Report of Conclusions from the 5th Asian Payment Card Forum Growing the Business: Launching Successful Consumer Payments Products

Transcription

1 On September 2014, The Thai Bankers Association (TBA) and APSCA hosted the 5 th Asian Payment Card Forum for card-issuing and acquiring financial institutions, domestic bank card networks, payment systems and central banks. The theme of the forum Growing the Business: Launching Successful Consumer Payments Products highlighted important decisions for payment card issuers and acquirers as they face significant changes that affect the future of the consumer payments business. Key topics discussed included developments taking place in tokenisation, HCE, NFC mobile payments and more! Among the 255 delegates who attended were over 115 senior bankers from 24 banks as well as experts from 6 payment service provider companies, 3 domestic switches in SEA and senior decision-makers from Visa, MasterCard, China UnionPay and American Express! Distribution of Attendees at the 5 th Asian Payment Card Forum September 2014, Bangkok Following are the more than 70 conclusions from the forum presentations and discussions: According to EMVCo figures, there are now 2.3Bn EMV Cards and 36.9M EMV Terminals deployed around the world. The adoption rate of EMV cards in Asia Pacific is only 17.4%. The adoption rate of EMV accepting terminals in all regions except USA is over 70%, with Africa and the Middle East (86.3%) exceeding Asia Pacific (71.7%). EMVCo s most important announcement was about their development of globally interoperable specifications for tokenisation of payment card data. The adoption of tokenisation will become the most important development in the consumer payments industry since the introduction of chip technology 30 years ago. Tokenisation is the foundation of a new approach to devaluing payment card data that will enable new ways to address and manage payment card fraud across a variety of channels. This new approach to devaluing payment card data and managing fraud will enable innovative new ways to pay that do not easily fit into the EMV chip-based model. APSCA th Asian Payment Card Forum Conclusions Page 1 of 6

2 Tokenisation includes non-payment tokens, used for data protection in merchant-related business operations other than payments, and tokens used in payments processing. Limiting the use of a payment token by device, merchant, transaction type or channel offers additional ways to devalue data used in consumer payment transactions. Payment tokenisation requires a Token Service Provider to convert between primary account numbers (PANs) at issuers, and payment tokens used in payment processing. In theory various organisations could act as the Token Service Provider (TSP). In practice today the role is so far only played by the major international payment card schemes. TSPs are in a position to manage payment transaction data and potentially earn revenue from tokenisation services. Payment schemes have moved quickly to become the leading TSPs. Payment card tokenisation schemes launched by the major payment card brands, to support HCE and Apple Pay etc., are based on their own proprietary specifications. Tokenisation includes new data fields for more transaction information, identifying and verifying consumers before generating tokens and restrictions on where payment tokens can be used. Payment tokens are used to generate token cryptograms that include additional transaction data, particularly single-use or limited-use keys that create a transaction-unique value. The simplicity of tokenisation, together with devaluing data, supports a wide range of consumer payment models including chip, proximity, cloud-based payments, BLE and QR codes. EMVCo continues to assess new mobile technologies and their implications for contactless mobile payments, including HCE, BLE and embedded secure elements. EMVCo also continues to assess the emerging mobile point-of-sale (mpos) market, industry requirements and best practices related to PCI Security Standards. A key priority of the EMVCo Next Generation specification is alignment of existing payment system contactless terminal specifications into a common framework. The EMVCo Next Generation specification is intended to converge disparate contactless technologies, optimise terminal implementations and evolve payment technologies. EMVCo s migration plan towards Next Generation forecasts completion of the specification by 2016 and initial sunsetting of legacy contact/contactless cards by Smart card and chip vendors are focused on facilitating rapid migration to dual-interface cards as contactless issuance and usage ramps up. APSCA th Asian Payment Card Forum Conclusions Page 2 of 6

3 As certified secure Flash replaces the use of Mask ROM for chip production, lead times will reduce thereby accelerating the supply chain for EMV chip cards. New ways to manufacture dual-interface cards, such as inductive coupling to replace antenna connections, will also reduce lead times and improve card reliability. Asia continues to see a (gradual) migration away from signature towards PIN CVM with a general preference for online PIN with less support for off-line PIN. The cost of a PIN CVM migration mandate can be significant - Malaysian banks will need to reissue around 70 million domestic and international cards that currently use signature CVM. Estimates of POS terminal upgrades in Malaysia are that around 380,000 EFTPOS terminals will need to be upgraded, in addition to infrastructure and backend system upgrades. In addition to customer education about PIN, banks will also need to provide PIN change facilities, at branches, online and remotely at ATM machines. An overarching trend is that consumer payments stakeholders (schemes, banks, PSPs) want customers to be able to make payments the same way through multiple channels/devices. The same trend means that consumer payments stakeholders would ideally like all payment channels and devices to connect to a single payment product with one (their) brand. Scheme and issuers see this strategy as being able to support multiple, scalable payment technologies as they emerge, while maintaining a consistent customer experience. The success of contactless payment cards in Australia illustrates their popularity with consumers and their ability to create a solid business and value proposition for merchants. The success of contactless payment cards for low value payments is the solution to displacing cash on the long-term, and an important prerequisite for NFC mobile contactless payments. Australia has created the blueprint for success with contactless payments: prioritise large supermarkets, service stations and fast food restaurants to achieve critical mass. Flagship merchants are critical to sell contactless payments to customers with promotions, campaigns and trained staff educating customers to pay with contactless. In Australia Coles is now processing 11M contactless transactions per month across the group and 79% of MasterCard and Visa transactions are contactless. The phenomenal growth of contactless payment card transactions in Australia means that the majority of Coles transactions are now tendered with payment cards instead of cash. Despite a major success with contactless payment cards, Coles took small steps towards mobile contactless payments: a small pilot, contactless payment tags, integration with loyalty. APSCA th Asian Payment Card Forum Conclusions Page 3 of 6

4 Australia is an exception; World Bank studies show only 5/6 countries process over 50% of transactions through non-cash channels (majority of Asian markets well below 12%). Asian regulators are increasingly taking significant steps to solve business model and infrastructure challenges in order to accelerate the growth of domestic e-payments. Regulator priorities include reducing the cost of e-payments to merchants and consumers, business models to support low transaction value, and financial inclusion. Asia is likely to see more national schemes competing with both international schemes and emerging payment options, to grow domestic transactions (eg India). Although UnionPay is the largest card brand by cards issued (3.7Bn) and second-largest by transactional volume (US$5.7Tn), driving card acceptance is still a priority in China. South Korea is the global benchmark for card acceptance. In 2014, BCcard had the 3rd highest number of acceptance locations after global brands Visa/MasterCard and Discover/Diners. South Korean government policies including income tax rebates for consumers, VAT credits for merchants, lottery promotions, etc resulted in the world s highest payment card usage. Card acceptance and usage in South Korea were assisted by an unusual efficient and unique VANbased domestic transaction switching so that most transactions are on-us. BCcard may be Asia s only payment service provider that is a card scheme, brand, issuer, acquirer, processor, switch and also supports both 3-party and 4-party models. The Trusted Service Manager (TSM), intended to simplify data connections between NFC stakeholders, unfortunately often results in complex practical and commercial issues. Service providers often prefer to have their own service provider or issuer TSMs while MNOs end up having their own root TSMs with complex interconnections and agreements. Ultimately the commercial agreements for costs of renting space on secure elements (SE), larger SIMs, TSM service agreements, have proved the most challenging. Host Card Emulation (HCE) addresses this challenge by moving the secure element (SE) to the cloud (typically the bank s data center) while the MNO reverts to becoming just a carrier. Without the SE an alternative approach to security based on devaluing data is required, using tokenisation, limited/single use keys (LUK/SUK) created from a Unique Derived Key (UDK). When a card is tokenised, the token service provider returns a tokenised PAN and tokenised Unique Derived Key (UDK) which the issuer stores in their cloud data center. APSCA th Asian Payment Card Forum Conclusions Page 4 of 6

5 Payment tokens consisting of tokenised PAN, LUK/SUK etc are pushed to the mobile phone and combined with transaction data into a cryptogram token at the time of payment. Payment schemes consider the security regime for HCE and cloud-based payments to be adequate and Visa, MasterCard and AMEX have now all released their own HCE specifications. Apple Pay stores the tokenised PAN and tokenised UDK in the iphone6 SE, instead of in the issuer s cloud, so that payment tokens do not need to be pushed OTA to the mobile device. Apple Pay has revived interest in the SE for NFC mobile payments but Apple s level of control and removal of the MNO would be difficult for other organisations to replicate. While there is industry talk of hybrid HCE/SE models for NFC mobile payments, questions remain as to whether there is a commercial business case (other than for SE manufacturers). HCE-based NFC mobile payments stands up to traditional security threat modelling (against the SE) because under HCE there are no valuable assets stored in the mobile device. The Trusted Execution Environment (TEE) in most mobile phones might serve as an MNO-free secure element but TEE standardisation for NFC mobile payments has some way to go. The commercial practicalities of how to provision and manage the TEE have not yet been addressed and could be similar to those encountered with removable SE form factors. The advent of payment card tokenisation, together with devaluing payment card data, may have effectively signalled the beginning of the end of the payment card era. Today the number of payment service providers is exploding. Many of them are mobile-focused and offer new ways to pay that do not involve an EMV chip. In the forum presentations both Visa speakers and the MasterCard speaker highlighted the plasticto-digital trend and the increasing variety of payment techniques and form factors. HCE s layered approach to security using tokenisation, limited use keys, transaction-specific data, device fingerprinting and data analytics could be adopted for other payment techniques. Security of consumer payments is always a consumer priority; the new approach to devaluing data in consumer payments aims to make sure that there is (almost) nothing for fraudsters to steal. The objective of the payment card schemes is to provide their member banks with digital wallet infrastructures (issuer-branded) and all-channel digital acceptance networks. A key component of this offer to member banks is a solution to secure payment card details across all devices on all channels in the payment card scheme network. The card scheme view is that eventually customer payment card account numbers will only be visible on physical cards and will be replaced everywhere else by value-less tokens. APSCA th Asian Payment Card Forum Conclusions Page 5 of 6

6 With data devaluation, card schemes now see CNP and digital payments as an opportunity (rather than the problem it was) to secure digital payment transactions across the ecosystem. The card schemes are offering their member banks on-behalf-of card-on-file, digital wallet, tokenisation and ID and verification services that do not wrap the issuer s brand. Banks will be able to use these services to digitise (card-on-file) and tokenise customer payment cards so that they can be used at the POS, in-app and online. The payment card schemes are also likely to offer the same services to enable wallet solutions from other major digital players, as they have done with Apple Pay. With MNOs facing challenges from HCE and Apple Pay a more realistic approach to the consumer payments business might be to set up an e-payments company such as TrueMoney. TrueMoney, part of the True communications conglomerate (including Thailand s third-largest MNO), targets underserved segments that include digital consumers and the under banked. The True Money digital wallet can be loaded with multiple sources of funds and then used for online digital payments on mobile devices and PCs, P2P payments and bill payments. To enable under banked customers to pay at card-accepting merchants a True Money MasterCard is offered for retail payments with a virtual version of the card for online payments. APSCA th Asian Payment Card Forum Conclusions Page 6 of 6