Acquiring: Who Will Be Ready for Chip Cards?

Karen Epper Hoffman

The card networks have weighed in with their U.S. EMV policies, but doubts persist among acquirers about whether processors and merchants will be able to meet the networks’ deadlines.

“Is EMV Finally, Actually, Really Here?”

That was the name of one of the most popular education sessions hosted by the Electronic Transactions Association at its meeting in Las Vegas in mid-April. Scheduled at the end of the day, the panel session, which featured representatives from the retail and acquiring communities, drew a capacity crowd.

Not only that, but the session, which was supposed to last one hour, ended up running nearly twice that, stretched out into the cocktail hour by questions from the eager audience surrounding the ramp-up to the new card-network standards.

“There’s a huge amount of interest and enthusiasm with the road ahead,” says Patty Walters, senior vice president for merchant products and security at Cincinnati-based Vantiv Inc. (formerly Fifth Third Processing Solutions), who sat on the EMV panel. “Any time you have new technology adoption, especially as pervasive as EMV will be … there will always be a feeling of angst.”

The popularity of this EMV-related education session—taking place just one year before the deadline set by the card networks for processors and merchant acquirers to support chip-based transactions—underscores not only the magnitude of this sea change, but the concern in the industry about the difficulties it poses. As Walters points out, “We believe there’s a tremendous amount of opportunity … but there are challenges.”

Deadline Angst

Perhaps the most immediate challenge to EMV at the moment is whether all processors, including sub-processors and gateways, will be capable of handling chip cards by the April 2013 deadline set by Visa Inc., MasterCard Inc., and Discover Financial Services.

EMV, which stands for Europay-MasterCard-Visa, is a 1990s standard that defines rules surrounding transactions with cards embedded with computer chips rather than magnetic stripes. Visa released its U.S. EMV policy in August, followed by MasterCard in January and Discover in March. The latter two networks echoed deadlines set by Visa.

At yet another industry meeting, this one hosted by the Merchant Advisory Group in February, some industry players expressed concern as to whether smaller service providers would be ready to support EMV transactions by early next year.

Indeed, a recent survey of some 20 acquirers and independent sales organizations by the Boston-based Aite Group LLC found fully 35% expect to miss the deadline. Aite says this group consists of companies that simply can’t make it and expect the deadline to be extended, as well as players that have outsourced compliance to a third party that will hit the deadline but won’t leave enough time for internal testing.

“A lot of players will not make the deadline,” says Robert McMillon, vice president for global security at Atlanta-based Elavon, the acquiring arm of U.S. Bancorp, and a panelist at the EMV session at the February MAG conference. “I wouldn’t be surprised if [even] one of the bigger processors asked for an extension.” Indeed, McMillon says that any gateway being ready with a “majority of processing partners by April 2013 would be a surprise to me.”

Nonetheless, McMillon points out that the 2013 deadline is more focused on host readiness, “having the core acquiring platforms and specifications ready to handle EMV contact or contactless transactions. It does not mean having to have gateway readiness.”

Jimmy Scarborough, senior vice president of business development, Bank of America Merchant Services (BAMS), says that the concern stems from the sheer number of processing partners that retailers work with. All of those partners have to get certified. “The certification process is not something simple, just flip a switch and it’s done,” he adds.

“Everyone has angst. Everyone is challenged by the deadline,” says Walters. At the same time, she adds that many participants in the payments industry—including the large acquirers and the leading terminal manufacturers—are already well on their way to EMV readiness. The terminal makers, she says, that operate in Europe as well as the States are the most prepared because they have been supporting EMV specifications already for a decade. “They’ve developed platforms that can be used in any country,” Walters adds.

Bruce Dragt, senior vice president of payment systems for First Data Corp., believes that by the time April 2013 rolls around there will be a “basic level of readiness in the industry.” The deadline as he sees it is more of a “technology capability date” aimed at the core infrastructure, Dragt adds. As Dragt and other industry insiders point out, this means the systems need to be capable of EMV transactions, but it doesn’t mean the industry will switch overnight.

“There’s not going to be a Big Bang event in 2013. Merchant adoption is going to be gradual,” McMillon says, adding that large retailers like Wal-Mart Stores Inc., which has already invested heavily in EMV, are more the exception than the rule in the merchant community. “Just because Visa and MasterCard say we need to be ready to do this doesn’t mean the merchants are going to be ready. There’s going to be an enormous merchant impact.”

‘Last And Biggest Hurdle’

Beyond the preparedness of sub-processors, the merchant community has other issues to sort out with the card networks before it can begin full-throttled support for EMV.

At the top of the list is the issue of whether EMV should require authentication with a PIN versus the use of cardholder’s signature. While chip-and-PIN is the standard in Europe and other regions where chip cards are common, signatures have long been the standard authentication in the States, but are not considered as secure as PIN.

Processors are largely supporting their client-merchants in demanding that the PIN be adopted to best ensure the reduction of fraud, while the card networks have backed away from committing to PIN authentication.

In the January release of its “roadmap for EMV,” MasterCard said it would offer incentives that indirectly favor EMV transactions with PIN at the point of sale by reducing the merchant’s liability. Meanwhile Visa said it would support dynamic authentication, a technology that generates unique encrypted identifiers with each transaction.

Here again, this topic was a hot source of commentary for the February MAG meeting. “PIN is absolutely the best method we have today for two-factor [authentication] that causes the least amount of disruption [at the point of sale],” said panelist McMillon at the event, according to a Feb. 17 Digital Transactions News article on the event.

Scarborough agrees. “The market is still split out there. Retailers out there are vocal about wanting PIN. Signature is not a method that can be verified the way PIN could. But [for some merchants] PIN does not meet their model.”

For example, in the case of a white-tablecloth restaurant, there would “need to be a change in the entire workflow of a transaction” to take a cardholder from the traditional slide-and-sign to dip-and-PIN process, according to Dragt.

Walters says the entire critical issue of the dispute process in EMV rides on how the transactions are authenticated. “This is a challenge the retail community needs to resolve before large adoption happens,” she says, adding that it will be the “last and biggest hurdle” to EMV in the United States.

Elavon’s McMillon still believes that without the PIN, card transactions will be easier to repudiate. But he believes that within two or three months, the industry will see “some sort of compromise” on the signature-versus-PIN issue. For example, just as cardholders today can make “swipe-and-go” debit transactions on purchases of less than $25 at many merchants, McMillon believes the card networks may ask consumers to enter a PIN for purchases over a certain dollar threshold.

‘Real And Significant’

While the merchant-acquiring community has its hands full preparing for next April’s deadline, the real focus, most say, is more than three years down the road.

Executives are most concerned about meeting the October 15, 2015 deadline—the all-important date when liability will shift to the acquirers, and by association the merchants, if the merchant’s terminal is not chip-card-capable and the transaction is fraudulent. (Petroleum companies have an extra two years, until Oct. 1, 2017, to get their pumps chip-card-compliant.)

For many in the industry, the April 2013 technology deadline is just the warm-up for the more meaningful main event that takes place in 2015. “The liability shift in 2015 is real and significant,” Walters says.

As McMillon points out, all the other EMV-related targets are acquiring-industry-focused, whereas the 2015 deadline is squarely focused on the merchants. He believes that, as the industry gets closer to that liability-shift date, larger merchants will not only be well-established in their EMV support, but smaller (and typically slower-moving) merchants will be catching up and supporting EMV at their points of sale, as well.   

McMillon notes that the momentum for EMV has been growing gradually in the United States for years and, with the upcoming deadlines and incentives in place (most notably, relief from annual Payment Card Industry data-security standard validation for merchants generating high numbers of EMV transactions), the likelihood of the merchant community hitting its goals is getting better and better with each day.

“If you had asked me three years ago if EMV was coming to the U.S., I would have said there’s a 50% chance it will be here 10 years from now,” he adds. “Today, I would say there’s a 95% chance it will be here in three to five years.”