Article
Scaling the EMV mountain
Just how serious is the EMV challenge facing U.S. ISOs?
September 2, 2014
by Daryl Cornell,
CEO, Triton Systems
Issuers have publicized plans to rain down chip cards on customers; Walmart has said it will fully support EMV by next fall, and the public has been educated on the risks of magnetic stripe cards.
Financial institutions are already implementing EMV at the ATM along with Windows 7 upgrades. Nearly 10 million point-of-sale devices are in the process of being replaced.
Even NAC has gone on record as saying that ISOs should begin now to upgrade their ATMs for EMV. But just how serious is the EMV challenge facing U.S. ISOs?
Assuming no further delays in liability shift, the current U.S. EMV implementation timeline calls for migration by Q3 2016 (MasterCard) and Q3 2017 (Visa). Taking the later date, ISOs now have roughly three years until full liability shift occurs.
Many ISOs will elect to roll the dice post-liability shift, hoping that any breaches and subsequent fraud originating at their ATMs will be small.
However, as we saw in Canada, processors might simply decide to turn off large swaths of high-risk, non-EMV ATMs rather than assume the risk of chasing shallow-pocketed ISOs for fraud claims.
Turning to the logistics of U.S. EMV upgrade, let’s look at the numbers. Estimates are that there are currently 300,000 retail ATMs operating in the U.S. Using recent data from Canada, a market where EMV conversion was completed at the end of 2012, retail ATM EMV conversion occurred roughly as follows:
•45 percent of terminals were upgraded for EMV through conversion kits, with upgrades performed by field technicians;
•50 percent of terminals were replaced, with ISOs trading in older gear for credit toward new ATMs; and
•5 percent of terminals were retired as sites were culled or contracts not renewed.
If we apply these same percentages in the U.S., retail ATM EMV conversion will look like this:
•135,000 ATMs will be upgraded via kits installed by field technicians;
•150,000 new ATMs will be purchased and installed and the 150,000 ATMs being replaced will be returned to manufacturers as trade-ins; and
•15,000 ATMs will be retired as uneconomical or will not have their contracts renewed.
Fortunately, many ISOs have already begun purchasing new ATMs that are EMV-ready, fixing or even slightly reducing the EMV conversion pool at currently installed base levels.
Using Canadian data, where an average of 3.2 site visits were needed to upgrade, install and de-install, activate and trouble shoot, approximately 912,000 site visits will be needed to complete U.S. retail EMV conversion.
Note that for the most part these are incremental site visits, although some ISOs are planning EMV upgrades in conjunction with PCI upgrades, security module upgrades, password resets, ADA upgrades or software upgrades.
If all ISOs were to begin EMV conversion tomorrow, OEM and field service requirements would require approximately:
•25,000 monthly field technician site visits;
•4,200 new ATM purchases each month; and
•3,750 monthly upgrade kits.
Third-party technicians are ill equipped to handle this level of additional work, as many are already busy upgrading FI terminals for Windows 7 and EMV.
Current monthly ATM manufacturing capacity is approximately 3,000 units and could be increased gradually to handle the 40-plus percent increase in market demand.
Upgrade kits are normally built to order and could also be produced to match market requirements, given appropriate lead times.
The reality is that few, if any, ISOs plan to begin EMV upgrade programs this year. Many cite the continued uncertainty surrounding the process and the heavy capital requirements needed.
Both of these are concerns that will likely delay widespread ISO EMV implementation well into 2015.
Assuming all ISOs begin EMV conversion a year from now, OEM and field service requirements jump to:
•38,000 monthly field technician site visits;
•6,250 new ATM purchases each month; and
•5.625 monthly upgrade kits.
ISO delay until Q3 2016, on the heels of the MasterCard liability shift, would require:
•76,000 monthly field technician site visits;
•12,500 new ATMs each month; and
•11,250 monthly upgrade kits.
Given the magnitude of these projections, it could prove simply impossible for the industry to hire and train enough field technicians on a temporary basis to complete the U.S. EMV upgrade in 24 to 36 months.
Manufacturers might be reluctant to speculatively employ the working capital needed to triple production capacity to meet temporary EMV demand — particularly when post-EMV hardware demand will almost certainly plummet to new historical lows.
Unlike Canada, Mexico and the UK, U.S. EMV conversion has not (yet) been mandated by a regulatory body. Liability shift alone virtually guarantees that a majority of ISOs will delay EMV conversion plans.
By the time non-EMV terminals are turned off by processors or six-figure liability claims are publicized, it might be too late to marshal the resources needed to make a timely transition to EMV.
The logistics involved in U.S. retail ATM EMV upgrade will be complex. Planning, which should include conversations with third-party field service and hardware suppliers, cannot begin soon enough.
This article has been republished from the Triton blog, atmAToM, with kind permission from Triton.
photo: USASOC News Service | flickr
Included In This Story
Triton Systems
Triton FI based products • NO Windows 10™ Upgrade • Secured locked down system that is virus/malware resistant • Flexible configurations - Drive-up and Walk-up • Triton's high security standards • NFC, anti-skim card reader, IP camera and level 1 vaults are all options • Triton Connect monitoring • Lower cost
