With EMV (EuroPay, MasterCard and Visa) timelines quickly approaching the convenience store and retail petroleum industries, POS system providers, pump providers and merchants are preparing for the October 2015 liability shift for in-store systems and the October 2017 liability shift for automated fuel dispensers. As retailers become acquainted with EMV and the needed system enhancements to support EMV, they soon learn that EMV can be a time-intensive and costly endeavor.
In a traditional configuration, after integrating EMVCo-certified payment peripherals and updating systems to accept and manage EMV transactions, the merchant or vendor will connect to the acquirer or processor’s certification environment, which is linked to the EMV certification test systems for Visa, MasterCard, American Express and Discover. Using an EMVCo-certified Level I and II device, the vendor or merchant will need to run about 120 test transactions for contact EMV and 150 test transactions for EMV contactless to obtain certification.
For a POS system, costs include the first contact-only EMV POS certification fees, plus any fees charged by a processor to support the certification. This does not include the cost of EMV transaction management code development, POS upgrades, installation or other necessary expenditures.
Optimistically, the time frame to code, test and certify for EMV is more than seven and a half months. However, the initial development and certification will likely take longer because there are intricacies in online and offline PIN management that take time to code and test. Also, many parts of this certification process and cost are repeated for each processor and each card brand to which the POS system certifies. To a degree, each POS or AFD configuration must also be repeated. The time frame indicated includes only EMV credit because open questions related to EMV debit haven’t been resolved by the industry.
There’s a Better Way
Fortunately, there is a way to reduce the cost, time and complexity of EMV compliance. While not new, a semi-integrated approach to in-store payment has taken on new value as a solution for EMV acceptance and as a way to reduce PCI scope.
In a traditional POS system configuration, the PIN pad sends the transaction to the POS for authorization and the POS system gets the authorization back from the acquirer or processor. In a traditional configuration, the POS system and merchant are in PCI PA-DSS scope and responsible for EMV certifications. In a semi-integrated configuration, the PIN pad or signature capture/PIN pad receives a prompt from the POS to start payment acceptance, and the PIN pad sends the transaction directly to the acquirer for approval.
The PIN pad receives the authorization response from the acquirer or processor and passes it to the POS system. This configuration takes the POS system out of the payment authorization process. The POS is notified of the transaction, but no cardholder data is sent to the POS.
The value of a semi-integrated configuration for a POS provider and the merchant is immense. When integrating EMV support with acquirers and processors, third parties and merchants incur a high cost per end point to become EMV-certified. The semi-integrated configuration eliminates the need for the POS system to code for support of EMV, as well as the need to certify the POS system to the card brands for EMV. Why? Whether the manufacturer or acquirer wrote the payment application residing on the PIN pad in a semi-integrated configuration, that party is responsible for EMV certification. The POS system will still need to be certified to the acquirer or processor, but the process takes far less time.
Semi-integration also reduces the POS system PCI scope, specifically the PA-DSS scope. When payment services are provided as part of the POS system, the POS system provider incurs a cost to become PCI compliant and to upgrade POS systems to meet card brand mandates. The merchant also benefits from this PA-DSS scope reduction.
In summary, a semi-integrated configuration eliminates costs associated with EMV for a POS supplier and the merchant by making implementing EMV easier and less costly. This approach also greatly reduces the provider’s and the merchant’s PA-DSS scope. Speak with your POS or pump supplier, or acquirer/processor, to learn more about this approach. If they don’t have the answers, you can always contact us.
Members help make our journalism possible. Become a CSP member today and unlock exclusive benefits, including unlimited access to all of our content. Sign up here.