Guidelines on the Implementation of EMV Card Fraud Liability Shift Framework

BANGKO SENTRIL NG} PILIPINAS OFFICE OF THE GOVERNOR ctRcutAR No. s36 Series of 2016 Subject: Guidelines on the lmplementation of EMV Card Fraud Liability Shift Framework The Monetary Board, in its Resolution No. 2304 dated 23 December 2OL6, approved: (i) the amendments to Subsections XL77.7, XL77.9 and Appendix L08 of the Manual of Regulations for Banks (MORB); and (ii) the attached guidelines governing the implementation of EMV Card Fraud Liability Shift Framework (ECFLSF) which is attached to SubsectionXLTT.T of the MORB and related to Appendix 108 of the MORB. Section I - Addition of Appendix 108a to the MORB to provide the general principles and guidelines in the allocation of liability and resolution of disputes on fraudulent transactions arising from counterfeit cards. Section 2 - Amendment of Appendix 108 of the MORB by deleting item I and amending item J to read as follows: l. Updated EMV migrotion plon xxx "All BSls shall support migration to EMV standards. Consequently, all cards issued and card-accepting devices should be EMV-compliant. Section 3 - Amendment of Subsection XL77.7 of the MORB to read as follows: xxx 3. lT controls implementation. xxx e. Electronic products and services. xxx iii. xxx. The entire payment card network should be migrated to EMV. This requirement shall cover both issuing and acquiring programs of concerned BSFls. A written and Board-approved EMV migration plan should be submitted to the Bangko Sentral within six (6) months from 22 August 2OL3. The guidelines on Europay, Mastercard and Visa (EMV) lmplementation are shown in Appendix L08. The guidelines on the EMV Card Fraud Liability Shift Framework (ECFLSF) are in Appendix 108a. xxx. A. Mabini St.. Malate 10t).1 Manila, Pltilippirtes . (632) 70fi2701 . www.bsp.13<.lv ph . bsprnarl(ii)111;p.g;ov.plr

Section 4 - Amendment of Subsection XL77.9 of the MORB to add another paragraph containing the relevant supervisory enforcement action concerning the ECFLSF, as follows: Section X177.9 Sanctions and penalties. xxx xxx xxx "BSFls should endeavor to achieve full compliance within a period as may be allowed by the Bangko Sentral. Prior to full compliance, failure on the part of BSFIs to submit and implement their EMV migration plan shall be subject to additional enforcement actions pursuant to Section X009." Section 5 - Effectivity. This Circular shall take effect on 1 January 2OL7. FOR THE MONETARY BOARD: /nm_ evrnru76rvr. rErANGco, J R Att: A/5 jO December 2016 Page2of 2

Appendix 108a EMV CARD FRAUD UABTLTTY SH|FT FRAMEWORK (ECFISFI t. Introduction This document outlines the Bangko Sentral's guidelines implementing the EMV Card Fraud Liability Shift Framework (ECFLSF). Pursuant to Subsection XL77.7 and Appendix 108 of the Manual of Regulations for Banks (MORB), Bangko Sentral Supervised Financial Institutions (BSFls) should shift from the magnetic stripe (magstripe) technology to EMV-compliant cards, POS terminals and ATMs. The immediate impact and benefit on the adoption of EMV technology is the reduction in card fraud resulting from counterfeit or skimming attacks. While migration efforts to shift to EMV technology are ongoing, the use of magstripe in payment cards and/or card-accepting devices shall be allowed subject to card fraud liability shift. This means that the BSFIs which have not yet or have partially adopted the EMV technology shall be held responsible for losses associated with the use of a counterfeit card in a card-present environment. il. Statement of Policy It is the policy of the Bangko Sentral to foster the development of safe, secure, efficient and reliable retail payment systems, protect the integrity and confidentiality of customer accounts and information and uphold consumer protection. Towards this end, the Bangko Sentral requires all concerned BSFIs to migrate to a more secure payment technology and sets forth subject principles for allocation of card fraud liability with the aim of ensuring compliance of the different retail payment system participants with the Bangko Sentral's EMV migration requirement. Pending full migration to the EMV technology, the ECFLSF shall likewise accelerate the dispute resolution and restitution process for customers who have valid claims arising from counterfeit fraud or skimming attacks. lll. Applicability and Scope These guidelines shall apply to all BSFIs with debit and credit card issuing and acquiring functions and shall govern the allocation of liability associated with fraudulent transactions arising from counterfeit cards beginning 1 January 20L7, subject to the conduct of proper investigation by the concerned participant/s of the payment card network. The coverage shall be limited to card-present and contact transactions of Philippine-issued payment cards used domestically in automated teller machines (ATMs), point-of-sale (POS) terminals, and other similar devices routed to either domestic or international payment networks. Page 1 of4

Consequently, the ECFLSF shall not apply to card-not-present and contactless transactions. Furthermore, foreign-issued payment cards used domestically and Philippine-issued payment cards used abroad shall not be covered as these are already subject to the existing liability shift and chargeback rules of the international payment networks. lV. Definition of Terms For purposes of these guidelines, the following definitions shall apply: 1) Acquiring institution (Acquirer), is a bank or non-financial institution that processes credit or debit card transactions via ATMs, POS terminals, and other similar devices. 2) EMV compliant device or terminal is a device or terminal that has, or is connected to, a contact chip card reader, has an EMV application, certified, and is able to process EMV transactions. 3) Co'branded cards are Philippine-issued cards affiliated with international payment networks. 4l Counterfeit cord is an imitation or falsification of a genuine magstripe card or EMV chip card with track data copied from a hybrid EMV card. 5) Debit cards are payment cards linked to bank deposit or prepaid/electronic money (e-money) accounts. 6) Follback to mogstripe transaction occurs when the chip on the card is not being read by a terminal. This is similar to technical fattbock, which is defined in Appendix 108 of the MORB as a state in which the chip cannot be used and another type of entry, such as magstripe, is used to complete a transaction. 7) Hybrid cords are payment cards that have both EMV chip and magstripe. 8) lnternationol payment networks refer to the payment networks that have global establishment. For purposes of subject guidelines, recognized international networks shall refer to Visa, Mastercard, Unionpay, Diners/Discover, American Express, Japan Credit Bureau (JCB). 9) lssuing institution (lssuer) is a bank or non-bank financial institution that issues payment cards, whether proprietary or co-branded, to consumers. LO) Payment cards are cards that can be used by cardholders and accepted by terminals to withdraw cash and/or make payment for purchase of goods or services, fund transfer and other financial transactions. Typically, payment cards are electronically-linked to deposit, prepaid or loan/credit accounts. V. Guiding Principles 1) The adoption of EMV technology is designed to reduce and mitigate risks arising from counterfeit card fraud. While it remains virtually impossible to create a counterfeit EMV card that can be used to conduct an EMV payment transaction successfully, the presence of magstripe in a hybrid EMV card makes it still vulnerable to counterfeit attacks. 2l A BSFI that has enabled the most secure EMV options shall be protected from financial liability arising from losses on counterfeit card fraud. The liability for

this type of fraud shall shift to the BSFI which is not or is partially compliant with the EMV migration requirement. 3) To resolve the issue on the allocation of card fraud liability using the guidelines described herein, the involved parties (such as issuer, acquirer, and payment network) should, first, characterize the fraud committed, and then, assess the technology being employed, in light of the applicable payment network rules. The party supporting EMV technology will prevail and in case of a technology- tie (neither or both parties are EMV compliant), the liability for fraudulent transactions generally remains with the lssuer. Vl. Allocation of Card Fraud Liability The allocation of liability for counterfeit card fraud is summarized in the following table: Card Capabllltles Acceptance Devlce Scenarlo Liablllty Support L Magnetic stripe only Magnetic stripe only Magnetic card transaction was lssuer completed 2 Magnetic stripe only EMV compliant Magnetic card transaction was lssuer completed 3 EMV compliant Magnetic stripe only Magnetic card transaction was Acquirer' hvbrid card completed 4 EMV compliant EMV compliant Fallback transaction; Magnetic lssuer hybrid card card transaction was completed The information provided above shall be considered as a general guide as each fraudulent transaction shall be separately investigated on. Likewise, the domestic and international payment networks may come up with other scenarios and probable conditions that illustrate how liability is assigned on counterfeit card fraud using different combinations of card and acceptance device capabilities. However, the resolution of such scenarios/conditions should follow the principles espoused in these guidelines. V!1. Consumer Protection and Complaints Handling and Resolution 1) The participants in the domestic payment network (such as issuer, acquirer, and payment network) should collaborate and devise detailed rules and procedures including arbitration mechanisms to operatlonalize the ECFLSF. Accordingly, a body responsible for strictly implementing the above-mentioned detailed rules and procedures on ECFLSF should be constituted. 2l Cardholders' complaints and/or requests for chargeback as a result of counterfeit card shall be considered as complex complaint/request defined in t When an Acquirer accepts a magstripe card that was counterfeited with track data copied from an EMV compliant hybrid card and the counterfeit card is used at a device/terminal that is not EMV-compliant, resulting in a transaction to be successfully processed, the Acquirer is liable for any chargeback resulting from such fraud.

Appendix 110 of the MORB and hence, shall follow the standards provided in such regulations, except for the processing and resolution timeline which should be within 10 days instead of 45 days. 3) lssuers and Acquirers should ensure that affiliated international payment networks align their existing liability and chargeback rules with the ECFLSF insofar as Philippine-issued payment cards used in the domestic payment environment are concerned.