Clear2Pay Exhibitor Workshop, Cartes 2013 Paris Nord Villepinte

1. So you want to be an EMV
Issuer….
Or how to launch a cards program – from
idea to implementation in easy steps
Clarity in Payments © 2013

2. Clear2Pay – Clarity in Payments
Clear2Pay is a payments moderniser
that actively supports financial institutions globally to meet
their payments unification goals across the entire payment value chain
Innovation
Payments
Testing
Consulting
Equipping payments facilitators with the knowledge and technology
that allow them to embrace the New Reality
Acquire
Anything
Clarity in Payments ©2013
Process
Anyway
Clear
Anywhere
View
Anytime
www.clear2pay.com
2

3. Thanks to living by our core values, Clear2Pay is the financial services
partner of choice for Banks and Corporates alike
Banks
Integrity
Clarity in Payments ©2013
Corporates
Quality
Together
Corporates
No Nonsense
www.clear2pay.com
3

4. In Europe we’ve had EMV Smart Cars for a while
now
Clarity in Payments ©2013
www.clear2pay.com
4

5. But seriously, let’s start with some definitions…
 EMV (Europay, MasterCard, Visa) is a group of specifications
for payment infrastructure using Chip cards – the specifications
cover messages, card profiles, card & terminal technology, and
applications – so an EMV card is a card that adheres to this
 A Chip card (or smart card, EMV card, ICC, ‘Chip and PIN’
card, stored value card, contact card…) is a plastic card with a
computer chip embedded in it that communicates with the
outside world through a visible contact plate that looks a little
like this:
 A Contactless card (or NFC card, ‘tap and go’ card…) is a
plastic card with a computer chip embedded in it that
communicates with the outside world through an
embedded antenna that is not visible:
 A Dual Interface card combines both of these interfaces into a
single card – so the embedded chip has both a contact plate and
antenna
Clarity in Payments ©2013
www.clear2pay.com
5

6. A Chip card is to Magstripe as Vinyl is to an iPod!
 Fixed content
 Passive
 Limited Data
 One Size Fits All
 Flexible content
 Active
 High Capacity
 Fully Configurable
Clarity in Payments ©2013
www.clear2pay.com
6

7. How does a Chip transaction work?
Check the Card is Genuine
Clarity in Payments ©2013
Introduce the Cardholder
Work Together to make a
Decision
www.clear2pay.com
7

8. All this already happens in Magstripe cards, but using physical
interaction rather than electronic
Hologram
Special Character
Check the person presenting
the card is the real cardholder
Authorization
Online
Clarity in Payments ©2013
Check the card
is genuine, and from
a real issuer
Online PIN
Signature
Decide if the payment
can be authorized
PAYMENT
AUTHORIZED
www.clear2pay.com
8

9. Alongside new features, Chip cards retain the recognizable
features of their predecessors to remain backwards compatible
Program
Brand
Issuer
EMV Chip
Hologram
Primary
Account
Number
(PAN)
Acceptance
Brand
including
Issuer BIN
Cardholder
Name
Physical
Issuer
Product
Information
Expiry Date
Magnetic
Stripe
Signature
Strip
CVx2 Code
Clarity in Payments ©2013
www.clear2pay.com
9

10. This means that a Dual Interface cards can be physically read in
four different ways (no contactless on plain chip card)
Clarity in Payments ©2013
www.clear2pay.com
10

11. Because of larger capacity, Chip cards can hold much more
information
 Magnetic Stripes have 3 tracks of data, typically they look like this:
–
%B1234567890123445^PADILLA/L. ^99011200000000000000**XXX******?*
–
–
;1234567890123445=99011200XXXX00000000?*
;011234567890123445=724724100000000000030300XXXX040400099010=************************==1=00000000000000
00?*
 Chip cards can hold much more data, including secure keys, and detailed risk &
behavioral parameters:
–
Clarity in Payments ©2013
CardID="53XXX82940116278" SequenceNumber="000" ExpiryDate="20140930“ Emboss_1
Value="3533303520353832392034303131203632373820202020202020202020202020 Emboss_2
Value="2020202020202020202020202030392F31342020A02020202020202020202020 Emboss_3
Value="554E4B4E4F574E20554E4B4E4F574E2020202020202020202020202020202020 Emboss_4
Value="2020202020202020202020202020202020202020202020202020202020202020 Emboss_5 Value="3632373820363435
Iso_Track_1 Value="B5305582940116278^CARDHOLDER/JIM
^1409221482690000000000739000000 Iso_Track_2
Value="530XXXX940116278=14092214826907390000 Address_1
Value="4D5220554E4B4E4F574E20554E4B4E4F574E2020202020202020202020202020202020 Address_2
Value="2020202020202020202020202020202020202020202020202020202020202020202020 Address_3
Value="2020202020202020202020202020202020202020202020202020202020202020202020 Address_4
Value="554E4B4E4F574E20202020202020202020202020202020202020202020202020202020 Address_5
Value="2020202020202020202020202020202020202020202020202020202020202020202020 Address_6
Value="422D3020554E4B4E4F574E202020202020202020202020202020202020202020202020 Address_7
Value="42454C4749554D20202020202020202020202020202020202020202020202020202020 Ref_ext Value="000/0000/00707
Layout_crt Value="000000000707 <EMVData><AID Value="524F4F545F4D46"><Item Tag="9F17" Value="03" Length="01"
Name=""/><Item Tag="" Value="8BEAA9B4A38FD30F" Length="08" Name="PIN"/><Item Tag="" Value="FFFFFF"
Length="03" Name="Pin Checksum"/></AID><AID Value="A0000000041010"><Item Tag="9F0D" Value="B050AC0800"
Length="05" Name=""/><Item Tag="9F0E" Value="0000000000" Length="05" Name=""/><Item Tag="9F0F"
Value="BC70BCF800" Length="05" Name=""/><Item Tag="9F42" Value="0978" Length="02" Name=""/><Item Tag="50"
Value="4D617374657243617264" Length="0A" Name=""/><Item Tag="57"
Value="530XXXX940116278D14092214826907540000F" Length="13" Name=""/><Item Tag="5F20" Value="554E4B4E4F574E"
Length="07" Name=""/><Item Tag="5F24" Value="140930" Length="03" Name=""/>…
www.clear2pay.com
11

12. Before you Issue, You need to know Who you are
Clarity in Payments ©2013
www.clear2pay.com
12

13. In a standard 4-box model the Issuer role can be split into four
distinct ‘jobs’ – each of which can be performed by the same or
different players.
Authorisation, Clearing, Settlement
Card
Manufacturer
and Perso
Issuer
Processor
BIN
Owner
License
Scheme
Acquirer
Card Programme
Manager
These could be the same
entity or multiple entities
Cardholder
Merchant
Issuer
Issuer
Physical Issuer
BIN Owner
• Promotes and delivers the product
proposition to the consumer
• Manages the product and is the ‘public
face’ of the product
• Performs identification of the
cardholder
• Manages the prefunded accounts and
associated processes –
loading, spending and unloading
• Manages the transactional interface
with the scheme
• Manages personalisation and despatch
of the physical cards upon request of
the issuer
• Initiates account opening at the issuer
processor
• Owns the license and brand relationship
with the scheme
• Takes financial settlement risk
(guarantor) with the scheme
• Typically a bank or PSD-compliant
payment institution (in EU)
Clarity in Payments ©2013
www.clear2pay.com
13

14. In markets like the US, this can be even more complex
•
•
•
•
•
•
•
•
•
ISSUING SIDE
Loyalty
Brand Management
Reporting
Token Validation
Authorization
Clearing & Settlement
Documentation
Card file generation
Type certificate
ACQUIRER SIDE
Bank License
Holder
Bank License
Holder
Scheme
• Card Lifecycle
Management
• Statementing / Billing
Processor
Card
Marketing
Card
Manufacturer
& Personalizer
Cardholder
Clarity in Payments ©2013
Processor
Fulfilment and
Delivery
Merchant /
Bank Branch
• Incoming Request
Processing
• Outgoing Response
• Advices
• Presentment
• Documentation
Handling
• Fraud Management
• Arbitration
• Hot List
• Reporting
• Own Application
• Loyalty
HD ISO
Value Added
ISO
Merchant
Original
Equipment
Manufacturer
www.clear2pay.com
14

15. To be a BIN owner, you need a license
Clarity in Payments ©2013
www.clear2pay.com
15

16. What is a BIN Owner, Scheme Member and BID/ICA? How are
these different?

Every direct member of one of these schemes is issued one or more unique IIN/BINs and a range within which PANs can be
generated for their cards (BIN Range) – they are consequently the BIN Owner.

Direct members of MasterCard and Visa are known as Principal members. They communicate directly with the scheme and
are financially responsible for transactions on any card within their BIN.

All members of MasterCard/Visa are also allocated a scheme identifier ICA (MC) or BID (Visa). It is this number that is used
in correspondence with the scheme. bpost already has both of these identifiers through its affiliate acquiring licenses.

Affiliate members of MasterCard/Visa can only communicate with the scheme through their Principal member. They receive
notifications and transaction data from, and pay fees to, the Principal, not the scheme.
PRINCIPAL
4912 2456 7890 0001
57 7890 8999
4912 2556 7890 0001
AFFILIATE
SPONSORED
57 7890 8999
57 7890 9999
Clarity in Payments ©2013
57 7890 9999
www.clear2pay.com
16

17. This is the transactional pie – it isn’t huge
Clarity in Payments ©2013
www.clear2pay.com
17

18. How the pie is split for a €100 transaction
Under
PSD2, this will
reduce to 0.2%
or 20¢
0,9%
I/C
6,4¢
Trx fee
0,6%
Mark-up
2,2%
MSC
€0,90
€0,064
€0,60
Under
PSD2, this will
probably not
reduce
€2,20
0,65%
Scheme
Fee
Cost
Revenue
Pays:
• Annual card fee
• Usage fees
Pays:
Pays:
• Program costs
• Not applicable
• Scheme membership
• Transaction + scheme
fees
• Internal cost
Gets:
• Cardholder
benefits
Gets:
Gets:
Gets:
• Interchange
• Setup and usage • Acquirer markup
revenue
(transaction/volum • Margin on terminals
• Cardholder card fee
e) fees
• Set up and
• Interest revenue
• Maintenance fee
certification fees
• Value added
services
Clarity in Payments ©2013
Pays:
• Card scheme fee
applicable
• Interchange fee
• Merchant
recruitment costs
and support
€0,65
Pays:
• Merchant Service
Charge
• Terminal costs
• Setup costs
Pays:
• Marketing support
for members
• Network
infrastructure
Gets:
• Acceptance of
additional
payment methods
Gets:
• Scheme fees
• Processing fees
• VAS fees
www.clear2pay.com
18

19. Once you know your role, you must also look at which operating
model to choose as this will directly impact time to market
Make vs. Buy
Insource vs. Outsource
Direct vs. Branch
Clarity in Payments ©2013
www.clear2pay.com
19

20. It is possible to fully outsource operations, but it creates the
need for interfaces – these represent the stakeholders that need
to be managed during an RFP process
Merchant
Web, POS, ATM
Acquirer
Scheme
Outsourced
Issuer
Processor
Finance &
Treasury
Clarity in Payments ©2013
Card
Management
System
IVR
Bank website/
eBanking
Teller system
Outsourced
Card Issuer
Back office
Call centre
AML & Fraud
systems
www.clear2pay.com
20

21. Regardless of model, cards issuance becomes a major program
within any institution
Steering Committee
Program
Manager
ICT Project
Manager
ICT
Business
Organisation
/ Governance
/ Processes
3rd party
management
Clarity in Payments ©2013
Compliance
and Legal
Logistics
and Physical
distribution
Commercial
integration
•Products
•Segments
•Customer
relationship
management
Cards
Issuance
•Product
definition
•Personalsation
•Certification
ICT: Platform
integration
ICT:
Financial
integration
ICT: Testing
www.clear2pay.com
21

22. Our proven Vendor selection and RFP methodology
Clear2Pay has extensive experience in evaluation and selection of IT infrastructures for
card & payment systems and can efficiently evaluate and provide decision support
Vendor selection and RFP methodology
Data collection and analysis
1
Analysis and
scope definition
• Define functional and
non- functional scope
• Define cost scope
• Define procurement
requirements and
constraints
• Establish initial target list
of vendors
• Define general selection
method
• Approve selection scope
Selection and negotiation
Selection criteria
and screening
vendors
2
• Prepare and conduct RFI
process
• Collect vendor info and
evaluate
• Establish legal framework
• Score RFI answers, product
demos and reference visits
• Selection of qualified/
approved vendors
• Approve short list
• Scheduling of all activities
3
Prepare and
conduct RFP
• Develop RFP document
• Prepare evaluation criteria
with weighting and scoring
• Distribute RFP, review, and
evaluate responses
• Organise vendor
presentation meetings
• Organize resulting Q&A
sessions
• Organise product demo
• Receive updated proposals
4
Implementation
Vendor
selection
5
• Review and score proposals
and vendor/product
capabilities
• Prepare financial analysis
and fact based negotiation
cases
• Prepare and conduct
negotiations for key issues
• Document results and
prepare recommendation
• Approve final ranking
• Inform vendors
Document management
Conclude
contract
• Prepare implementation
plan
• Finalise contract
negotiation
• Approve and sign
contract
• Finalize KPI’s, SLAs and
agree on
tariffs, fees, supply
models, licensing
schemes, etc.
• Prepare project initiation
document
Deliverables
Project management - communication, reporting, escalation
• Scope document, high
level requirements
(business, technical and
functional)
• Vendor landscape report
• Initial target list of vendors
Clarity in Payments ©2013
•
•
•
•
Vendor selection approach
Pre-screened vendors list
RFI document
NDAs
• RFP document
• Vendor evaluation
scorecard
• RFP Response Evaluation
• Cost/benefit analysis
• Vendor proposal
• Vendor evaluation report
• Signed contractual
agreement
• Finalised implementation
plan
• Project initiation document
• Risk Management Plan
www.clear2pay.com
22

23. Pick a card, any card
Clarity in Payments ©2013
www.clear2pay.com
23

24. Example: Debit card issuance – selecting a debit brand
Selecting your debit brand is about maximising the customer experience while ensuring that you also get the closest fit to
your bank requirements
10
9
8
Functionality
7
6
5
4
3
2
1
0
0
2
4
6
8
10
12
Acceptance
Size of bubble indicates relative cost of issuing the brand
Clarity in Payments ©2013
www.clear2pay.com
24

25. Example: Viable Debit card brands in the Belgian Market
Card
Bancontact/
MisterCash
Maestro
Pros
• Incumbent brand with high
acceptance
• Well known by consumers
• Cost ‘subsidised’ by local
market
• Currently cobrand on cards
so customer visibility is
high
• Supported by MasterCard
in Waterloo
• Very high acceptance level
• Runs on standard
infrastructure so multiple
vendors possible
• New LVP interchange tier
Cons
• Expensive single choice for
processing
• International acceptance
requires cobrand
• Slow development
• eCommerce acceptance
only in Belgium
Future
• Undergoing SEPA
transformation – EMV
cards and opening acquirer
market
• Mobile project slowly
ongoing
Debit MasterCard
VPay
Visa Debit
• Higher interchange level
for issuer than Maestro
• Greater international
acceptance than Maestro
• Europe-only electronic
brand
• Issuance already in
neighbouring markets
• Visa anxious to launch the
brand in Belgium
• Acceptance as wide as
Maestro
• Traditional debit brand
well accepted globally
• Runs on credit rails so very
high acceptance in all
channels
• Supports offline
acceptance
• eCommerce acceptance
only in Belgium
• PIN change only possible at
Citi ATMs
• Requires direct
membership to issue
• 1/3 acceptance at Colruyt
• Product recognition low in
Belgium – Credit brand
perception
• No other issuers, vendor
support low
• Zero acceptance at Colruyt
• Low product support at
MasterCard
• First issuer in Belgium
would need to overcome
unknown obstacles
• No PIN change support
• 1/3 acceptance at Colruyt
• No acceptance outside
Europe
• Credit perception of the
brand
• VPay is preferred by Visa
• Zero acceptance at Colruyt
• Ongoing projects to
improve the product
including deals with
Amazon and big online
retailers
• Due to Durbin now being
promoted as preferred
debit brand for the US
market
• Uncertain in Europe as EU
war on interchange could
kill the product
• Will likely become the first
chip-only card so
magstripe fraud becomes
impossible
• Strong support from Visa
for product development
including mobile
• Has strong mobile support
and will likely become a
key component of the US
rollout thus driving new
technology adoption.
Brand Mark
Clarity in Payments ©2013
www.clear2pay.com
25

26. Once you have your scheme/brand, you need to create
your card
Clarity in Payments ©2013
www.clear2pay.com
26

27. Building your card for issuance includes parallel processes
Card Program Name
Card Parameters
Card Type Definition
Program Scope
Card Profile Definition
Application Definition
Test Keys
Card Image File
Card Structure
Live Keys
Test Card
Clarity in Payments ©2013
Card Sample Production
Card Personalization Validation Certificate
Card Design Approval
www.clear2pay.com
28

28. Card design is a process that involves communications and
operations. Physical proofs need to be created by the physical
issuer and certified by the scheme before manufacturing can start
• The card design process takes approximately 4-7 weeks depending on
the number of iterations required for to satisfy the scheme and obtain
certification
• Card design includes communication of the program name to scheme.
• Each individual card design needs to be submitted for approval – even
small changes require approval.
• Consideration should be given to limiting the number of physical card
designs submitted to keep initial investment costs to a minimum.
Clarity in Payments ©2013
www.clear2pay.com
29

29. The card pack is a sales and information distribution tool, but
pricing will be a key factor in selecting the format
• The card pack can be anything from a folded piece of paper
right through to custom metal boxes or clamshell blister
packs. The cost per item is a sensitivity of the business case.
• The basic function of the card pack is to protect the card in
the retail environment, allow it to be displayed and to
contain all of the elements and information required to use
the product once purchased
• Card packaging is not certified and so can be done later than
other components.
Clarity in Payments ©2013
www.clear2pay.com
30

30. The parameters stored on an EMV card are many and varied
Standard Data
•
•
•
•
•
•
•
•
•
Account Number
Country Code
Currency Code
Effective Date
Expiration Date
Cardholder Name
Issuer Country Code
Language
Geographic
limitation for usage
Security
•
•
•
•
•
•
•
•
Cardholder verification
method
Certification Authority
Public Key Index
Cryptogram Version
Number
Data Authentication Code
(for offline Card
Authentication Method)
PIN Encipherment Private
Key
ICC Private Keys and
Certificates (for Dynamic
Data Authentication)
PIN try limit
Offline plaintext PIN
verification supported or
not
Credit Risk
•
•
•
•
•
•
•
•
Clarity in Payments ©2013
Issuer Action Code default (Issuers
conditions to reject a transaction
even if the transaction has been
approved online –e.g. terminal
problems, etc.)
Consecutive Offline Limit
Cumulative Offline Transaction
Amount
Non domestic Control Factor
(reduce all limits for international
transactions)
Previous Transaction History
Last Online Transaction Counter
(for card velocity checking = after a
certain number of offline
transactions the next transaction
shall proceed online)
Consecutive Transaction Counter
International Limit
Available Offline Spend Amount
www.clear2pay.com
31

31. You need to make Authorization host changes or define
services with your processor
Clarity in Payments ©2013
www.clear2pay.com
32

32. And now the testing times begin…
Clarity in Payments ©2013
www.clear2pay.com
33

33. The test plan is also multi tier (Example)
07/11
14/11
21/11
28/11
05/12
E2E live part I
12/12
19/12
26/12
02/01
09/01 16/01
UAT
Syst & Int
23/01
30/01 06/02 13/02
E2E live part II
ICT E2E test
06/01
GO/NO GO
UAT
UAT & Live testing:
Processor - Syst & Int.
Processor to support and monitor
Perso file for 10000 live cards
Manufacturer - Personalization
MC MC 1st
CPV E2ED
MC production
MC 2nd
E2ED
CVC3 OBS validation
Fulfillment
Delivery first batch of live
cards
setup
MC Live
BIN and ICA
Clarity in Payments ©2013
www.clear2pay.com
34

34. Clear2Pay is your end-to-end supplier
 Comprehensive consulting solutions at all stages
of your issuance project
– Strategy, Business Case & Planning, RFP
management, Certification support, Test Management
 Full EMV training for Managers, Marketers and
all of your technical staff
 A complete range of testing solutions for
cards, hosts and all infrastructure
 A world-leading solution for Chargeback
management and automation
Clarity in Payments ©2013
www.clear2pay.com
35

35. Headquarters
Brussels, Belgium
info@clear2pay.com
www.clear2pay.com
Clarity in Payments © 2013