EMV Delivery of Mobile, Parking and Unattended Payments Elavon
Elavon-At-A-Glance Elavon s primary business model is growth through partnerships; more than 1,500 Financial Institution partners serving over 20,000 branches Wholly owned subsidiary of U.S. Bank Every day, more than 1.3 million customers trust us to efficiently and securely manage their payments business Global Customers United States: 900,000 Europe: 250,000+ Mexico: 50,000+ Brazil: 30,000+ We extend end-to-end payment solutions, flexible connectivity and effective fraud monitoring tools to customers and partners around the globe Customer and partners are attracted to our robust and secure international processing platform Elavon drives growth for our customers and partners by enabling commerce. 2
About Elavon Our Acquiring Solutions Footprint 3
Evolution of Payments and Point-of-Sale Yesterday Today
EMV and Mobile API and Gateway Acquirer/Processor 5
EMV, Parking and Unattended Payments API and Gateway Acquirer/Processor 6
Checklist for EMV EMV Hardware Solution with Level 1 Certifications Payment Application with Level 2 Certifications on EMV Hardware Solution SDK for Integration on Mobile Device Mobile or Platform OS Application Gateway, Platform or End Point Acquiring/Processing Scale Holistic Reporting and Reconciliation Security and P2PE 7
Key Considerations for EMV Security Flexibility Time to Market Scalability 8
9 Thank You!
Implementing EMV in Canada Lessons Learned Mike Hughes Manager, North American Strategic Partners March 18, 2014 Michael.Hughes@Moneris.com
About Moneris Largest electronic payment processor in Canada, 6th largest in North America Joint venture between RBC Royal Bank and BMO Bank of Montreal (including Harris Bank), processing more than 3 billion credit and debit transactions annually As the largest North American processor of EMV transactions, Moneris supports 350,000 merchant locations in Canada with more than 95% EMV enablement Leader in payments processing in the retail, B2B, education, restaurant, travel and entertainment, government, and services industries Full product range with sophisticated customization capabilities 2
Canadian EMV Migration Staggered brand introduction of EMV and technology mandates increased the development and implementation effort and created confusion for consumers Stand Alone Devices Currently 98% EMV Enabled Canada is a hardware rental market - upgrades are easier to control Applications self contained and don t bring the challenges of integrated solutions Integrators underestimated the required development effort Most complex solutions can take 2 years from initiation of project to roll out Intermediate complexity 12 to 18 months - Low complexity 6 to 12 months By 2012, 75% of integrated devices were EMV enabled Currently 95% EMV Enabled Hospitality and Petroleum were exceptions, momentum started in 2010. Cost of upgrade and pay-at-table technology presented challenges delaying migration Introduction of PED resident payment application solutions significantly reduced integration complexity and effort 3
Certification Requirements EMVCo sets the Standards, but it is the Brands who determine what, and how, these standards are Implemented. Layers Management Functions Certification Entity Level 1 - Physical Level 2 - Software (Kernel) PED Payment Application Protocols between the chip card and the PED EMV application selection, EMV command set, and the EMV transaction steps EMV command/response mgmt., encryption, communication protocols EMVCo EMVCo Acquirer on behalf of brands 4
Typical EMV Development Activities Component Summary of change Is this required for implementation of a new card brand? EMV Kernel Changes Native Device App Changes Acquirer System Changes POS Application Changes Middleware Changes Merchant Host / Switch Changes Support new requirements by scheme or new EMV options Support New Requirements for a Scheme. Extensive: Switch, back end settlement, dispute, financial and reporting systems Significant: Application, user interface, receipts, communications, support for new EMV parameters Significant: New network and business functionality in a Register application that interfaces to a POS payment device Communication message formats, transaction routing, and possible new communications links. Usually Depending on the complexity of the scheme Frequently - Depending on the POS device software Always - required for support of new card brand Always - required for support of new card brand Always required for integrated systems Always - required for support of new card brand 5
Who makes the changes and how long? Component Timeline Standalone (Moneris owned) Integrated (Moneris owned) Integrated (Merchant owned) EMV Kernel Changes Acquirer System Changes 12-24 Mos. (Once Per Brand) 18 Mos. (Once Per Brand) POS Vendor POS Vendor POS Vendor Moneris Moneris Moneris POS Application Changes: PED App, Middleware, Merchant Host 6-12 Mos. (Once Per Brand Per Terminal) Moneris Moneris Merchant s POS Merchant s POS Software provider KEY Moneris Responsibility Merchant Responsibility POS Vendor 6
Using P2PE with EMV: Reducing PCI DSS Scope Integrated EMV Omni-Channel Devices P2PE manages all aspects of the transaction requiring clear-text account data (e.g., BIN lookup for card brand identification, PIN block generation, etc.), and P2PE prevents the release of clear-text account data into the merchant s environment (the merchant only receives truncated or encrypted account data), thus The edge of the PED becomes the boundary of the merchant s Cardholder Data Environment (CDE) Boundary of Cardholder Data Environment (CDE) Merchant Store System and Concentrating Switch/Host Moneris Acquiring PCI DSS Compliant Secure Environment Secure PED with POSPAD app Insecure ECR / Kiosk Insecure Store Controller Merchant Host Moneris P2PE Decryption Gateway Acquiring Switch 7
Why Do It? : EMV Dispute Impacts Visa Intl. Liability Shift Oct 31 st 2010 V/MC Domestic Liability Shift Mar 31 st 2011 AFD Liability Shift Mar 31 st 2012 8
Things to keep in mind Understand the Challenge Technology Change Business Change Behavioral / Operational Change Do It Once / Inter-Brand Harmonization 80/20 Rule Commitment New Roles for Acquirers