Financial institutions all over the U.S. are making decisions about how they will implement and manage their EMV infrastructure moving forward; decisions that will impact their operations for years to come.
One such choice concerns data preparation for EMV. This is more complex than for magnetic stripe cards as there is more key and cardholder data to protect. Financial institutions will need to make a choice between managing data preparation in-house or out-sourcing it to a third-party provider, like a processor or personalization bureau.
There is currently a lot of confusion around the various benefits of each approach, which will result in some issuers maxing out their budgets and struggling to get a grip on forecasting and budgeting for deployment of additional services in the future.
An eye-opening exercise which will fine tune your business model, starts with asking (all) of your EMV partners, and stakeholders 8 high level questions. Be warned, you are about to turn over a mossy rock and the (magnetic stripe card turned EMV) model which you have currently "in place" may go into a tail spin.
Asking these 8 questions is disruptive behavior. The results, however, could save you double digit percentages of invested money, reinstate you as the Client who is once more in charge of forecasting and budgeting, and fully aware of the financial repercussions of managing your EMV card lifecycles pre and post issuance. If the answers to the below surprise you, it might be time to challenge your business model.
Ask your team: Do we want to outsource to a third party?
The information contained in the master key files is central to the security of your EMV implementation. If this is compromised, so are all of the keys held in the EMV chips within your customers plastic cards. When issuers send the master key outside of the organization, it is relying on the personalization bureau or other third party to keep it safe. With issuers doing daily risk evaluations across all of their product portfolios, it needs to be considered whether this additional risk is acceptable.
Ask your partners: How will my costs change over the next five years?
Outsourcing data preparation to a third party may have seemed simple and cost effective for the initial roll-out phase of an EMV project. Costs, however, can spiral out of control as your project gains maturity and new EMV scripts and keys are needed, you want to change network affiliations or are looking at deploying mobile payments, for example. Bringing data preparation in house may seem foreign in the short term but will deliver cost savings in the long run. More specific questions to ask are: What is my initial cost for the EMV cards initial issuance? What about in 6 and 12-18 months for that same card profile?
How much will it cost for production of new EMV scripts and keys?
Following on from changing costs, it is interesting to know how much you will be charged by your partners for the production of a new EMV script. Are your partners actually authoring those application scripts or is the work being outsourced to another party, accruing an additional percentage of margins? When you are in control of the data preparation, EMV card lifecycles are managed by you at no additional cost, but when outsourcing this as a service, charges can soon mount up across a portfolio covering hundreds of thousands of cardholders.
Does the system support instant issue EMV cards so that we can issue direct from branches?
EMV instant issuance, or in-branch issuance, enables bank customers to receive a personalized and activated EMV chip card while visiting the branch, instead of receiving it in the mail several days later. Fewer distribution costs, greater customer service and consistent use of the same smart card management technology are just some of the reasons so many banks are interested in this functionality. All this can only be done if the issuer is in control of its data preparation.
Can we use any processor, personalization bureau or card manufacturer?
Traditionally, for magnetic stripe cards it has been easiest to outsource to a number of card manufacturers or processors who combine card personalization for data preparation and production, keeping the market competitive. However, the relative complexity of EMV card issuance means that, for those choosing to outsource the whole process, issuers could end up getting locked in to a specific provider and as a result, being held victim to their deadlines, maximized resources and blue sky pricing. This limits options significantly.
Keeping the preparation in house offers choices, leaving them in a position to receive quotes for card personalisation from multiple suppliers, rather than be restricted to ones that can offer data preparation as an additional service.
Was your partner's data prep system designed pre-NFC?
Migrating to EMV cards is just the first step in fulfilling EMVs potential. The U.S. has a unique opportunity to consider mobile payments at the same time as EMV migration. Issuers that have in-sourced a suitable lifecycle management solution have the flexibility to move forward with mobile payment solutions, bringing the most innovative offering to their customers, increasing e-payments and driving revenues.
Does the system support the capability to update cards after they have been issued?
After a card has been issued, customers and banks often need to alter the parameters of the card to change the PIN, enable international use or raise spending limits, for example. Updating the card without having to reissue is important for many banks as it reduces costs for the bank and makes the service more convenient for customers. After all, the cost of a chip card is significantly higher than that of a magnetic stripe card.
Can I offer my customers loyalty programs?
EMV chips have more capacity than magnetic stripes, opening up the possibility of issuing multiple applications such as loyalty and access control on a single card. This could open up the possibility of issuing both debit and credit on a single card or allow the card to be used within a transport network, for example. Therefore, make sure your system supports multi-application management.
The above questions are designed to make sure issuers are getting the best long-term deal on their EMV projects. If the answers are clear and align with the banks business model, and key and script management are not priced separately, then the services being offered will support your route to market.
If answers from the personalization bureau, manufacturer or other third party are overly complex, mysterious or designed to deflect, then it is time to shake it up and challenge your business model. Dont just accept what people tell you, EMV deployment and data preparation is not as complex as some would have you believe!
Michelle Lehouck is EMV Director for Bell ID.
