ATM COMMITTEE. Canadian Lessons Learned Bruce Renard, Execuive Director The National ATM Council, Inc. General Implementation Issues. - Canada had 3-4 years to implement EMV & manufacturers were forced on the front end by the banks/Interact to rewrite the software
Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.
Canadian Lessons Learned
Bruce Renard, Execuive Director
The National ATM Council, Inc.
-Canada had 3-4 years to implement EMV & manufacturers were forced on the front end by the banks/Interact to rewrite the software
-Announcement of EMV implementation came @ end of 2008 – time from software availability (10-09) until 100% compliance (12-31-12) = 3 years – Liability shift phase in began 12-10
-A phased deadline for set % of providers’ machines to be in compliance was provided in Canada (50% - 100% benchmarks)
-Timing specifics were somewhat vague – when the details were finalized & announced – very little time to get the work done
-It is important for ATM providers to promptly press their manufacturers for certified hardware/software solutions
-“Touch” in Canada (= NFC ) has a $100 limit– then cardholder needs to reenter PIN
– enabling Touch feature is optional for ATM operator in Canada
-Need to determine what will be different for EMV standards/handling as between Canadian and the US
-Need a widespread/open ISO communication pipeline to disseminate info on EMV related issues/fixes
-Given all the different networks/banks/processors in the US – vs. the simplified structure in Canada—we have out work cut out for us
-All networks must be coordinated for card standards/timing/software certification/etc. or the problems will be significant
-All manufacturers/models must be certified & approved by the Processors to work on all the networks – how do we make certain this is accomplished within the applicable liability shift deadlines?
-Reconciling liability shifts with hardware/software solutions throughout the food chain is critical
- Must have certification across the board – then allow adequate time for software and EMV compliant machines to be shipped – & then allow adequate time for installation of new hardware/software before broad liability shift occurs
-Screen graphics from manufactures informing customers of different procedures with EMV are not intuitive – the changed user experience requires clear instruction/education = Insert your card & do not remove it until after you’ve entered your PIN
–Providers needed to redo their screen graphics vs. using what was provided by the manufacturer – major consumer learning curve
-Removing card too early on some hardware will damage the card reader
-One should consider placing physical signage at the machine location telling users to leave card in until after PIN is entered
-Need for ATM manufactures to provide EMV compliant terminals and upgrade kits/parts/software/etc. ASAP, including: disclosure of the software version & compatibility/interoperability (by model)
-If Pin Pads are PCI compliant these should work in an EMV environment (need to confirm with manufacturer)
-In Canada PCI pin pad standards are still in place & must be maintained (rationale: EMV relates to the card reader vs. the pin pad –however as a practical matter EMV affects pin pads & bezel) --- -Buffer size on non PCI compliant pin pad to small to handle EMV
-Security packets with EMV can become very large and potentially service affecting depending on software
-Need to implement high speed internet communications connection – or machines become too slow (90second transaction time with traditional wireline – TDM wireless a bit better – IP wireless still better) (analogy for older non IP connections = like running your brand new laptop off a dial up connection = slow) (get ATMs on high speed access - or you will get blamed & lose the account)
-Card readers: Some EMV readers have had high failure rates – as high as 50%; need to have a good solid card reader
-Static will cause the card to get stuck & no money to be dispensed – problem: machines are not well grounded – this was a huge issue – hardware is available to address this – mother board – ‘reset board’ provided free for some EMV card readers
-ATMs must be well grounded – with a chip machine power is critical – power surge destroys mother board – investigate additional grounding options (add this at same time as EMV upgrade – to avoid making an additional visit)
-Stable Power is very important in an EMV environment. “Clean” power supply devices are worthwhile for best locations ($70-100) / a power tester device will tell you how clean the power is at each location & whether this is an issue (tester costs $500-600)
-Upgrades: some products require laptop to do the download
-Waiting until later in the transition cycle to deploy new EMV compliant machines will avoid another service visit
-The internal “date” on the ATM machine must be correct – or the transaction will be declined with EMV
-Bank ATMs implemented EMV in Canada before IADs
-How will banks handle U.S. card & ATM migration?
-Will mag stripes continue to work throughout the migration period—or will issuers begin denying these at EMV ATMs as an anti-fraud initiative?
-Non-uniform denials of EMV card transactions at non-EMV enabled machines & vice-versa was a real problem for the Canadian transition (“throttling”)
-Will failover to mag stripe work when EMV fails?