Acquiring: Stumbling Blocks on the Migration Path

Jane Adler

With an April deadline looming, industry observers’ doubts are growing that merchant processors will be ready to handle EMV transactions.

Nothing inspires like a deadline.

Just ask the merchant acquirers and processors that face a quickly approaching April deadline to be ready to process EMV or chip card transactions.

Many acquirers and processors are finally ramping up their EMV efforts. They’re retooling software, updating their databases of point-of-sale (POS) equipment, creating education programs for merchants, and even thinking about consumer outreach. The industry has formed several forums to speed implementation as acquirers and processors size up the risks and opportunities associated with replacing all the POS terminals in the country.

What’s at stake? It’s estimated that sales of the new terminals could total as much as $8.4 billion. While merchants will certainly bear most of that expense, acquirers are spending millions of dollars to make the EMV shift.

For now, the big processors say they’ll be ready by April 1, 2013, the date set by the card networks for EMV acceptance. But smaller processors and acquirers aren’t so sure they can meet the deadline as they wait for the big players to unfold their plans. At the same time, real questions about the transition from swipe technology to chip cards haven’t been resolved.

The debit-processing networks have yet to figure out a way to route chip transactions and still comply with the so-called Durbin Amendment that regulates interchange rates. Another wrinkle: Will contactless or NFC payments technology be integrated into EMV terminals? No merchant wants to replace POS terminals twice in a short period of time.

“There is so much confusion in the marketplace,” says Drew Freeman, president at Merchant Data Systems Inc., a wholesale independent sales organization (ISO) based in Miami. “EMV rollout is going to take a while.”

Small ISO, Big Challenge

Globally, there are more than 1.3 billion EMV cards in circulation and 15.4 million EMV POS terminals installed, according to a September report by Mercator Advisory Group Inc., Maynard, Mass. The United States is the last major market to introduce EMV, also known as smart card technology, for payments. Unlike the magnetic-stripe cards that have been in use here for years, EMV cards are mini-computers that are highly secure and difficult to counterfeit.

In 2011, Visa announced its EMV rollout roadmap for the United States. Soon thereafter, MasterCard signed on, along with the other major card brands. The roadmap includes a series of deadlines for compliance as well as incentives and penalties to encourage implementation, though industry players question whether the measures are truly enough to help speed adoption.

The first deadline streamlines compliance with the Payment Card Industry data-security standard (PCI). As of October, merchants were allowed to skip their annual validation for Visa PCI compliance if 75% of Visa transactions were made on EMV-ready POS terminals.

This may act as an incentive for the big retailers, but it isn’t much of a carrot for small ones. “The PCI requirements for small merchants are really low,” says Marc Castrechini, director of software development at Merchant Warehouse.com LLC, a Boston-based acquirer with 80,000 merchants. “All they have to do is fill out a survey.” Fees associated with compliance for small merchants aren’t much either, usually under $100.

In October 2015, the liability for counterfeit fraud shifts from issuers to merchant acquirers if a merchant’s POS terminal cannot accept EMV transactions (gas stations have until October 2017). The shift is meant to encourage adoption. But small retailers without a lot of chargebacks due to fraudulent transactions might not think it‘s worthwhile to invest in new and expensive POS terminals when their old system works just fine. As a result, many industry insiders don’t think a significant percentage of merchants will be able to accept EMV cards by 2015.

Just four months away, the April 2013 deadline worries processors most. The roadmap requires that processors and sub-processors be able to process EMV transactions by then, along with near-field communication (NFC) payments via mobile devices. A big part of the requirement is that acquirers have the capability to process the digital certificates and cryptograms generated with EMV transactions.

In a survey of ISOs and acquirers last April, 35% of respondents said they don’t expect to meet the deadline. About 50% of independent sales organizations expect to be ready, says the report by the Aite Group LLC, Boston.

Even if half of the ISOs are ready to take transactions on April 1, 2013, their acquirer clients may not have enough time to prepare, according to Rick Oglesby, an Aite senior analyst. He argues that the large ISOs will make the changes just in time to meet the deadline. But that means the small acquirers that rely on technology from the big companies won’t have enough time before the deadline to test their own systems and train a sales force. “The smaller the acquirer, the bigger the challenge,” says Oglesby.

For many observers, the long march toward EMV hasn’t quickened its pace since early this year, when doubts first began emerging about processors’ ability to meet the April 2013 deadline (“Who Will Be Ready for Chip Cards?” June).

‘A Real Tough Question’

Several industry forums have started groups and held meetings to speed EMV adoption. These include the Smart Card Alliance, the Merchant Advisory Group and the Secure Remote Payments Council. In August, the Smart Card Alliance formed the EMV Migration Forum, which includes 41 acquirers and processors.

“We lost a year,” says Randy Vanderhoof, executive director of the Smart Card Alliance, Princeton Junction, N.J. He explains that processors and acquirers were waiting to see if EMV would really happen. “Now, the stakeholders realize they have to move quickly to meet the deadlines,” he adds.

The EMV Migration Forum meets biweekly to work through challenges and identify common approaches and best practices. Visa is hosting a December meeting for Forum members at Visa’s offices in California.

MasterCard has held a number of training sessions with acquirers and merchants. MasterCard also has a team of EMV “ambassadors” drawn from different specialties to help guide customers.

First Data Corp. assembled what it calls a “cross-functional” team, bringing together managers from the issuing and processing sides of the business. The team meets regularly to coordinate the company’s EMV approach.

Despite these industrywide efforts, debit card acceptance remains a huge speed bump on the road to adoption. “Debit is a big problem for everyone,” says Paul Tomasofsky, president of the Secure Remote Payment Council, an industry forum for the debit network processors. “There’s a lot of talk right now, but no action.”

The Durbin Amendment, which was part of the 2010 Dodd-Frank financial reform and caps debit interchange, complicates EMV adoption. Under the regulation, merchants are allowed to choose their own transaction routing to reduce their processing costs. But the EMV chip, for a variety of technical reasons related to the processing priorities programmed into the chip, may have to route the transaction to a processor other than the one designated by the retailer.

“It’s a real tough question,” says Terry Dooley, senior vice president and chief information officer at Shazam Inc., a debit network based in Des Moines, Iowa. “The Durbin Amendment creates a lot of complexity.”

‘Too Aggressive’

Another issue yet to be resolved is whether EMV cards will be authorized by signature or by PINs. Credit card users are not accustomed to entering a PIN at the time of payment, so some financial institutions are issuing EMV cards with signature approvals. But the worldwide standard is PIN authorization.

Adding to the complexity is the emergence of contactless payments. The EMV standard can be built into smart phones. Cards can be issued that can be used for contact or contactless transactions. POS terminals that can accept contact and contactless EMV can also process mobile payments from smart phones.

In June, processor Chase Paymentech launched a “future-proof” terminal that accepts EMV, mobile, contactless, and traditional card-swipe payments. The terminal also supports either PIN-based or signature EMV transactions. Merchant Warehouse is testing custom software that accepts EMV cards and also contactless NFC payments.

Atlanta-based First Data is deploying EMV-capable POS terminals that accept multiple payments modules. Consumers can swipe cards with a magnetic stripe, or pay with a tap from a contactless card or phone. “Merchants aren’t in the business of payment acceptance,” notes Dom Morea, senior vice president and division manger at First Data. “We know the technology is working if merchants are not talking about EMV, chips, or NFC. It just works.”

With the April deadline approaching, some acquirers and processors are worried. “I don’t know how merchant processors can be ready by April,” says Tomasofsky. “They don’t know what to do.”

Shazam’s Dooley believes meeting the April deadline in its current form will be a challenge. Shazam won’t push terminals into the merchant markets until shopkeepers ask for them. “The deadlines are too aggressive. The industry will have real challenges over the next three to four years,” Dooley says.

He also worries that fraud mostly occurs on card-not-present transactions and EMV doesn’t solve that problem. “So why are we being pushed to implement this?” asks Dooley, who thinks 100% deployment of EMV terminals will take a decade.

EMV adoption could be slow despite looming deadlines, industry players say. In Canada, where EMV was first rolled out in 2007, about half of the terminals had been replaced with EMV-enabled machines by the time of the deadline, says Aite’s Oglesby. Based on the normal replacement cycle for POS terminals, Oglesby predicts a replacement period similar to the rollout in Canada. Half the terminals here should be replaced in three to four years, and the rest in another two to three years.

Merchants will probably continue to take both EMV card transactions and swipe transactions until mag-stripe cards are prohibited, says Castrechini at Merchant Warehouse. “No store clerk is going to push it either way,” he says.

‘A Negative Event’

About 70% of the new merchants acquired by Veracity Payment Solutions Inc. receive an EMV-enabled terminal. EMV equipment is being rolled out to existing clients too, starting in January with small merchants. “Small merchants require a lot more training,” notes Joseph Cohane, chief executive at Veracity, a merchant processor based in Atlanta. He believes the biggest challenge will be convincing merchants that EMV implementation adds real value.

Beyond the improvements in fraud protection, Cohane thinks merchants must be sold on the benefits of smart card technology, which can support features that boost sales, such as electronic couponing, discounts, and loyalty points. “We want to emphasize that chip cards will create more transactions for merchants and not just more work,” says Cohane.

Financial incentives may be needed, too. Cohane helped introduce EMV cards in the United Kingdom and Ireland in his previous position with processor Elavon. “Adoption was slow until there was an interchange incentive,” says Cohane. Once that financial incentive was in place, he adds, most of the POS systems were converted within a year.

Here in the U.S., Cohane believes it will eventually be necessary to have interchange incentives for merchants along with expense sharing to retrofit POS systems at big retailers, an operation that can cost tens of thousands of dollars. “The liability shift alone will not be enough to trigger mass adoption,” he says.

Cohane estimates that the shared costs between Veracity and its merchant clients for EMV adoption will range from $5 million to $7 million. For its part, Veracity will have to certify terminals, update platforms, produce new merchant guides, modify dispute procedures, train customer-service reps, and assist merchants, along with other functions.

Certain disincentives could also help speed adoption. “You can educate merchants forever, but until they have a negative event, it’s hard for them to understand,” says Freeman at Merchant Data Systems. He likens the situation to compliance with PCI standards. A retailer that has a breach and faces network fines understands why it needs to be PCI-compliant. Shazam’s Dooley expects new penalties to be introduced for acquirers and merchants that are not EMV-compliant.

While financial institutions slowly ramp up efforts to issue smart cards, consumer adoption could ultimately decide the pace of use. Veracity’s Cohane, who watched the EMV rollout in the U.K. and Ireland, thinks the implementation here will happen in phases. The first task is to get the cards in people’s hands. But consumers will need some education about the value of chip cards.

First Data’s Morea says, “It’s important to focus on consumers and to get them to let go of the swipe.” Merchant Warehouse’s Castrechini agrees, but thinks it will take more than encouragement. “If people are not forced to use EMV, they will fall back on old habits,” he says.