Automated teller machine owners will have to upgrade their machines to comply with the Triple DES data encryption standard by 2005.
But the high cost of replacing older ATMs has opened a niche market for a handful of vendors that say they have the technology to upgrade the machines and make them compliant.
Large banks typically buy high-end ATMs made by Diebold Inc. and NCR Corp. and sell them to resellers after retiring them. These resellers refurbish the machines and sell them to community banks, credit unions, or merchants, which enjoy having nicer ATMs at lower prices.
Now that the Triple DES requirements have come along, smaller deployers are facing questions over whether to upgrade or replace; many are upgrading high-end machines rather than replacing them with compliant lower-end ones. An upgrade can cost about $1,900, versus $25,000 for a replacement, according to one estimate.
How large is the niche market? Bob Normyle, the president of Pi Systems LLC, a Euless, Tex., company that sells new and refurbished ATMs, called the market "huge," since it includes not only the United States, but every country where ATMs are deployed. His company is working on 100 and expects to have 200 to 300 by yearend.
MasterCard International has approved Pi Systems' Triple DES Fix kit, which helps ATM owners refurbish noncompliant ATM keypads.
Both MasterCard and Visa International have set "sunset" deadlines for when all ATMs will have to process their transactions with the Triple DES standard. MasterCard's deadline - April 1, 2005 - is the earlier of the two. It has issued waivers to some ATM owners, but the waivers give them only an extra six to 12 months.
Companies offering Triple DES upgrades are working in "a niche that needs to be filled, because there are a lot of older models out there," said John Schettino, the vice president of security and risk management for MasterCard. "It would be a burden for these ATM owners to buy new ATMs. That's why we've made our conversion requirements from an implication perspective very flexible."
ATM manufacturers say that they are conducting the bulk of the upgrades; most machines simply need new software, but some need retrofitted keypads.
But executives at Diebold and NCR say they will not attempt to upgrade "vintage" machines that need more than a little work, so the companies that own such ATMs are left with few alternatives.
"I've got credit unions that have 20 or 30 machines that can't afford to replace them for anywhere from $12,000 to $30,000" each, said Jerry Gregory, the corporate development officer of Cash Carriers USA, a Richardson, Tex., company that sells, services, and stocks ATMs, particularly Diebold and NCR machines. "They just won't do that. They've been talking to me about what we're going to do when the time comes."
Mr. Gregory has been working with ATM Exchange Inc. of Cincinnati, which sells an upgrade kit called Triple DES Plus, but MasterCard has not yet approved the kit. ATM Exchange has been working closely with MasterCard to make the kit compliant with Triple DES, but an earlier version did not make the cut, according to MasterCard.
Dave Parlin, the chief executive officer of ATM Exchange, said it has had to develop its own Triple DES system based on domestic and international standards, because Diebold and NCR will not sell any of their software or keypad equipment to third-party vendors.
"I was forced to create this solution," Mr. Parlin said. "Third-party services like us do not have access or cannot purchase the Triple DES solution from NCR or Diebold. This is a defensive move for me, but it turns out to be a very positive move for the bankers."
For example, he cited NCR's 50XX series, which was introduced in the 1980s. NCR stopped making the machines a little over a decade ago. An equivalent replacement would cost about $25,000 new, but an ATM Exchange upgrade would cost only $1,950, he said - if and when MasterCard approves the kit.
Diebold and NCR are taking advantage of the new standards and creating a "forced obsolescence," Mr. Parlin said. "You can put two and two together. If someone makes a product obsolete, then the financial institution will be forced to buy a new machine."
Executives at Diebold and NCR deny that this is the reason they are not retrofitting older machines.
"They're certainly entitled to their opinion," said Dean D. Stewart, the director of product planning and management for Diebold. "We've been pretty straightforward on these upgrades. Long term, we don't think they're the best investment to make."
As for the deployers that upgrade rather than replace, "it's their decision to do that," Mr. Stewart said. Diebold has not interfered with any ATM owner's attempts to upgrade its older machines, he said.
Nor did the ATM manufacturers apologize for not sharing their equipment with third-party vendors.
"We have to protect our intellectual property in order to protect the industry," said Andrew Orents, NCR's vice president of ATM business for the Americas. The equipment even has to be manufactured in a "secure room."
