Article

Considerations for EMV migration at the ATM

The process of moving to EMV technology can seem overwhelming, but thorough planning, communication and coordination can help make the transition a success.

October 9, 2014

by Randy Vanderhoof, director, EMV Migration Forum

The U.S. is two years into its migration to EMV chip technology. More than 80 countries are already using the more secure form of payment, and other markets' experiences have proven that it significantly reduces counterfeit card fraud.

As an ATM owner, you have many things to consider when planning for your migration to EMV. For example, liability shifts have been established by MasterCard (October 2016) and Visa (October 2017) to encourage the adoption of EMV. Some debit networks, too, have implemented liability shift dates; ask the networks supported about their policies. Though they are not mandates, the shifts are intended to assign liability for counterfeit card fraud to the party in the transaction that is using the less secure magnetic stripe technology.

It's important to understand that aligning your migration to these shifts will help to prevent liability for counterfeit transactions. If you haven't already begun the migration to EMV, you should begin as soon as possible. Though the process can seem overwhelming, thorough planning, communication and coordination can help make the transition a success.

One way to simplify this difficult process is to learn from other migrations. EMV has been implemented in many regions around the world, and as a result, some common themes have emerged. Although the EMV specification, global payment network specifications and similar documents provide the framework for an EMV implementation, there are also best practices that are not covered in those documents.

Consider these suggestions and recommendations based on experiences with EMV migrations around the world:

• work closely with your payment network representatives and make sure you understand the requirements of the individual payment networks;
• work closely with vendors, and solicit their input and recommendations. Be aware of each vendor's plans and roadmaps, upgrades, recertifications and other updates;
• if working with a processor, be aware of their EMV-readiness. This includes both testing and certification of the processor's platform and end-to-end testing to ensure compatibility between the processor and each make and model of ATM;
• allow extra time for all tasks that involve external vendors. A delay is likely to have a domino effect because so many external entities (such as vendors and payment networks) are involved;
• if you wait to certify, you will undoubtedly find yourself in a queue with others who are also trying to certify. This may cause significant delays in getting ATMs into production; and
• though it might be tempting to make further changes such as software upgrades, attempting multiple changes simultaneously could prove to be unmanageable. Focusing only on EMV will allow for a more efficient and effective migration.

Testing and certification

You should also consider that testing and certification can be a lengthy process that cannot be overlooked. Currently, American Express, Discover, MasterCard and Visa require that ATMs accepting chip cards must have:

• EMV Level 1 Approved Card Reader ("interface module" or "hardware"); and
• EMV Level 2 Approved Application Kernel ("software").

ATM owners are responsible for multiple levels of certifications. It is also important to note that the certifications required by the relevant payment networks are designed to test functionality that is important to them, and ensure that EMV data is handled correctly by the terminal and the network as per their specifications. These certifications will not cover all types of testing that an ATM owner, acquirer or issuer will need to perform. Regression, new feature, specific EMV, performance, volume and stress testing may be needed prior to certifying with a payment network. It is vital to certify the exact ATM configuration and software that will be used in production; therefore, internal testing should be completed prior to initiating formal certification with the networks. It is very likely that ATM vendors have already obtained all EMV approvals and that the network certifications will be completed by the ATM processor.

When certifying ATM processing for EMV, the scope of the effort should include certification with all EMV-ready payment networks (global and domestic) that are supported by the ATM. Where feasible, the ATM deployer may choose to place ATMs into production (or have EMV "turned on" for EMV-compliant ATMs already in production) only when all terminal certifications are complete for the majority of networks that the ATM supports. This will greatly reduce the possibility of AID mismatches, fallback and unexpected fines. 

Customer experience

Customer experience is another critical aspect of the EMV migration. Before making decisions, first consider if and how the ATM experience will change for:

• customers using a magnetic stripe card versus those using a chip card;
• on-us customers vs. off-us customers; and whether ATM transactions will be acquired as EMV transactions for all cardholders (including on-us) or just off-us cardholders; and
• customers using a motorized card reader versus a dip card reader.

If your ATM fleet experiences a low volume of chip transactions, you might want to work with application providers to limit customer experience effects to those customers using a chip card while not affecting magnetic stripe card users. By adopting this strategy initially, the customer base will not be affected until they are issued chip cards.

Overall, the migration to EMV at the ATM is a large and challenging task, and no two migrations are exactly the same. To avoid taking on unnecessary fraud liability and to achieve certifications in a timely manner, ATM owners should begin planning their migrations as soon as possible. Working closely with vendors, processors and payment network representatives will help to ensure an efficient and effective transition.

The preceding was excerpted and summarized from the EMV Migration Forum white paper, "Implementing EMV at the ATM: Requirements and Recommendations for the U.S. ATM Community," available online.

photo courtesy lida | flickr