Property of the EMV Migration Forum © 2013

ATM COMMITTEE

Canadian Lessons LearnedBruce Renard, Execuive DirectorThe National ATM Council, Inc.

Property of the EMV Migration Forum © 2012

General Implementation Issues-Canada had 3-4 years to implement EMV & manufacturers were forced on the front end by the banks/Interact to rewrite the

software-Announcement of EMV implementation came @ end of 2008 – time from software availability (10-09) until 100%

compliance (12-31-12) = 3 years – Liability shift phase in began 12-10 -A phased deadline for set % of providers’ machines to be in compliance was provided in Canada (50% - 100% benchmarks)-Timing specifics were somewhat vague – when the details were finalized & announced – very little time to get the work

done-It is important for ATM providers to promptly press their manufacturers for certified hardware/software solutions-“Touch” in Canada (= NFC ) has a $100 limit– then cardholder needs to reenter PIN – enabling Touch feature is optional for ATM operator in Canada -Need to determine what will be different for EMV standards/handling as between Canadian and the US-Need a widespread/open ISO communication pipeline to disseminate info on EMV related issues/fixes -Given all the different networks/banks/processors in the US – vs. the simplified structure in Canada—we have out work cut

out for us-All networks must be coordinated for card standards/timing/software certification/etc. or the problems will be significant-All manufacturers/models must be certified & approved by the Processors to work on all the networks – how do we make

certain this is accomplished within the applicable liability shift deadlines? -Reconciling liability shifts with hardware/software solutions throughout the food chain is critical- Must have certification across the board – then allow adequate time for software and EMV compliant machines to be

shipped – & then allow adequate time for installation of new hardware/software before broad liability shift occurs

Property of the EMV Migration Forum © 2012

CUSTOMER EDUCATION-Screen graphics from manufactures informing customers of

different procedures with EMV are not intuitive – the changed user experience requires clear instruction/education = Insert your card & do not remove it until after you’ve entered your PIN

–Providers needed to redo their screen graphics vs. using what was provided by the manufacturer – major consumer learning curve

-Removing card too early on some hardware will damage the card reader

-One should consider placing physical signage at the machine location telling users to leave card in until after PIN is entered

Property of the EMV Migration Forum © 2012

HARWARE/PROGRAMMING/CONNECTIVITY-Need for ATM manufactures to provide EMV compliant terminals and upgrade kits/parts/software/etc. ASAP, including: disclosure of

the software version & compatibility/interoperability (by model) -If Pin Pads are PCI compliant these should work in an EMV environment (need to confirm with manufacturer)-In Canada PCI pin pad standards are still in place & must be maintained (rationale: EMV relates to the card reader vs. the pin pad –

however as a practical matter EMV affects pin pads & bezel) --- -Buffer size on non PCI compliant pin pad to small to handle EMV -Security packets with EMV can become very large and potentially service affecting depending on software-Need to implement high speed internet communications connection – or machines become too slow (90second transaction time with

traditional wireline – TDM wireless a bit better – IP wireless still better) (analogy for older non IP connections = like running your brand new laptop off a dial up connection = slow) (get ATMs on high speed access - or you will get blamed & lose the account)

-Card readers: Some EMV readers have had high failure rates – as high as 50%; need to have a good solid card reader -Static will cause the card to get stuck & no money to be dispensed – problem: machines are not well grounded – this was a huge issue

– hardware is available to address this – mother board – ‘reset board’ provided free for some EMV card readers -ATMs must be well grounded – with a chip machine power is critical – power surge destroys mother board – investigate additional

grounding options (add this at same time as EMV upgrade – to avoid making an additional visit)-Stable Power is very important in an EMV environment. “Clean” power supply devices are worthwhile for best locations ($70-100) / a

power tester device will tell you how clean the power is at each location & whether this is an issue (tester costs $500-600)-Upgrades: some products require laptop to do the download-Waiting until later in the transition cycle to deploy new EMV compliant machines will avoid another service visit -The internal “date” on the ATM machine must be correct – or the transaction will be declined with EMV

Property of the EMV Migration Forum © 2012

BANK/CARD ISSUES

-Bank ATMs implemented EMV in Canada before IADs-How will banks handle U.S. card & ATM migration? -Will mag stripes continue to work throughout the

migration period—or will issuers begin denying these at EMV ATMs as an anti-fraud initiative?

-Non-uniform denials of EMV card transactions at non-EMV enabled machines & vice-versa was a real problem for the Canadian transition (“throttling”)

-Will failover to mag stripe work when EMV fails?