April 2012
Contents Introduction 03 Questions to Ask Your 04 EMV Level 2 Kernel Provider EMV Kernel Range 06 About Creditcall 07 02 creditcall.com
EMV Kernel Provider Introduction Contents One of the most common decisions faced by payment terminal or ATM manufacturers is whether to develop in house or buy in the technology of this critical component. Those who decide to buy a Kernel from an EMV * Level 2 Kernel supplier often do so because they require a quicker route to market, have limited EMV knowledge and expertise or do not wish to risk high upfront cost of developing a solution in house. Combine this with testing and the formal EMVCo certification process, the majority of companies decide to buy in a solution rather than develop it. An EMV Level 2 Kernel is a critical element of the EMV chip technology standard, and decisions on which supplier to choose should be based not simply on the initial development cost alone. Purchasing an EMV Kernel for a payment device is not a one-off technology purchase and should be considered more of a long term investment. As the EMVCo standards continually evolve, future code maintenance, re-certification and support will be required and should be considered during the initial purchasing evaluation in order to reduce risk and eliminate any unexpected future cost. This whitepaper provides a list of questions payment device manufacturers and integrators need to consider when outsourcing an EMV Kernel project to a third party, highlighting pitfalls, risks and hidden cost. * EMV is a trademark owned by EMVCo LLC. An EMV Level 2 Kernel is a critical element of the EMV chip technology standard... creditcall.com 03
Questions to Ask Your EMV Level 2 Kernel When researching the most suitable Kernel, price should not be the only purchasing criteria. Anyone considering purchasing a Kernel from a third party needs to ensure the Kernel will be maintained and supported for the foreseeable future. The following 10 questions should be directed to every Kernel supplier when looking for the best solution: How many years has the 1 company been in business? Purchasing a Kernel is not a one off activity. It is important to choose an established development partner with a proven track record of success in maintaining compliance with the evolving EMVCo specifications and a demonstrable capability in providing code updates and support. Creditcall was incorporated in 1996 and is a financially stable, growing company with two main focuses; the first is EMV Kernel technology (since 2002) and the second, payment processing (since 1997). The company has a global reach, operating in Europe, the USA and Canada. 2 How financially strong is the company? As the EMVCo standards change, significant resources need to be put into both R&D, in order to maintain compliance with the standard, and into costly EMVCo test tools. Any development partner must show more than token commitment to maintaining their EMV Level 2 Kernels. Creditcall has maintained financial stability even through the current economic climate and has no debt. This has been realised through prudent financial management and a worldwide customer base. Creditcall is also a PCI DSS Level 1 Certified payment gateway which provides another diverse revenue stream, again on a global basis. In short, Creditcall is not dependant on a single source of revenue. 3 How many years has the 4 company been developing and maintaining their EMV Level 2 Kernel? The EMVCo technical standards are vastly complex and continue to become more so. Maintaining a detailed understanding of these standards requires not only a highly qualified development team but one with years of experience within the world of transaction processing. To get a project to market quickly and avoid costly delays, only a developer with proven track record should be selected. Creditcall first developed an EMV Level 2 Kernel in 2001 which was commercialised in 2002. Since then, the core Kernel has been updated to support every new version of the EMV Level 2 standard including minor and major changes or those detailed in the many EMVCo bulletins. This has built up 30 man years of real world experience within its EMV team. This means when we embark upon a customer s EMV project we can get straight into the development and integration process without wasting time on research and learning, saving the customer time and money. How many different platforms does the company s Kernel support? With numerous operating systems and processors in use in terminals today, one EMV Kernel cannot fit all. However manufacturers often have to make their application work across a range of hardware platforms to stay competitive. Creditcall s EMV Kernel range includes products for all common platforms including Windows, Windows CE and Java. ANSI C contact and contactless versions complete the picture allowing EMV acceptance on virtually any embedded platform. In short, there is no other company that can offer the same level of platform coverage. 04 creditcall.com
100% first time EMVCo certification pass track record 10 Questions to Ask Your Are EMVCo pre-certification 5 testing services provided or included? An EMV Kernel supplier should use the same test tools as the EMVCo certification laboratory before submitting the Kernel for EMVCo certification. This will increase the likelihood of your Kernel passing the formal EMVCo Certification first time, ensuring your project remains within budget and on time. Creditcall use the same test tools as the EMVCo certification laboratories and to date has a 100% first time pass track record. As pre-certification testing is an iterative process where we normally identify issues, our EMV team can often help you pin point what the issues are and suggest suitable remedies or workarounds. 6 Does the company have an excellent relationship with an EMVCo approved test laboratory? Payment devices that incorporate an EMV Level 2 Kernel come in all shapes and sizes from battery powered handheld PIN pads, different types of PoS terminals, right through to floor standing ATMs and ticketing machines. In order to minimise cost, delay and additional complexity the relationship with the EMVCo approved test laboratory is critical. Over the last 10 years, Creditcall has built a trusted relationship with TÜV Product Service, less than 2 hours from its development centre. TÜV is an internationally renowned testing, qualification and consultancy, and work with Creditcall to maximise efficiency in all aspects of the certification process, whilst ensuring every detail of the standard is met. Creditcall offers a service where an EMV Engineer accompanies the equipment to the laboratory to set it up and answer any questions, in addition to assisting the laboratory tester with the more difficult tests. How many products has the 7 Kernel been integrated into? Every EMV Kernel certification is different and the number of separate products a Kernel supplier has successfully certified their Kernel with is a measure of their breadth of experience and expertise. Creditcall has successfully undertaken over 100 separate certifications in terminals as diverse as simple PIN pads, ATMs, handheld devices, mobile phones and Windows based ticketing devices. 8 Do they manage the EMVCo certification on your behalf? A Kernel provider should manage the EMVCo certification process on behalf of the customer. The EMVCo certification process is often complex and requires that the supplier liaises with EMVCo test laboratory and EMVCo. Creditcall offers a managed EMVCo certification which means all aspects of the certification are managed, we will even provide links to documentation that needs to be completed and advise when EMVCo requires payment. Do they offer a source code 9 escrow service? For absolute certainty in the maintenance of a critical software component such an EMV Kernel, software escrow can be requested as part of the licensing agreement, such that in the event of the supplier closing down through bankruptcy the source code can be released to the licensee. Creditcall views the request for escrow as the customer s prerogative, and will fully cooperate with any such arrangement. For peace of mind, Creditcall uses the well-respected NCC Group for such agreements. 10 Has their EMV Kernel really been developed from the ground up with embedded platforms in mind? Many Kernel providers developed their Kernel on larger PC based environments where processor and memory constraints (both flash and dynamic) are less of an issue. Creditcall developed EMV.LIB and Contactless.LIB specifically for embedded environments with limited memory, processor speed, stack and other resources that are taken for granted in PC based environments. Our embedded products have been used on the most challenging embedded environments from Z180 based systems with 32K of memory to ARM based platforms with less than 256K of memory. Creditcall pioneered the concept of a hardware abstraction layer in relation to EMV Kernels enabling the Kernel to be compiled for virtually any environment with a C compiler. creditcall.com 05
EMV Kernel Range With numerous operating systems and processors in use in terminals today, one Kernel cannot fit all. We provide a range of Kernels to match the architecture of the terminal exactly. EmvX Windows & Windows CE EMV.LIB Embedded Systems EmvJ Java Contactless.LIB Operating Systems/ Platform Supported Development Languages Windows 95/XP/7, Windows CE Any language that supports Windows COM interfaces or.net (e.g. C++, C#, Visual Basic) Any platform that has a C compiler Any Java Virtual Machine C, C++ Java C, C++ Any platform that has a C compiler Library Format Windows.DLL using COM interface Depends on the toolset available (e.g. object files or static library).jar package Depends on the toolset available (e.g. object files or static library) Advantages Easy to use, handles platform specific functionality automatically Fully ANSI-C compliant and completely Hardware independent, custombuilt for each target platform Easily portable to any Java platform Fully ANSI-C compliant and completely Hardware independent, custombuilt for each target platform Ideally Suited For Retail and kiosk payment applications running on Windows NFC enabled devices & embedded platforms with limited resources and custom hardware Java-based payment applications andserver-based solution NFC enabled devices & embedded platforms with limited resources and custom hardware 06 creditcall.com
About Creditcall Creditcall makes card acceptance simple from any device, anywhere. Whether attended, unattended, online or mobile payments, our award-winning EMV-ready payment gateway and EMV Migration solutions are at the very heart of our clients businesses, ensuring payments flow all day, every day. Founded in 1996 and with over 14 years of EMV experience, Creditcall has a proven track record in providing payment gateway services and offers EMV Migration solutions that are tried and tested. Our EMV Migration solution, ChipDNA, is a rapid EMV Migration SDK for Windows, Linux, ios and Android. It greatly helps ISVs transition from older magnetic stripe technology to EMV and Chip technology. ChipDNA is the easiest and most cost effective way of adding EMV payment functionality into an attended or unattended Point of Sale (POS) application. mpos EMV Migration We were the first EMV-ready Payment Gateway in the U.S., and completed our EMV certification in April 2014. Our Chip-based EMV Level 1 and EMV Level 2 Kernel software is used globally in contact and contactless environments such as ATMs, mpos, card readers, PINpads and other POS devices. We are the first EMV-compliant mpos solution to allow businesses accept Chip and PIN cards on the go via smartphones and tablets. Millions of users and billions of transactions depend on Creditcall EMV technology each and every day. Creditcall works collaboratively with companies across Europe, North and South America, South Africa and Asia-Pacific to deliver business-critical payment solutions. Clients include ATOS, DHL, Elavon, Hilton Hotels & Resorts, Toyota, Wayne (a GE Company) and Westfield. Creditcall The Heart of Payments. POS Transport Vending ATM Mobile & Online Parking Ticketing 07 creditcall.com
Regional Offices Creditcall Europe Merchants House North, Wapping Road, Bristol, BS1 4RW, United Kingdom T: +44 (0)117 930 4455 F: +44 (0)117 930 4477 E: hello@creditcall.com W: www.creditcall.com Registered No: 3295353. VAT Registered No: 713 0076 80. Creditcall North America 1133 Broadway, Suite 706, New York, NY 10010, USA T: +1 (800) 868 1832 F: +1 (212) 300 8006 E: hello@creditcall.com W: www.creditcall.com