Commentary

The whats and whys of EMV noncompliance at merchant-owned ATMs

If you are an IAD or ISO with processing agreements currently in force for independently owned, EMV-noncompliant ATM locations, the $64,000 chargeback question is ... "What are you going to do?"

photo-illustration istock

October 17, 2017 by atm Atom — blogger, atmatom

by Jack Milford Ford, Attorney at Law, JMFord Law Offices

Even in October 2017, after the so-called Visa liability shift, I have continued to read in numerous publications that the vast majority of merchant-owned ATMs — approximately 200,000 in all — are not EMV compliant.

I recently noted in reading another publication that the vast majority of gas stations have yet to switch their fuel pumps to be EMV compliant, as well.

The article said that as of 2013 there were approximately 153,000 gas stations in the U.S., and that approximately 80 percent of automobile fuels are purchased by convenience stores.

The vast majority of these stores are owned by merchants, not major oil companies. Exactly how many are independently owned as of October 2017, I do not know, but my assumption is that the number is probably far in excess of 100,000.

Why do I cite these numbers? Because over the past year, the vast majority of independently owned gas stations have barely moved toward upgrading their fuel pumps to be EMV compliant. Why is that, you ask? Well, according to the article:

Fraud at fuel pumps is very low — just 1.3 percent of total U.S. payment fraud.
Most gas stations have multiple fuel pumps, each costing between $6,000 and $10,000 to upgrade.

If pumps have to be physically removed (not only the hardware, but also the wiring), the cost is compounded due to loss of business while all this work goes on.

So, the independent gas station owners have weighed and continue to weigh the overall expense to upgrade against the risk of not upgrading and incurring card fraud.

Plus, a deadline extension by the networks means that they now have three more years before their EMV deadline.

Consequently, it appears that this has become a business-financial issue and the independently owned gas stations have voted to wait and see by their non-action to upgrade.

Why is this relevant? I will now go out on a limb here and assume that most of these 100,000 plus independently owned gas stations have an ATM on site within their convenience store.

So, it should not be a surprise that a high percentage of the gas stations not currently upgrading their pumps to be EMV compliant have decided to hold off upgrading their ATMs to be EMV compliant, as well, even though:

The cost to upgrade or replace one in-store ATM would probably be less than the cost to replace or upgrade a fuel pump.
Upgrading or replacing an ATM would involve no real downtime,
Fraud amounts at an ATM will be higher than at a pump.
The ATM deadline is not three years away, but this month!

Probably a significant percentage of the 200,000 merchant-owned ATMs that currently are not EMV compliant sit in gas station convenience stores.

So, if you are an IAD or ISO with merchant-owned processing agreements currently in force with independently owned ATMs at gas stations and other merchant locations that have not upgraded to be EMV compliant, the $64,000 chargeback question is what are you going to do?

I have written white papers and blogs, been a panelist on webinars, and spoken at ATM conferences — all with the same message concerning this issue: 1) Continually remind these merchants that they are liable for chargebacks at non-EMV ATMs; and 2) document your contacts with them.

If certain merchants are in avoidance mode and elect not to upgrade their ATMs, then their IADs and ISOs need to upgrade their merchant-owned processing agreements to protect themselves.

Why? Because, if the merchant-owned processing agreement has not been amended within the past year or two to deal directly with EMV liability shift claims, the IAD or ISO risks being hit with EMV chargeback claims.

Why? Because the EMV liability shift is neither regulated by federal or state governments, nor mandated by the networks. Accordingly, merchants are neither legally required nor mandated to be EMV compliant.

Consequently, what provision will IADs and ISOs rely on in their standard merchant-owned processing agreements to deal directly with EMV liability shift claims? Typically, most such agreements have no such provision!

I understand that the chargeback is the merchant's liability if that merchant owns the ATM. However, based on contractual relationships between the applicable parties, the IAD or ISO will be the one that initially incurs the financial liability of a chargeback.

Why? Because the IAD or ISO has the contract with the processor and sponsoring bank.

The processor, pursuant to instructions from the IAD or ISO's sponsoring bank, will withhold money from the IAD or ISO's settling account (which indiscriminately will apply to all merchant ATM surcharge fees being settled, not just those of the merchant with the EMV-noncompliant ATM) to cover the chargeback.

More than likely the IAD or ISO will then have to file a lawsuit against the merchant to recover these funds. Litigation is the last thing that most IADs and ISOs I have talked to want to initiate, and rightly so — it's not good for customer relations.

I hope that IADs and ISOs trying to recover chargeback funds being withheld from their settlement accounts have other cash flow streams to rely on in the interim.

I certainly hope that IADs and ISOs do not have additional chargebacks from merchant-owned EMV noncompliant ATMs, as more funds ultimately will be withheld from settling accounts if there are.

And finally, I hope that IADs and ISOs can be creative in coming up with financial incentives for merchants to upgrade their ATMs.

If this fails, try to negotiate and sign an amended processing agreement — one with teeth — regarding chargebacks. And if this also fails, consider negotiating a walk-away.

My concern is that the IAD or ISO who does nothing — and has old contracts with the type of merchants discussed above — will have hanging over their business the doom-and-gloom question of when, not if, they will be hit with a wave of chargeback claims.