimately, Embry said, an EMV upgrade would amount to about 10 percent of the cost of a new machine.

To determine whether there was a business case for adopting EMV, Embry said IADs need to develop their own EMV roadmap taking into consideration several points:

• What is their foreign traffic volume?
• What types of machines do they have in place, and where?
• What is the cost to upgrade that machine?
• What is the risk of not upgrading?
• Are there other revenue-driving opportunities (such as dynamic currency conversion) that could be implemented along with EMV to help mitigate upgrade costs?

To help with their assessment, IADs should leverage the experience of vendors and partners who have had prior experience with EMV conversions, Embry said. And should understand that it's okay not to be an early adopter. "If you make your decision with the facts and understand the market today, you'll know when to strike and when to take advantage of EMV and its capabilities."

For more on this topic, visit the EMV research center.

photo: Flickr/michael mol