The 10 Things Issuers Need To Know About EMV Migration

T-minus one (day) until the migration to EMV in the U.S. officially happens. A journey that started worldwide two decades ago will finally include the largest card market in the world.

There’s been a frenzy of activity over the last 12 months or so as merchants, processors, issuers and networks prepare. Although a lot of progress has been made, a lot of work remains to be done.

In many, many ways, the journey is just beginning.

Oberthur Sr. VP of Sales James Sufrin shared a few important tips for issuers who are taking or are about to take that journey with MPD CEO Karen Webster, based on a brand new piece that the company published in anticipation of the shift tomorrow. Oberthur Technologies (OT) is no stranger to EMV and migrations — it has 20 years of experience in chip card migration worldwide, with 18 out of the top 25 largest financial institutions having placed their trust in OT. It established a footprint in the U.S. in 1996, completed the first major U.S. chip card migration in 2011 and now has a U.S.-based chip card personalization capacity of over 200 million cards annually and a chip card manufacturing capacity in excess of a quarter of a billion cards a year.

Here are three of the 10 must-know tips for how to prepare for this new chip-enabled world.

KW: Let’s start with tip number one because I think it’s a fundamental point that perhaps a lot of people missed. That is the role of really understanding what’s involved and educating all parties on the issuing side of making the migration. Can you elaborate a little bit on why that is important?

JS: EMV is obviously — as opposed to what issuers have been used to for many, many years with mag stripe cards — complex. There are a lot of elements. There is a lot of misinformation out there. There’s a lot of stakeholders that are trying to drive issuers in certain directions, for good reasons and for bad. Having worked with literally hundreds of issuers at Oberthur on chip card migrations, I would say the most important thing is to understand what’s important, what’s not.

This speaks to our first tip: Contact your processor. These are the folks or the entities actually handling the transactions, so we recommend issuers first reach out to them. Issuers will need to work with their processor on how the data needs to be changed. Is the processor ready to even handle EMV data, and what does that mean in terms of the timeline of the card issuing? Every EMV payment transaction will be impacted by these decisions. All of these things and more go into the education of the issuer.

KW: You mentioned reaching out to processors as the first step, but your second tip talks about the need to get in touch with the payment network provider. Why is that important, and why is that the second thing that needs to happen?

JS: Frankly, in the spirit of common cause, the payment networks are certainly the stakeholders driving EMV adoption. They are the ones that implemented this liability shift that’s upon us now in the U.S. And they each have their institutional views of EMV implementation, their vision of what the issuer needs to be concerned about, should be implementing and must consider going forward. They are also the ones that test and certify the EMV platforms that are developed for stakeholders like Oberthur. Additionally, the payment networks assist in EMV profile development and recommended risk perimeters. And, ultimately, they test and approve the issuers fully functioning EMV card products. The network — and the processor — are absolutely key stakeholders on your EMV migration project team.

It is important to note that payment networks are an important part of the team in the project initiation phase and in the ongoing lifecycle management of the products in the issuer’s portfolios.

KW: One of the other tips that I thought was particularly interesting was the need to be very clear on the authentication, verification and authorization parameters in contemplating this migration. These seem like very basic concepts that all issuers should be thinking about regardless. What’s different in a chip world?

JS: Certainly, those terms and those concepts have been out there for mag stripe card issuance, or even before. The reality is, at its core, EMV is all about those three elements of risk and fraud mitigation.

Authentication is all about, as we say in our tips, addressing counterfeiting. There, an issuer needs to consider an online card authentication scenario — or perhaps an offline authentication scenario. Offline authentication means that the communication between the terminal and the host processor, or the network, isn’t authenticating in real time. The chip generates a digital certificate, which is read and validated by the terminal when at the point of sale.

Again, these are just some important options and choices you have with EMV, where you didn’t have those with the mag stripe product. Depending on the issuer’s requirements, online and offline are two very different strategies with different implementations. But they both don’t all have to happen at once; an issuer could decide that they are going to support an online-only environment and then move to offline authentication later.

Verification also comes in multiple forms. This is about fraud mitigation when it comes to lost and stolen cards. The ability to verify that that cardholder is who that cardholder is supposed to be is obviously very critical in mitigating that fraud due to lost and stolen cards. This decision, like authorization, is a function of risk management and user experience. Verification could happen via a PIN solution, which could be online or offline — or signature-only. EMV will allow the issuer to configure to any of the above to prevent this type of fraud and this type of loss.

Transaction authorization is where EMV shines and where issuers can really leverage this little key computer that sits on that little piece of plastic. By using the chip, an issuer can configure the card to approve that transaction when connectivity to the network is down. Utilizing the chip to take advantage of what happens when the network is down to assure proper transaction authorization is a big help. And although that may not happen often, when it does, it helps issuers, merchants and cardholders to feel a whole lot more secure.

KW: These are three of the 10 tips that you offered in your new whitepaper. Reading it, I think it’s easy to kind of get the gist of what issuers need to be thinking about as they contemplate the move to chip.

One final thought: You obviously encourage issuers to get in touch with card providers and those that are personalizing those cards to get moving and to get a schedule in place. Is this a long and complicated process?

JS: It can be. I’m a big believer in trying to simplify what could otherwise be viewed as a complex program or project. Basically, not only do we recommend — in our 10th tip — that issuers reach out to their card manufacturer, or their card personalizer, but that those two entities could, and probably should, be one in the same.

We think that having an end-to-end value proposition for EMV card issuance is far more important and even relevant than it was in a mag stripe environment. Having been part of so many client EMV migrations over so many years and in so many countries, our experience at OT tells us that the EMV chip is closely tied to the card personalization platform. So, having a single partner for both eliminates unnecessary complexity — not only for initial migration but obviously for the life of the products and services that that issuer is going to be dealing with.

We also think that having a single entity reduces the EMV migration in terms of the time it takes. It takes more time to launch an EMV program than a mag stripe card program. But over the years we’ve reduced the complexity through what we call an “EMV-in-a-Box” solution. Simply put, we have created a program based on our best practices gained from doing chip migrations all around the world. The EMV-in-a-Box program includes on-site consultation, EMV training, project management and technical support. The migration plan enables EMV cards to be issued within 12 weeks from card validation. EMV and migrations can be complex, but we’ve developed an ability to make it relatively simple.