Europay, Mastercard and Visa (EMV) Implementation Guidelines

BANGKO SeNTRal Ng PIliPinAS

OFFICE OF THE GOVERNOR

CIRCULAR NO. _859 Series of 2014

Subject : Europay, MasterCard and Visa (EMV) Implementation Guidelines

the public against payment card fraud. Monetary Board, in its Resolution No. 1795 dated 06 November 2014, approved the issuance of subject EMV Implementation Guidelines. This is part of BSP's continuing efforts to strengthen the electronic retail payment network and for the protection of Pursuant to Subsection X177.7 of the Manual of Regulations for Banks, the

management of risks while the financial industry migrates the magnetic stripe maintain interoperability of payment networks. shall govern the EMV implementation for debit cards in any card-accepting devices/terminals to safeguard customer information, reduce card fraud, and payment environment to chip-enabled technology based on EMV. The guidelines The attached guidelines set forth the expectations of the BSP with respect to

For information and guidance.

FOR THE MONETARY BOARD:

AMANDO M. TETANGCO, Jr.

Governor

November 2014

Att: a/s

A. Mabini St., Malate 1004 Manila, Philippines * (632) 7087701 * www.bsp.gov.ph [email protected]

GUIDELINES ON EMV IMPLEMENTATION

A. Background

skimming' and counterfeiting. magnetic stripe (magstripe), international payment networks have orchestrated the shift towards EMV chip-enabled card. The EMV is an interoperability standard for chip-bearing smart card technology defined by EMVCo in 1994, adoption of which has resulted to significant reduction in card frauds due to In response to the increasing sophistication of frauds perpetrated through

stifl using magstripe, BSP supervised institutions (BSis) via Circular No. 808 dated 22 August 2013 were required to migrate their entire payment network to the more secure EMV chip-enabled cards. To outpace and manage fraudsters' shift towards jurisdictions that are

B. Statement of Policy

efficient, and reliable retail payment systems, protect the integrity and confidentiality of customer accounts and information and uphold consumer protection. It is the policy of the BSP to foster the development of safe, secure,

C. Scope

EMV of all BSIs with debit card issuing and acquiring functions. For credit card, covered since other credit card transactions are governed by the rules of the only cash advance transaction at Automated Teller Machines (ATMs) shall be international payment networks. These guidelines shall govern the migration to and implementation of

the domestic payment network comply with these guidelines. It is incumbent upon all affected BSIs to ensure that other key players in

limited to card present and contact transactions in ATMs, POS terminals and other similar devices. Guidelines governing card-not-present as well as contactless transactions shall be issued separately. For purposes of the subject guidelines, payment transactions covered are

D. Definition of Terms

1. EMV, which stands for Europay, MasterCard and Visa, is a global standard for microprocessor, a type of small computer. The microprocessor chip contains credit, debit and prepaid payment cards based on chip card technology. EMV chip-based payment cards, also known as smart cards, contain an embedded

I Skimming is the illegal copying of information from the magnetic stripe of a payment card to gain access to accounts.

Page 1 of 6

traditional.magstripe payment cards. the information needed to use the card for payment, and is protected by various security features. Chip cards are a more secure alternative to

through the following features: Implementing EMV shall address the deficiencies inherent in magstripe by reducing fraud arising from counterfeit, lost and stolen card information

b. Digitally signing payment data for transaction integrity; a. Authentication of the chip card to ensure that the card is genuine so as to C More robust cardholder verification to protect against lost and stolen protect against counterfeit fraud for online-authorized transactions;

card fraud for EMV transactions in all acceptance environments. 2. Acquiring institution (acquirer) is a bank or financial institution that processes credit or debit card transactions via ATM or POS terminals.

3. BSP Supervised Institutions (BSIs) include banks, non-banks with quasi- bank institutions which under existing BSP rules and regulations and special banking function (NBQB), non-bank electronic money issuers and other non- Iaws are subject to BSP supervision and/or regulation. 4. Co-branded cards are Philippine-issued cards affiliated with international payment networks.

5. Debit cards are payment cards linked to bank deposit or prepaid/electronic money (e-money) accounts.

6. Domestic payment network includes BSis as well as other key players such as merchants, providers of ATMs, point-of-sale (POS) terminals and similar devices, card vendors, card personalization bureaus and domestic switches responsible for processing and handling domestic transactions.

7. Domestic switches refer to BancNet and Megalink.

8. EMV chip liability shift means that the liability and responsibility for counterfeit or fraudulent transaction shall shift to the BSI who is not EMV- compliant.

9. EMVCo is the governing body that manages the EMV specification. 10. Hybrid cards are payment cards that have both EMV chip and magstripe. 11. International payment networks refer to the payment networks that have international networks shall refer to Visa, Mastercard, UnionPay, Diners/Discover, American Express, Japan Credit Bureau (JCB). global establishment. For purposes of subject guidelines, recognized

12. Interoperability refers to the ability of Philippine cardholders to transact at Philippine ATM and POS terminals, regardless of network affiliation or branding of the card.

Page 2 of 6

13. Issuing institution (issuer) is a bank or non-bank financia! institution that

issues payment cards, whether proprietary or co-branded, to consumers.

14. Payment cards are cards that can be used by cardholders and accepted by terminals to withdraw cash and/or make payment for purchase of goods or services, fund transfer and other financial transactions. Typically, payment

cards are electronicafly-linked deposit, prepaid or loan/credit accounts.

15. Philippine domestic EMV specification refers to the specification or standards based on EMV that shall be adopted in the Philippine financial market for the proprietary or non-co-branded cards.

16. Proprietary cards are Philippine-issued cards without international payment network affiliation.

17. Technical fallback is a state in which a chip cannot be used and another type of entry, such as magstripe, is used to complete a transaction.

E. General Rules

consider the following: In line with the declaration of policy, BSIs, in migrating to EMV, shall

1. BSis shall maintain interoperability of the domestic payment network; 2 The Philippine EMV Implementation shall use established EMV specification

as follows: a. Issuers of proprietary cards shall use the Philippine domestic EMV

specification; and b. Issuers of co-branded cards shall use the EMV specification of their affiliated international payment network.

5. BSis shall strengthen consumer protection by adequately handling and 4. The domestic payment network shall ensure continued interoperability and 3. At a minimum, all debit accepting devices shall acquire/accept Philippine acceptance of Philippine EMV issued cards using the Philippine domestic EMV schemes done electronically. containing consumer concerns and complaints arising from fraudulent issued proprietary cards using the Philippine domestic EMV specification of members/participants of the domestic switches; specification on Philippine EMV deployed acceptance devices;2 and

F.The Philippine Domestic EMV Specification

card fraud, BSIs shall adopt a Philippine domestic EMV specification for With the main objectives of maintaining interoperability and reducing

proprietary cards. The domestic EMV specification should:

> Adopt the EMV specification according to EMVCo;

2 Include EMV-compliant ATMs, POS terminals and other similar devices.

Page 3 of 6

T Apply to ATM and domestic debit POS transactions; > Support contact transactions; d Support online card authentication to ensure that transactions are made Y Support online authorization to enable issuer to manage fraud and credit risk using a valid card;

Y > Support technical fallback to magstripe in the interim; as provided in Section I Support online PIN cardholder verification method; at the transaction level;

of these guidelines, without prejudice to the issuer's decision to process/approve fallback transactions.

G. Minimum Operational Requirements

1. Issuing institutions shall:

a. Ensure that they have the technical systems and network necessary to b. Support EMV data elements in authorization messages; process and handle EMV transactions;

C. Define chip cards feature, functionality and interface capability; d Enhance risk management systems to leverage chip; e Determine the card migration strategy; f Update customer support and operational systems to support chip cards; 8. Be certified for network interfaces and card personalization by a

h Replace card base; and certification body organized by BSIs pursuant to these guidelines;

Educate the consumers.

2 Acquiring institutions shall:

a. Ensure that card-accepting devices are EMV-certified to support the b. Ensure that PIN-entry devices are Payment Card Industry PIN Transaction C. Enable a debit POS environment that supports online PIN for Philippine- Security (PCI-PTS)3 compliant; and acquiring and routing of Philippine-issued debit cards using the Philippine domestic EMV specification;

issued debit cards.

3. Domestic switches shall:

b. Ensure continued support to existing transaction sets and functions a. Establish infrastructure and systems that are EMV-compliant and able to support switched EMV transactions from domestic interconnected provided to consumers; networks;

3 A security requirement of the Payment Card Industry (PCI) regarding testing of PIN-entry devices using predefined standards to get certification.

Page 4 of 6

c. Enhance efforts to educate their members on EMV collaboration and seek d. Ensure continued ability to support, in the interim, transactions in effective alignment of strategy and design principles; and magstripe format subject to liability shift policies acceptable to BSP, the standards of which shall be covered in subsequent guidelines.

H. Detailed Guidelines, Policies and Processes

subject EMV .Implementation Guidelines, covering but not limited to the following: requirements, policies and procedures that are acceptable to the BSP, the standards of which shall be covered in subsequent guidelines, and aligned with BSis shall agree on and implement detailed technical and operational

4. Testing and certification 2. Single Common AID, Single Common Card Personalization Profile and Single 3. Transaction routing; 5. Dispute and fraud risk management; and 6. Other processes affected by the EMV migration. 1. Philippine Application Identifier.(AID); Common Terminal Configuration for domestic transactions;

I. Hybrid Card, Fallback Function and EMV Liability Shift

framework that is acceptable to the BSP, the standards of which shall be covered achieving full stability, hybrid cards may still be acceptable as a fallback option in cases when the EMV chip or terminal is unable to process domestic chip transactions for an interim period, which shall initially be for a period of one (1) year after 1 January 2017. In this regard, BSIs shall formulate a liability shift While the EMV infrastructure and environment are in the process of

in subsequent guidelines.

J. Updated EMV Migration Plan

incorporated in the EMV Migration PIan and all affected BSIs shall resubmit their within sixty (60) calendar days from the date of the Circular. updated plan to BSP's Core Information Technology Specialist Group (CITSG) Any changes arising from the aforementioned guidelines shall be

K. Sanctions/Penalties

penalties provided under Circular No. 808 dated 22 August 2013. Non-compliance with these guidelines shall subject BSIs to sanctions and

Pa ge 5 of 6

LEffectivit

issued and card-accepting devices should be EMV-compliant by 1 January 2017. All BSts shall support migration to EMV standards. Consequently, all cards

Pa ge 6 of 6