Banks Need More Detailed ATM Tests to Ensure EMV Compliance

With the first chip card deadline for ATMs coming up in a few weeks, banks need to quickly gain an upper hand on potential risks. This starts with a more complete understanding of the complex changes at the ATM terminal.

Mastercard's shift deadline is Oct. 1, while Visa's is in October 2017. Considering the complexity of the changes and the involvement of multiple stakeholders, comprehensive testing performed at various levels can reduce risk and enable cost- and time-savings for ATM owners. 

While specific payment network certifications are mandatory, they do not cover all aspects of testing such as regression testing, new feature testing, transaction-specific testing, and performance and stress testing. Rather, certification tests are designed only to test functionality that is important to a specific network and ensure that EMV data is handled correctly by the terminal per the network’s specification.

The extent of testing needed during EMV ATM migration depends on the ATM fleet, payment networks and types of services and transactions supported by the bank/processor. Because these factors can vary by terminal, appropriate testing can ensure that all features and functions are working as desired across models.

For example, apart from cash withdrawals and disbursements, ATMs typically support various other transactions like balance enquiry, cash deposit, funds transfer, PIN change and PIN unblock. While these may not be considered as EMV transactions, EMV-defined steps can be used to initiate these transactions.  Testing should be performed to ensure that non-EMV transactions that use EMV functions work as expected at the ATMs.

ATMs may also require other software upgrades that require testing. NCR, for example, does not support EMV on ATMs using older operating systems such as OS/2 and RMX and recommends upgrading to Windows 7. Windows XP ATM owners, too, are migrating to Windows 7 to facilitate EMV migration.

The ATM EMV migration is still slow. It is estimated that “only about 20% of U.S. ATMs have been adapted to accept the chip cards” and “by October 1, that will creep up to 35%.” The   unique complexities of the ATM migration journey do little to support a faster rate of transition in the U.S.:

Market Size: With more than 425,000 ATMs deployed, the U.S. is the second largest global market for ATMs. While the estimates vary, costs of the EMV upgrade are huge. Fiserv estimates upgrade costs range from $2000 to $5000 per device; Aite Group estimates the costs of upgrade at $2,000 to $4,000 per ATM; and Javelin projects the ATM upgrade cost at $500 million.

Common Debit Aid:   In order to comply with the Durbin Amendment, ATMs and ATM hosts need to support U.S. Common Debit AID (application identifier) as well as point to a globally recognized Global AID.

NFC (Near Field Communications) Withdrawals: While initial implementations are based on contact EMV, U.S ATMs also need to plan for the acceptance of EMV-based contactless card or Near Field Communication (NFC)-based withdrawals.

Dated ATMs: 10 to 15% of currently functioning ATMs may not be upgradable for EMV and will need to be eliminated. This increases the load on ATMs, further complicating the migration process. 

The pressure is on. Every complex technology migration has its risks and EMV is no exception.  Because the migration involves changes at multiple levels (terminal card reader and software, transaction switching, and acquirer host), banks must be equipped to deal with potential glitches that can lead to customer dissatisfaction and financial losses.

Undertaking a detailed analysis of existing ATM fleets (including terminal makers, models and the firmware/software in use) can help evaluate replacement or upgrade options based on whether inventory can be made EMV complaint.

Other proactive steps include:

--Check on the availability of EMV Level 1 and Level 2 certifications from the vendors of the identified devices.

--Implement payment network certification requirements as required for EMV deployment.

--Minimize customer confusion by clearly displaying EMV chip acceptance, instructions for dip card readers, and screen and menu changes.

Sudha Kiran Pentela is a principal consultant for cards and payments practice for SQS.