Building the Foundation for Mobile Payments at the Point-of-Sale Prepared by the CPA February 2011

Transcription

1 Enhancing the CPA s Framework for PIN-less POS Debit Payments Building the Foundation for Mobile Payments at the Point-of-Sale Prepared by the CPA February 2011

2 Contents Copyright 2011 Canadian Elgin Street, Ottawa, Ontario K2P 2K3 Executive Summary 1 I. Background 2 II. Purpose of the Review 3 III. Consultation 3 IV. Facilitating Emerging Payment Products 4 1. Gap in the Contactless POS Debit Marketplace 4 2. CPA Rule Issues 6 3. Implications for the Marketplace 6 V. Example of a Real-Time Authorization with Delayed Posting 7 VI. Shared Responsibility Model 8 VII. Proposed Updates to Rule E4 Requirements 9 1. High-Level Requirements of the Existing Rule E4 Framework 9 2. Proposed Updates to Rule E Increased Flexibility for Authorizing PIN-less POS Payments Recommendation Rationale Implications of E4 Amendments Receipting Recommendation Rationale 12 VIII. Concluding Remarks 13 Appendices 14 APPENDIX I 14 APPENDIX II 15 APPENDIX III 16

3 Executive Summary In reviewing the blueprint of other countries that have successfully launched Near Field Communication (NFC) mobile products for the Point-of-Sale (POS) channel, the Canadian (CPA) found that a key success factor was the establishment of contactless payments for environments where convenience and speed of throughput is essential. Today, both credit and prepaid products can offer the functionalities of contactless best suited for this market. The CPA has a mandate to facilitate the development of new payment methods and technologies. Pursuant to this mandate and as a means of being responsive to market needs, the CPA is looking to provide POS scheme operators with the flexible environment they require to offer competitive debit products with the same speed and convenience that the market has come to expect. The CPA s Rule E4 for PIN-less POS payments provides the framework for contactless debit payments made at the point-of-sale. The framework may also be used to facilitate contact PIN-less POS payments. On the basis of its review, the CPA has identified two areas where CPA rules could be enhanced to enable a broader array of POS debit payment products (in certain environments, e.g. transit), namely: i. CPA Rule E4 currently requires that each POS transaction be authorized on-line and in real-time by the Payor FI. a. This requirement does not permit the use of any alternative type of real-time authorization for POS Debit Payments (e.g. terminal based authorization, whereby the Payor FI s authorization is provided at the time of sale via the chip embedded in the POS device; consequently, immediate online delivery of data to the Payor FI for the purposes of authorization would not be required at the time of the transaction); and b. Where delivery of data (for reconciliation and settlement) to the Payor FI is not immediate, neither will the posting of the transaction to the customer s account. ii. CPA Rule E4 requires that the merchant have the ability to issue to the Payor a PIN-less POS scheme receipt 1 upon request. This is a challenge particularly for certain environments where printing is not practical or rapid throughput is critical. Note: There is no corresponding requirement to provide scheme receipts for traditional PIN-based POS debit payments in Rule E1. As such, the CPA is seeking feedback on its proposal to amend Rule E4, Exchange of PIN-less POS Debit Payment Items for the Purpose of Clearing and Settlement, to (i) amend the requirements of the rule for authorization to enable a broader array of POS debit products, and (ii) provide a more flexible approach for ensuring that the payor is made aware of the value of a transaction. In assessing these issues, key considerations for the CPA include: Determining whether some of the rule requirements are necessary when considering the CPA s duty to promote the safety, soundness and efficiency of the payments system and take into account the interests of users; and Leveraging a shared responsibility model, whereby the CPA distinguishes its role & responsibilities from others in the payment system, e.g. scheme-operators, members and/or government. 1 The PIN-less POS receipt is not the sales receipt, but rather the accompanying POS receipt provided by the scheme operator. Sales receipts, which may be used for accounting, taxes, returns and other purposes, are not addressed in the CPA s rules. 1

4 Background Contactless NFC Pilots Strong Industry Collaboration Mass Transit NFC Capable Dominant NFC Standard & Strategy Pursued Commercial NFC Products Successful End-User Adoption Japan S. Korea Singapore UK France China Turkey US Canada Australia International research on countries developing Near- Field Communications (NFC) payments reveals an international blueprint for mobile payment made at the Point-of-Sale (POS) using a mobile device to initiate a payment, such as tap, to a POS reader. The technology behind mobile POS payments, NFC, leverages the use of contactless technology, with an additional layer of standards to enable richer device interaction and enhanced security. International experience has shown that the first step in NFC development is fostering a diverse contactless payment ecosystem. Robust contactless payment adoption is facilitated by offering contactless payments in environments that fully capitalize on contactless technology s potential for speed and convenience such as mass transit and highway toll fares in dense urban areas. These payment environments require rapid throughput of transactions and a wide use of readers that logistically cannot be authorized online 2 (a constraint that significantly slows down throughput). Because NFC builds on contactless technology, the more flexibility that is provided for increased use of contactless payments notably in the mass transit environment, the better the prospects become for future NFC mobile payments. The CPA s Rule E4 for PIN-less POS payments provides a framework for contactless debit payments made at the point-of-sale in Canada. The framework may also be used to facilitate contact PIN-less POS payments. In modernizing its rule to allow for a broader array of PIN-less POS payments, the CPA is taking a step towards laying the foundation for potential mobile payments in the POS channel. 2 Where a data transmission and return message are delivered to/from the Payor FI for the purposes of authorization at the time of sale 2

5 II. Purpose of the Review The CPA has a mandate to facilitate the development of new payment methods and technologies. Pursuant to this mandate and as a means of being responsive to market needs, the CPA is looking to provide POS scheme operators and other stakeholders with the flexibility they require to enable a broader array of chipbased PIN-less POS debit payment products under CPA Rule E4 3, namely: Allow for alternative authorization methods to support the use of various processes for real-time authorization for PIN-less POS Debit Payments; & Provide more flexibility for ensuring that a payor is made aware of the value of a transaction in order to address challenges in certain environments where the provision of receipts is not practical or rapid throughput is critical. Scope The focus of this consultation paper is on chip-based PIN-less POS debit transactions, as addressed in CPA Rule E4; these payments are made in the retail (i.e. non-virtual) environment using a CPA Member-i ssued payment device or application (e.g. bank card, key fob, cellular phone, etc.) that results in a debit to the Payor s account held at a CPA Member financial institution (FI). For the purposes of these payment items, real-time authorization of each transaction by the Payor FI is required. Authentication of the customer is not required under CPA Rule E4. 3 CPA Rule E4 Exchange of PIN-less Point-of-Service Debit Payment Items for the Purpose of Clearing and Settlement III. Consultation A key ingredient in developing the rules applicable to the clearing and settlement of payments is the CPA s effort to consult with members and various stakeholders during their development, particularly when dealing with new payment methods and technologies such as mobile payments. Over the summer of 2010, the CPA conducted preliminary discussions with 16 key players in the mobile and POS Debit payments industries. Consultation participants represented a cross-section of the industry including FIs, consumer groups, merchants, a POS scheme operator, mobile payment scheme operators, and a telecom security consultant. Throughout the fall, the CPA worked with its members and targeted stakeholders to develop enhancements to CPA Rule E4 to facilitate new functionalities of the contactless POS debit environment. A policy framework document and draft rule amendments have been developed for broad public consultation in Q For remote mobile payments (e.g. phone to phone payments), the CPA felt that no immediate action was needed as it remains uncertain whether mobile payment types will emerge that will clear and settle via its systems and thus require supporting rules. As such, this work has been deferred to June 2011 to focus on the more immediate priorities of the POS channel. 3

6 IV. Facilitating Emerging Payment Products 1. Gap in the Contactless POS Debit 4 Marketplace benefits of contactless products cardholder/consumer benefits Move faster through checkout lines More convenient no need to deal with change or carry cash All transactions will be on banking statement helps with tracking and budgeting Optional participation merchant benefits Increased throughput at the point of sale Reduce lost sales Improve customer experience Reduce cash handling costs Good funds model irrevocability 4 Contactless POS debit payments that clear and settle via the CPA s Automated Clearing Settlement System (ACSS) fall under CPA Rule E4. Rule E4 also facilitates contact PIN-less POS debit payments. 4

7 IV. Facilitating Emerging Payment Products (cont.) Contactless debit products enhance the utility of the POS channel, but further opportunities remain. Under current CPA rules, POS debit products cannot be processed unlike their credit and pre-paid counterparts at many generally low-value, unattended or cash-based locations, including: transit Delays in online approvals & scheme receipts may prevent the speed of throughput desired for transit parking Machines may not have the ability to be systematically online 24/7 vending machine Machines may not have the ability to be systematically online 24/7, nor do they currently provide scheme receipts home delivery airlines highway tolls Salesperson may not always have access to an online channel when traveling to different locations for home deliveries For on-board flight purchases (e.g. food and beverages), airlines may not have access to an online channel Machines may not have the ability to be systematically online 24/7, nor do they currently provide scheme receipts The use of POS Debit payments is not ubiquitous in Canada. In some environments Canadians may use other means of payments (e.g. credit, prepaid, or cash) because current POS debit requirements do not allow merchants to provide the same speed and convenience as other card based payment products. For example: Delays in online approvals and scheme receipts may prevent the speed of throughput desired for transit; It may be impractical for certain POS terminals to be online all the time; and/or Certain environments may preclude terminals from having access to an online channel. The CPA has a mandate to facilitate the development of new payment methods and technologies. Pursuant to this mandate and as a means of being responsive to market needs, the CPA is looking to provide POS scheme operators with the flexible environment they require to offer competitive debit products with the same speed and convenience that the market has come to expect. 5

8 IV. Facilitating Emerging Payment Products (cont.) 2. CPA Rule Issues 3. Implications for the Marketplace The CPA s Rule E4 for PIN-less POS payments provides the framework for contactless debit payments made at the point-of-sale. The framework may also be used to facilitate contact POS payments. On the basis of its review, the CPA has identified two areas where CPA Rule E4 could be enhanced to enable a broader array of PIN-less POS debit payments in certain environments, namely: i. Allow for alternative authorization methods CPA Rule E4 currently requires that each POS transaction be authorized on-line and in realtime by the Payor FI. This requirement does not permit the use of any alternative type of real-time authorization for POS Debit Payments (e.g. terminal based authorization, whereby the Payor FI s authorization is provided at the time of sale via the chip embedded in the POS device; consequently, immediate online delivery of data to the Payor FI for the purposes of authorization would not be required at the time of the transaction). ii. Provide more flexibility for ensuring that a payor is made aware of the value of a transaction CPA Rule E4 requires that the merchant have the ability to issue to the Payor a PIN-less POS scheme receipt 5 upon request. This is a challenge particularly for certain environments where printing is not practical or rapid throughput is important. Note: There is no corresponding requirement to provide scheme receipts for traditional PIN-based POS debit payments in Rule E1. k k Delayed posting of transactions Permitting the use of alternative authorization methods means that where an online method is not used (i.e. immediate online delivery of payment data to the Payor FI for the purposes of processing), posting of the transaction to the customer s account may be delayed. Based on feedback, the CPA understands that for the majority of environments where terminal-based authorization may occur (e.g. transit, vending machines, parking, and highway tolls), transactions would generally be posted to customers account on the day of the transaction subject to the time of the payment. Understandably, merchants will be motivated to send transaction certificates through the Scheme Operator s network in order to effect settlement of transactions as soon as possible. Nevertheless, for certain offline environments (e.g. purchasing food on-board an airline abroad via a Canadian POS terminal), an extended period of time to download and process the payment may be required, possibly extending to the following business day. Lost or stolen POS device Amending the authorization procedure of POS debit payments exposes payors (e.g. consumers) and payees (e.g. merchants) to no additional risk (above and beyond those identified in the development of a framework for PIN-less POS debit payments) should a POS device be lost or stolen. POS scheme rules look to mitigate consumer liability. For example, Interac offers consumers a zero liability protection in the case of unauthorized use of a POS device. For payees (e.g. merchants), the POS transactions are irrevocable once authorized. 5 The PIN-less POS receipt is not the sales receipt, but rather the accompanying POS receipt provided by the scheme operator. Sales receipts, which may be used for accounting, taxes, returns and other purposes, are not addressed in the CPA s rules. 6

9 V. Example of Real-Time Authorization with Delayed Posting authorization The transaction is authorized between the chip-based POS device & the terminal. payor merchant/ acceptor 1. A consumer makes a purchase at a merchant using a chip-based POS device (e.g. a debit card, token, fob, or mobile phone) and the merchant s POS terminal. The terminal validates the customer s payment application (e.g. EMV standard compliant chip or industry equivalent) and authorizes the transaction based on an interaction between the device and the terminal that assesses the requested payment against the conditions of use established by the Payor s FI (Direct Clearer A). If all the conditions of the Payor FI are met (e.g. value limit, frequency of usage, etc.), the transaction is approved and payment is completed. processing to payor s account Later, when connected online, the transaction certificate is sent to the Issuer (the Payor s FI) for posting. merchant/ acceptor merchant acquirer (Direct Clearer B) connection service provider scheme operator connection service provider payor s account (Direct Clearer A) cpa clearing & settlement direct clearer b ACSS Settlement at the Bank of Canada direct clearer a 2. The terminal sends individual transaction certificates to the Merchant Acquirer FI on a daily or multi-daily basis for processing and posting. 3. The Merchant Acquirer FI routes the information (through Connection Service Providers and the Scheme Operator) on to the Payor s FI (Direct Clearer A). 4. Direct Clearer A, which holds the customer s account, receives the file and debits the Payor s account. 5. At a later stage, the Merchant Acquirer FI provides funds to the Merchant for the value of transactions. 6. As a result of this payment exchange, the Merchant Acquirer s FI (Direct Clearer B) is owed funds by the customer s FI (Direct Clearer A). To effect settlement, Direct Clearer B creates ACSS deliveries against Direct Clearer A for all the POS debits that it has originated to Direct Clearer B that day. This transaction is rolled into the overall multilateral ACSS balance for the day, and the settlement accounts of the Direct Clearers held at the Bank of Canada are adjusted accordingly. 7

10 VI. Shared Responsibility Model The introduction of innovative products and services has opened the payments landscape to an array of new players (other than deposit-taking financial institutions). As such, the CPA s clearing and settlement systems do not operate in a silo; its rules should be read in conjunction with other bodies rules and regulations addressing the payments marketplace. In the POS environment, the CPA already leverages a shared responsibility model, whereby other rules and regulation exist in the form of the Government s Codes, scheme operators rules, and FI contractual agreements. In the development of its Rules, the CPA must distinguish its role and responsibilities and thus those elements that will be included in its Rules from others in the payment system, e.g. Scheme Operators, Government and Members. k Government: Establish Codes and Regulations (where appropriate) to address specific public policy objectives (e.g. consumer protection and the preservation of a competitive marketplace). Example of Codes and Regulation include: CANAdIAN COde OF PrACTICe FOr CONSUMer debit CArd ServICeS COde OF CONdUCT FOr The CredIT ANd debit CArd INdUSTry IN CANAdA k k k Canadian Establish a common framework of rules that govern the daily clearing and settlement of POS payments between member financial institutions. The rules: Ensure safety, soundness, and efficiency of payment systems Take into consideration interest of users Determine eligibility criteria of payment items entered into the ACSS for clearing and settlement Scheme Operator Establish a common set of procedural rules that govern the origination, validation, and potentially the exchange of POS payments between Issuers and Acquirers over Scheme Operators network(s). Financial institutions Through account agreements and other contractual agreements with customers, merchants and other parties, FIs establish the framework of voluntary arrangements that define and promote individual responsibilities and rights with respect to payment products/services (e.g. overdraft limits, credit limits, fees, etc.) Examples of how a shared responsibility model is already in place to facilitate PIN-less POS debit payments in Canada may be seen in Appendix I. PAyMeNT CArd NeTWOrK ACT 8

11 VII. Proposed Updates to Rule E4 Requirements 1. High-Level Requirements of the Existing Rule E4 Framework Rule E4 already establishes a framework for the eligibility of PINless POS debit transaction into the CPA s Automated Clearing and Settlement System (ACSS), as well as the clearing and settlement of these transactions. In enhancing the rule to enable a broader array of POS debit payment products that clear and settle through the CPA, only two areas would require changes at this time: (i) (ii) Amending the online requirement, and Removing the receipting requirements. An overview of the Rule E4 s existing requirements, listed above, is attached as Appendix II. device ISSUANCe FOrM FACTOr NeUTrAlITy SeCUrITy PrIvACy & CONFIdeNTIAlITy data INTegrITy PAyMeNT APPlICATION validation disclosure (TerMS, ABIlITy TO OPT IN/OUT, dispute resolution registration OF ACqUIrer WITh The SCheMe COMPlIANCe WITh CPA BylAWS & rules ensuring 3rd PArTy COM- PlIANCe WITh CPA erule FrAMeWOrK CONSUMer redress/refund AUdIT TrAIl & TrACKINg IrrevOCABIlITy real-time AUThOrIzATION ONlINe requirement receipting 9 ChANgeS Needed

12 IV. Facilitating Emerging Payment Products (cont.) 2. Proposed Updates to Rule E4 2.1 Increased Flexibility for Authorizing PIN-less POS Payments Recommendation The requirement in Rule E4 that each POS transaction must be authorized on-line by the Payor Financial Institution (FI) does not permit the use of any alternative type of real-time POS Debit Payments (e.g. terminal based authorization, whereby a payment may be authorized based on the criteria programmed into the EMV or industry equivalent chip). As such, the CPA is recommending amending the existing requirements for authorization in the rule to provide for greater flexibility for POS debit products Rationale k Market Need Various members and stakeholders have suggested that for payments performed in unattended environments (e.g. vending machines, parking meters) or in environments where speed of throughput is crucial (e.g. transit) an online authorization process is impractical and at times not feasible. EMV standards for terminal based authorization of transactions have already been adopted successfully in the credit card and pre-paid environments thus offering opportunities for speed and convenience to merchants. The CPA seeks to provide POS scheme operators with the flexibility to offer debit products with the same speed and convenience that the market expects, while maintaining safety and soundness. k EMV Chip technology In 2007, an industry-wide migration to chip technology allowed for enhanced security of transactions. The move to a chip technology that is based on EMV standards 6 also enabled new functionalities for the POS environment; today both authentication (where appropriate) and authorization of a POS debit payment may be performed securely using only the encrypted data stored on the microchip embedded in the debit product. k Authorization In today s online environment, the Payor FI authorizes a payment based on the data it receives online at the time of the transaction. With chip technology and the EMV contactless standards (or industry equivalent), authorization may be performed securely by way of a pre-standing authorization embedded in the chip set by the Payor FI. The characteristics of a particular prestanding authorization would be determined in advance of a transaction by the Payor FI. k Pay/No Pay Decision According to the CPA s rules, the pay/no pay decision rests with the Payor FI. In today s online environment, the Payor FI makes this decision based on a set of proprietary criteria once data has been transmitted to it from the terminal at the time of sale. In the future, where terminal based authorization 7 is permitted, the Payor FI will continue to make the pay/no pay decision based on the authorization criteria it embeds into the EMV chip (or industry equivalent) of a PIN-less POS device. In this regard, simply altering the operational process does not remove an FI s ability to set the criteria by which it makes the pay/no pay decision. 6 EMV chip standards are an internationally accepted series of procedures and specifications to ensure interoperability and acceptance of chip-based payment applications on a world-wide basis. 7 The terminal validates the customer s payment application (e.g. EMV standard compliant chip) and authorizes the transaction based on an interaction between the device and the terminal that assesses the requested payment against the conditions of use established by the Payor s FI (e.g. value limit, frequency of usage, etc.). k Irrevocability As payments continue to be authorized at the point-ofsale, all POS debit transactions processed through the CPA s ACSS would remain irrevocable a hallmark of the POS channel. k Payor FI Liability In developing the CPA s rules, a guiding principle is that risk should be borne by the party best able to mitigate it. As the criteria for the pre-standing authorization programmed into the EMV chip (or industry equivalent) would be determined by the Payor FI (e.g. amount/ transaction limits, availability of overdraft facilities, etc.), the Payor FI would continue to bear the liability for the transaction conducted on the PIN-less POS device. 10

13 IV. Facilitating Emerging Payment Products (cont.) Implications of E4 Amendments Permitting various processes to authorize a POS debit payment means that where an online method is not used, the funds in the payor s account will not be verified at the time of the sale. Eliminating the online step in the process would facilitate faster transaction processing and would allow consumers to carry less cash. There is, however, a trade-off between the increased speed and convenience customers and merchants will obtain at the checkout and the risk of: k Use of the EMV standard Device validation via the embedded EMV chip (or industry equivalent) will ensure that the POS debit device is authentic and has not been altered since it was issued. k Irrevocability of payments All POS debit payments are irrevocable once authorized. As such, settlement will occur and the payee (e.g. merchants) will receive the funds it is owed. 8 (a) (b) Potential overdraft or moving to a credit balance in the account due to delayed posting of transactions; and/or Unauthorized transactions in the event the device is lost or stolen and not reported promptly. The value of this product is to support the payment needs of low-value payment environments (e.g. transit, vending machines, parking, etc.). The potential exposures per cardholder are expected to remain small, however considerations needs to be given in how to minimize/mitigate these challenges. A number of tools already exist in CPA Rule E4, including: k Payor FI choice The Payor FI has the ability to opt-in/opt-out of offering any POS debit service. k Timeframe for clearing & settlement The timeframes for clearing and settlement of POS transactions require that entries into the Automated Clearing Settlement System (ACSS) be made as soon as possible and no later than the ACSS closing time applicable to the business day following authorization. Accordingly the delay for delivering POS transaction certificates to FIs and posting transactions to a customer s account will be constrained by that requirement. A number of other tools also exist. While these are all valid mitigation tools, it is important to note that the CPA s rules may not be the most appropriate place to encode them; some reside more appropriately within other bodies rules and risk management procedures. These tools include: 8 The irrevocability of POS debit transactions does not preclude the possibility for returns (e.g. in the event of return of merchandise) at the request of the payor via a separate POS credit transaction. k Consumer choice Where the Payor FI opts to offer POS debit services, the Payor FI is responsible for disclosing to the consumer that he/she has the ability to opt-in/opt-out of the service or certain aspects of the POS debit service, as well as any arrangements and implications of the service (e.g. arrangements for and implications of generating a credit balance). k Value/transaction limits At the transaction level, authorization will ensure that payments made using the POS debit device are within the value and/or transaction limits established by the Scheme Operator s rules and within any limits that may be mutually agreed upon between the Payor FI and the consumer. In certain circumstances, the POS device may prompt the transaction to be processed online to authorize amounts exceeding the maximum threshold as well as after a certain number of transactions. k Credit balance The Payor FI may opt to provide customers with overdraft facilities or a line of credit to mitigate the risk of NSF transactions. k Consumer liability POS Scheme Rules look to mitigate consumer liability. For example, Interac offers consumers a zero liability protection for PIN-less POS debit cards. 11

14 IV. Facilitating Emerging Payment Products (cont.) 9 The PIN-less POS scheme receipt is not the sales receipt, but rather the POS receipt provided by the scheme operator. Sales receipts, which may be used for accounting, taxes, returns and other purposes, are not addressed in the CPA s rules. 10 Though the issuance of 2.2 Receipting Recommendation The requirement in Rule E4 that the merchant have the ability to issue to the Payor a PIN-less POS scheme receipt 9 upon request is an obstacle to innovation of this payment service in certain environments. As such, the CPA is recommending removing this requirement and relying on other existing means of attaining transaction information (see Availability of Information section below). scheme receipts could be addressed in CPA Rules, it has been proposed that their availability be dealt with in scheme operators rules, which could tailor requirements to certain markets and monitor compliance more suitably Rationale k Receipts impractical for certain markets Requiring scheme receipts to be made available upon request means that all merchants must have receipt issuance capabilities whether the consumer requests a scheme receipt or not. POS scheme operators have suggested that the universal issuance of scheme receipts is impractical in certain environments as it would either slow-down throughput considerably (e.g. transit turnstiles) or would represent an additional requirement that does not exist today in certain unattended environments (e.g. vending machines). Scheme receipts are not universally required in the credit and pre-paid contactless market today, nor are they a requirement where cash is used. In its consultations with members and stakeholders, the CPA found that most participants believed that the issuance of scheme receipts (whether electronic or paper) should not be a matter dealt with in the CPA s rules as it is not relevant to the clearing and settlement of these payments. 10 CPA rules will however require that the amount of a transaction be made available to consumers before a purchase. k Traditional PIN-Based Environments There is no corresponding requirement to provide scheme receipts for traditional PIN-based POS debit payments in CPA Rule E1. k Availability of transaction information Though scheme receipts may not be required in CPA Rules, information regarding transactions may be made available to customers via other means, e.g.: CPA Rules and Scheme Operators will require merchants to prominently show the amount of a transaction prior to purchase FIs may have transaction information available on bank statements CPA requires Members to maintain an audit trail and tracing capabilities 12

15 VIII. Concluding Remarks As payment innovation continues to emerge, existing CPA Rules sometime create requirements that could have unintended consequences as technology progresses. The CPA has a mandate to facilitate the development of new payment methods and technologies. Pursuant to this mandate and as a means of being responsive to market needs, the CPA is looking to provide POS scheme operators with the flexible framework they require to address stakeholders current and future needs. Further, it is important to recognize that the CPA s clearing and settlement systems do not operate in a silo; its rules should be read in conjunction with others rules and regulations which may best address certain payment criteria. The policy directions put forth in this document have relied upon the input from CPA Member institutions, members of our Stakeholder Advisory Council and other interested stakeholders, and will serve as the basis for updates to CPA Rule E4 for PIN-less POS Debits. To this end, the CPA invites comments on its proposal to implement the following recommendations: Allow for alternative authorization methods to support the use of various processes for real-time authorization for PIN-less POS Debit Payments; and Provide more flexibility for ensuring that a payor is made aware of the value of a transaction in order to address challenges in certain environments where the provision of receipts is not practical or rapid throughput is critical. The consultation period for the policy framework and the draft Rule will conclude on April 15th, All comments/submissions should be directed to the address consultation@cdnpay.ca. 13

16 Appendix I Shared Responsibility Model for PIN-less POS Debits PIN-less POS debit products enhance the utility of the POS channel. Where concerns may arise, various ways already exist to mitigate and/or minimize potential challenges: k Value limits k Transaction limits k Small overdraw amounts permissible k Use of EMV standard and protocols k Consumer choice: Ability to opt in or out of service k FI choice: Ability to opt in or opt out of service k Zero liability protection for consumers k Irrevocability of payments k Limit timeframe for clearing & settlement While these are all valid mitigation tools, it is important to note that the CPA s rules may not be the most appropriate place to encode them; some may reside more appropriately within other bodies rules and risk management procedures. As the CPA looks to facilitate through its rules the clearing and settlement of innovative products in the proximity POS environment, it is important to distinguish the Association s role (from a clearing and settlement perspective) from that of other parties (e.g. government, scheme operators, Member financial institutions) through a shared responsibility model. risk mitigation tools CPA scheme operator payor/issuing fi acquirer fi Value/Transaction (counter) limits may set min/max limits in its rules may set proprietary limits in accordance with scheme operator s rules Small overdraft amounts permissible may provide overdraft facilities to customers Ability to opt in or out rule E4 requires Payor FI to disclose ensures service offers this to members & users yes + disclose to customers Use of EMV standards and protocols for offline payments rule E4 requires EMV chip specs or equivalent technology requires EMV chip specs or equivalent technology issue payment applications that meet EMV specs or equivalent ensures terminals are compatible with EMV specs or equivalent Irrevocability of payments under rule E4, payments are irrevocable under POS scheme rules, payments are irrevocable Consumer zero liability under POS scheme rule, PIN-less and contactless payments offer zero consumer liability Timeframe for clearing & settlement limits clearing and settlement to the close of next business day 14

17 Appendix II Rule E4 s Existing Requirements Though the removal of the online and receipting requirements would provide more flexibility to POS scheme operators who chose to clear and settle their transactions through the CPA, many of Rule E4 s existing requirements would remain unchanged. A highlight of these is provided below: CPA Rule E4 for Contactless PIN-less POS Debit Payments Device Issuance Form factor Security of information & technology Privacy & confidentiality of information Data integrity Authorization Irrevocability Payment application validation Payor FI Disclosure Acquirer FI responsibility & liability Consumer Redress/Refunds Audit trail, Tracing Settlement Payor FI is responsible issuing the payment application, and the cardholder agreement Payor FI must ensure the agreement clearly identifies the Payor FI as the issuer Form factor neutral Contact/Contactless transaction both permitted by the Rule Magnetic stripe technology not permitted EMV Chip Specifications or equivalent technology permitted Each Member shall respect the privacy and confidentiality of Payor, and Acceptor personal and financial information in accordance with applicable Canadian legislation Each Member shall ensure the integrity and authenticity of data Payments authorized in real-time Payments are irrevocable once authorized No customer authentication performed payment application validation only (i.e. the techniques, procedures and processes used by the Acquirer/Scheme to prove the integrity of the POS device and payment application) Payor FI responsible for disclosing to payor: Terms, conditions & risks associated with a PIN-less Debit Product The Payors ability to opt-in or opt-out of the product/service The procedures for dispute resolution outlined in the CPA s Rule Registration the Acquirer with the Scheme Timely investigation of non-compliance with CPA Rules Complying with CPA By-laws and Rules, and ensuring that third parties involved also agree in writing to comply with the same Part C contains the procedures that apply to members if a customer claims that an approved transaction was initiated as a result of fraud or theft Each Member must maintain an audit trail of each transaction for a minimum of 12 months ACSS entries shall be made as soon as possible and no later than the ACSS closing time applicable to the business day following authorization 15

18 Appendix III Glossary of Terms Authentication Authorization Contactless Payments EMV Standards Irrevocable Liability Near Field Communication (NFC) Payments Payment Application PIN-less Point of Sale (POS) POS Device Posting Scheme Operator Scheme Receipt The techniques, procedures, and processes used by a financial institution to verify the identity or the security attributes of a cardholder or other payment device holder (e.g. the use of a personal identification number (PIN) or a secret code). The techniques, procedures & processes used by a financial institution to approve a POS transaction. Based on standard ISO 14443, a contactless payment is executed at the POS by moving a standard compliant chip, located in a payment device (e.g. card, fob, phone, sticker), within a close proximity (but generally without physical contact) to a standard compliant chip reader device. Standards established by Europay, MasterCard and Visa (EMV) that set protocols and hardware requirements designed to minimize the potential for fraudulent activity and the loss of private customer data for POS transactions using payment cards. EMV is often used as general term to describe embedded smart-cards in payment devices that enable secure chip and PIN, PIN-less, and contactless payments. Refers to payments that once authorized, are precluded from being dishonoured, returned or redirected by the financial institution that authorized the payment. Assignment of roles and responsibilities to the relevant parties involved with the stages of a transaction and related processing. An ISO compliant technology that can be used to make contactless payments, or perform two-way communication between devices and readers using ISO NFC is expected to alter future POS purchases through improved merchant and consumer interaction. Software issued by financial institutions, which is embedded on payment devices (e.g. card, fob, phone, or sticker) to initiate payments at the POS. Payments initiated at the POS which take advantage of security measures that do not require users to enter a personal identification number (PIN) or other type of secret code. Makes reference to a physical checkout or payment terminal that has a payment reader that is capable of accepting card payment devices for conducting sales or transactions from user accounts. Also known as Point of Service. Describes payment devices that carry payment applications to initiate payments. Most commonly today these devices are cards, but these devices may also be fobs, phones, stickers, etc. The point in time when transactions are debited or credited to a customer s account and reconciled with their previous balances. National or regional payment networks that allow customers to pay for goods and services or access their funds through Automated Banking Machines (ABMs) and POS terminals across Canada. A POS scheme receipt provided by the scheme operator detailing transaction specific information. The scheme receipt can be in addition to or separate from the merchant-provided sales receipt. Sales receipts, which may be used for accounting, taxes, returns and other purposes, are not addressed in the CPA s rules. 16