With many markets having completed the migration to EMV,
the onus is now on countries which have not yet upgraded their
payment infrastructures to catch up with the rest of the world. Ian
Kerr, CEO of ATM specialist Level Four, outlines some of the major
issues that need to be considered. John Hill reports.
Go deeper with GlobalData
Many of the largest banks in the US have been steadfast in
their refusal to adopt EMV as a standard security measure on their
payment cards and terminals. Much of the motivation behind this
decision boils down to the enormous outlay that would be needed to
replace current processing systems, especially ATM networks.
However, the US is almost alone in
this decision, with virtually every other developed country across
the globe either implementing or planning to implement an EMV
migration programme. One of the players involved in EMV programmes
in the Asia-Pacific, Latin America and Europe regions is Level
Four, an ATM software tester and developer, based in the UK.
Ian Kerr, CEO of Level Four,
explains that with the current wave of EMV migration and the added
complexity that comes with implementing the fraud prevention
technology, many central and commercial banks are turning to
outside consultants for guidance with the migration process,
especially with ATM networks.
“A lot of the work we have been
doing shows banks need to be testing at least four or five thousand
scenarios on their ATMs, so you would be covering accurately the
number of transaction types, languages, bill mixes, menu options
and so on,” Kerr says.
How well do you really know your competitors?
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Thank you!
Your download email will arrive shortly
Not ready to buy yet? Download a free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalData“Of course, once EMV is
implemented, that testing requirement goes up by an order of
magnitude. This is where we come in, which means as a company we
are reasonably well positioned, having worked with a lot of
different companies as an independent consultancy to comment on
some of these migration exercises.”
Growing pressure on the
US
With the rest of the world
looking at EMV as the solution to a lot of their card security
problems, there has been a lot of pressure put on US banks to
revisit chip and PIN as a viable possibility.
According to Kerr, with both Canada
and Mexico adopting EMV, there is now real discussion going on
within American banks as to how exactly this could work.
“EMV is now gathering momentum
around the world,” Kerr adds. “Canada did a very good job with
their EMV migration, which is now virtually complete, and although
they are still working towards some deadlines they are well down
the track. What this has meant is that in recent conversations with
some of the big US banks we are speaking to, some are changing
their viewpoint from if the US will eventually go to chip and PIN,
to when.
“This has become more pronounced
over the past year or so, and the point about fraud crossing
borders to the easiest point of exposure has become increasingly
important. Canada and Mexico converting to EMV has meant that the
US will find itself surrounded fairly soon. On top of that, US
cardholders are travelling abroad to places like the UK and Europe
and are finding that they are being denied transaction access,
particularly in some ATMs, because of a lack of EMV facility on
their cards.”
As the prevailing wind switches
from a question of if to when, another important question that
arises is how long the banks can survive with fraudsters
increasingly pushing into the US from all angles.
“The US will be highly isolated if
they are an island of non-EMV compliance surrounded by EMV adopters
like the Canadians and the Mexicans,” Kerr told CI.
“They are going to leave themselves
quite open and that is not a good place to be. One of the arguments
coming out is that the US is a different ball game altogether, and
given the number of ATMs and POS terminals in the country, which is
an undeniably huge number, especially when compared to some of the
European countries, this is certainly a reasonable point.
“But there comes a time where that
weight of evidence becomes compelling and they have got to do
something about the fraud problem. In fact, I am hoping and
expecting that in the next year or so some targets will be
expressed by the US banking community, and they will start a
programme.”
Challenges of meeting
migration dates
Despite a late start, Australia has
actually set a deadline for its migration programme, a mandate that
many Asia-Pacific countries have yet to do with their own
programmes. The lack of harmonisation in terms of EMV migration
deadlines also poses some challenges, according to Kerr.
“The next big country looking to
migrate over to EMV is Australia,” Kerr said. “They are now under
direction to change all their ATMs to chip and PIN by the end of
2011, which is something we are keeping a close watch on and
hopefully will be an opportunity for us as we work with the banks
there.
“In terms of different central bank
mandates in Asia-Pacific compared to Europe, we have recently been
having discussions in places like Thailand, where there are
different views on the deadlines. We are trying to clarify exactly
what those deadlines mean, because we have had a few different
interpretations. In Australia, as previously mentioned, they expect
ATMs to be totally compliant by the end of 2011. That is a mandate
that has been issued by Visa and it looks like they are going to
enforce that reasonably rigorously.”
He continued: “Comparatively
speaking, Canada was a very good example of a country that planned
well for an EMV migration. They listened to people’s experiences
from around the world and they prepared very well for the migration
exercise, which is why it has gone so smoothly.
“Conversely, some Asian countries
have a lot on their plate with other projects at the moment and, of
course, it is a costly exercise, so we are still waiting to get
some firm tangibility around dates. Hopefully that will be
clarified before too long.”
But it appears some banks are using
the implementation of EMV as an opportunity to enhance the value of
their product propositions, Kerr pointed out.
“We have just done our first
project in Asia, and are seeing a lot of interest around the EMV
migration – which is somewhere near the top of many banks’ lists of
things they have to take action on in terms of regulatory
compliance. As well as supporting EMV migration, it also means they
have an environment where they can bring increased functionality to
market in the future. What we can help them do is take cost out and
make the process less risky while implementing new ATM software and
releases.”
The cost of replacing
legacy systems
While it looks like even the US
banks are coming round to the idea of EMV, there are certainly
problems involved with implementation, not least of all the
enormous costs associated with the process of upgrading legacy
systems.
In Europe and the West, the general
rule with a standard such as EMV is that it is an all-or-nothing
process, meaning either all the banks or none of the banks adopt
the technology. In some of the more fragmented Asia-Pacific
markets, it is almost up to each individual bank as to whether they
wish to roll out the scheme. Kerr explains the case for banks
adopting EMV technology in situations like this.
“In the case of EMV it is a costly
exercise to upgrade from banks’ current systems. Including ATMs and
POS terminals, there is a lot of capital expenditure, time and
consultancy required, and in fact it is actually a bit of a reverse
business case. What this means is that it is an investment to avoid
potential loss into the future, and obviously those losses are
around mitigating card fraud. As we go forward the card schemes
will shift liability onto the banks if they aren’t EMV-ready, so
while there is a business case for doing it, it is a hard one to
quantify,” he says.
“From a cards perspective, it
really throws an emphasis on taking advantage of the particular
chip and PIN technology on a certain card, which means looking to
try and overlay additional card applications to produce revenue.
This could maybe be loyalty programme-type applications or
co-marketing-type applications to generate revenue opportunities
for banks, which is a lot more attractive from their point of view
than just investing in a cost avoidance programme.”
The main reason for adopting EMV is
to mitigate fraud risk. As shown when EMV was adopted in Europe,
this can push the fraudsters into other geographical areas, as well
as into using increasingly more technically complex methods to
obtain and use card data. Kerr explains that while the geographical
location for fraudsters may change, their methods remain much the
same.
“I think that is the pattern that
does emerge, meaning that fraud or crime will migrate into the area
of least protection or most exposure, and that will continue. It is
going to be the banks in country that must take responsibility to
make sure they are as well protected as they possibly can be,” he
adds.
“Obviously cardholder-not-present
fraud is something that needs to be looked at as we go forward and
maybe this is even an opportunity for smart cards to be used in a
type of e-commerce environment.”
As well as the US and Asia-Pacific,
there is also a great deal happening in terms of EMV in Latin and
Central America. Kerr talked about how Level Four have been working
with TecBan, an ATM network provider in Brazil.
“Over the last few months, we have
successfully completed our first project in Latin America in Brazil
with TecBan, the country’s largest processor of off-premise ATMs.
They work on behalf of 35 Brazilian banks and their network is
around 7,000 machines, and growing to 12,000 over the next couple
of years,” he says.
“TecBan actually support their own
application on the network which quite cleverly customised itself
around each individual account holder for their banks, so if you
are one of their customers you see the bank’s own screen flow and
images when you put your card in one of their ATMs. It is quite a
dynamic and clever application.
“We see a lot of opportunity in Latin America.”
