1 usbpayment.com/emv Proprietary and Confidential New EMV Chip Technology and Compliance Mandate: Are You Ready? Moderator: Richard Ellis – State Treasurer,

1usbpayment.com/emvProprietary and Confidential

New EMV Chip Technology and Compliance Mandate:

Are You Ready?

Moderator: Richard Ellis – State Treasurer, State of Utah

Julie Tvedt – Sr. Global Product Manager, Commercial Payments, U.S. Bank

Orson Morgan – Sr. Account Executive, Public Sector, Visa


EMV 101

What, When and Why


What is EMV?

EMV is named after its original developers (Europay, MasterCard® and Visa®)

EMV is a global standard for chip cards featuring embedded microprocessor chips that store and protect cardholder data.

Microchip generates a dynamic one-time use code (cryptogram) with every transaction

Prevents the data from being re-used to create counterfeit cards


Worldwide EMV Deployment and Adoption

RegionEMV Cards

Adoption Rate

EMV Terminals

Adoption Rate

Western Europe 794M 81.6% 12.2M 99.9%

Canada, Latin America and the Caribbean

471M 54.2% 7.1M 84.7%

Africa and Middle East 77M 38.9% 699K 86.3%

Eastern Europe 84M 24.4% 1.4M 91.2%

Asia Pacific 942M 17.4% 15.6M 71.7%Figures reported in Q4 2013 and represent the latest statistics from American Express, Discover, JCB, MasterCard, UnionPay and Visa, as reported by their member institutions globally.

Source: Estimates stated from The Smart Card Alliance/EMV Migration Forum, May 2014

RegionEMV Cards

Adoption Rate

EMV Terminals

Adoption Rate

United States [estimates] ~17-20M ~1-2% ~2M ~20%


When is EMV Coming to the U.S.?

Fraud Liabil i ty Shift for Non-Gasoline Retai lers

OCT

Fraud Liabil i ty Shift for Gasoline Retai lers

OCT

2015 2017


Why Chip and Why Now?

Security and Fraud

Global Interoperability

Mobile Payments


70%U.S. Credit Cards migrated to EMV - by end of 2015FORECASTED1

EMV Technology Trends

The U.S. market

will see rapid adoption

of EMV technology

over the next 3 years

47%U.S. Activated Terminals migrated to EMV – by end of 2015FORECASTED1

Sources: Current cards per Operating Certificates as of 30-Sep-14; credit card forecast per Aite Report – EMV: Lessons Learned and the U.S. Outlook (June 2014); activated terminal forecast per Payment Security Taskforce Acquirer projections press release (October 2014)¹Forecast based on information currently available to Visa.


Card Stays in the Terminal

Cardholder Experience

Non EMV Terminal

Transaction processing per

existing process takes place

Cardholder swipes card at the

POS terminal

Cardholder provides signature

verification

EMV Enabled TerminalCardholder inserts card in the POS

terminal

Cardholder inserts (“dips”) card; OR

swipes card, and is then prompted to

insert card

Cardholder provides

signature or PIN verification

Transaction complete;

cardholder removes card from terminal


EMV will:

Prevent counterfeit fraud at the point of sale

EMVwill not:

Protect against card-not-present fraud

Protect against counterfeiting cards Prevent data breaches

Create a different point-of-sale experience (“dip” vs “swipe”) Always require a PIN

Store cardholder data on a chip

Be vulnerable to wireless interception of data

Require a new card Eliminate the need for magnetic stripe

See growing adoption in the U.S. in the next 12-18 months

Be universally adopted in the U.S. for 3-4 years

EMV – What it is… and What it isn’t


Key Points

Education!!! Commercial Card Programs

• Liability shift does not impacted cardholders as they are not liable for fraud

• No cost for EMV plastic• Know your PIN, in case you are prompted• PINS do NOT mean cardholder has access to cash• Program authorization controls untouched

11 Visa Confidential

Notice of confidentiality

This presentation is furnished to you solely in your capacity as a Visa employee. By accepting this presentation, you acknowledge that the information contained herein (the “Information”) is confidential and subject to Visa’s confidentiality restrictions.

You agree to keep the Information confidential and not to use the Information for any purpose other than in your capacity as a Visa employee. You may disseminate the information to other Visa employees only on a need-to-know basis.

Please be advised that the Information may constitute material nonpublic information under U.S. federal securities laws and that purchasing or selling securities of Visa Inc. while being aware of material nonpublic information would constitute a violation of applicable U.S. federal securities laws.


Forward-looking statements and disclaimerThis presentation may contain forward-looking statements within the meaning of the U.S. Private Securities Litigation Reform Act of 1995. These statements can be identified by the terms “objective,” “goal,” “strategy,” “opportunities,” “continue," “can,” "will" and other similar references to the future. Examples of such forward-looking statements may include, but are not limited to, statements we make about our corporate strategy and product goals, plans and objectives. By their nature, forward-looking statements: (i) speak only as of the date they are made, (ii) are neither statements of historical fact nor guarantees of future performance and (iii) are subject to risks, uncertainties, assumptions and changes in circumstances that are difficult to predict or quantify. Therefore, actual results could differ materially and adversely from those forward-looking statements because of a variety of factors, including the following: macroeconomic and industry factors such as currency exchange rates, global economic, political, health and other conditions, competitive pressure on customer pricing and in the payments industry generally, material changes in our customers' performance compared to our estimates; systemic developments such as disruption of our transaction processing systems or the inability to process transactions efficiently, account data breaches involving card data stored by us or third parties, increased fraudulent and other illegal activity involving our cards; and the other factors discussed under the heading "Risk Factors” in our most recent Annual Report on Form 10-K and our most recent Quarterly Reports on Form 10-Q. You should not place undue reliance on such statements. Unless required to do so by law, we do not intend to update or revise any forward-looking statement, because of new information or future developments or otherwise.

Studies, survey results, research, recommendations, and opportunity assessments are provided for informational purposes only and should not be relied upon for marketing, legal, regulatory or other advice. Recommendations and opportunities should be independently evaluated in light of your specific business needs and any applicable laws and regulations. Visa is not responsible for your use of any studies, survey results, research, recommendations, opportunity assessments, or other information, including errors of any kind, or any assumptions or conclusions you might draw from their use. Except where statistically significant differences are specifically noted, survey results should be considered directional only.


How Does a Transaction Work?

http://visatv.trusted.visa.com/viewerportal/webcast/home.vp?programId=esc_program:7513&contentAssociationId=association:18347


Fraud Landscape TodayCounterfeit fraud represents 70% of card-present fraud and grew 27% in 2014

Source: Visa Fraud Reporting System (FRS) and Enterprise Data Warehouse (EDW); CY 2014; U.S. Issued / U.S. Acquired

Total fraud by type Card-present fraud

EMV chip will significantly reduce card-present

counterfeit fraud

Other5%

Card not

present44%

Lost/stolen

12% Counterfeit

39%

Other9%

Lost/stolen

21%Counterfe

it70%


U.S. EMV Migration − Client readiness report

Sources: Current cards based on MARS data through June 30, 2015; credit / debit card forecast per Aite Report – EMV: Lessons Learned and the U.S. Outlook (June 2014); activated terminal forecast per Payment Security Taskforce Acquirer projections press release (October 2014) ¹Forecast based on information currently available to Visa. Actual results may vary significantly.

• 117.1 million EMV chip cards issued, 78.1 million of which are credit

• Over a quarter of US credit cards have a chip on them today

Credit

• 39 million EMV debit cards issued; a 33% increase from May to June

• Debit issuance continues to outpace credit issuance. 7 of the top 10 Visa debit issuers are now issuing EMV debit cards

Debit

• A few hundred EMV terminals are now capable of routing PIN debit EMV transactions using the common debit AID

Domestic EMV PV increased 42% from $1.3B in May to $1.9B in June

Acquirers / Terminals

• • 247 thousand EMV chip activated merchant locations, a 15% increase from May to June

• Visa has partnered with a number of merchants to deploy point-of-sale decals to help train customers on how to conduct chip transactions

Merchants

U.S. EMV Chip Migration Forecast1

By the End of 2015

Credit cards 70%

Debit cards 41%

Activated terminals 47%


Jan-15 Feb-15 Mar-15 Apr-15 May-15 Jun-15 Jul-15 Aug-15 Sep-15 Oct-15 Nov-15 Dec-150%

20%

40%

60%

80%

70%

41%

47%

29%

Where We’re Going in 20151

Sources: June 2014 operating certificates; VisaNet data as of March 2014; cards per Aite Report – EMV: Lessons Learned and the U.S. Outlook (June 2014); terminals per Payment Security Taskforce Acquirer projections press release (October 2014) ¹Forecast based on information currently available to Visa. Actual results may vary significantly.

EMV chip as % of U.S. total

Liability shift

credit cards

activated terminals

debit cards

chip-on-chip transactions

Issuers begin mass issuance

Merchants begin activating terminals

Significant ramp up in

Q3 2015


Top 20 US Cities by EMV Cards in Market

Chip card transactions at Mag Stripe or EMV terminals (based on 201 service code). Based on US VisaNet data (Feb – May 2015) for merchant geo enriched city fields.


How does EMV chip technology work?Because the cryptogram changes with every transaction, even if the card data is stolen, the information can’t be used to create counterfeit cards because the cryptogram would have already “expired”

Card number Name Expiry

Service

code

CVV(STATIC

)

4 0 0 0 1 2 3 4 5 6 7^JOHNDOE^0 1 2 0 1 2^1 0 1^2 1 7^…


Service

code

iCVV

4 0 0 0 1 2 3 4 5 6 7^ JOHNDOE^ 0 1 2 0 1 2^ 2 0 1^ 3 8 6 ^

Cryptogram(DYNAMIC)

151873283102829182184384910631428563860915743017 ^…248018031518732831028291821843849106314285638609157430172480180343123689367945103491523858368127


Service

code

iCVV

4 0 0 0 1 2 3 4 5 6 7^ JOHNDOE^ 0 1 2 0 1 2^ 2 0 1^ 3 8 6 ^

Cryptogram(DYNAMIC)

151873283102829182184384910631428563860915743017 ^…248018031518732831028291821843849106314285638609157430172480180343123689367945103491523873256003


2004 2005 2006 2007 2008 2009 2010 2011 2012 2013

Hong Kong

Chip Impact on Counterfeit Fraud in Asia Pacific

2004 2005 2006 2007 2008 2009 2010 2011 2012 2013

Malaysia

2004 2005 2006 2007 2008 2009 2010 2011 2012 2013

Thailand

Start chip migration



• Since 2004, EMV chip implementation has led to more than two-thirds reduction in counterfeit fraud across Asia Pacific

• Counterfeit fraud liability shift effective date in Asia Pacific was January 1, 2006, but EMV chip migration started at different times in each country

• Malaysia was the first country to mandate EMV technology in 2005

77% decrease

since 2006

94% decrease

since 2005

99% decrease

since 2007

Source: Visa Fraud Reporting System, issuer-reported annual domestic counterfeit fraud volume

19


Impacts on Fraud

Source: Visa Fraud Reporting System; US domestic Visa and Interlink; CY2013; including POS, cashback and ATM (Visa has limited visibility into domestic ATM volume and fraud)

$0-25 $25-50 $50-100 $100-250 Over $2500.0

10.0

20.0

30.0

40.0

• EMV combats counterfeit fraud, which represents 39% of total US issued fraud and is growing at 27% per year

• In an EMV environment, PIN addresses lost/stolen fraud, which represents 13% of total US issued fraud. However, many low-value, low-risk transactions will continue to be authorized with no CVM

CVM Performance by Transaction BandFraud bps

Transaction Dollar Value

EMV solves for counterfei

t fraud

PIN solves for lost/stolen fraud

Signature - CounterfeitSignature - Lost/Stolen

PIN

No CVM Limit

s

20


EMV and CVM in Other Large MarketsChip and … Key Countries Rationale

Signature

ArgentinaColombia

Hong KongIndonesia (credit)Mexico1

Peru (credit)

SingaporeSouth Korea1

TaiwanThailand (credit)

Venezuela

• Cultural norms / mimicked CVM usage on prior magnetic stripe only products

• Lack of infrastructure support / business case to build out PIN acceptance

Offline PINBrazil (credit)

CanadaFrance

JapanS. Africa

UK2

• High legacy telecom/online authorization costs

Online PIN

Australia2

Brazil (debit)Chile

GermanyItaly

India2

Indonesia (debit)

KuwaitNew Zealand2

Peru (debit)Saudi Arabia

SpainThailand (debit)

UAE

• Cultural norms / mimicked CVM usage on prior magnetic stripe only products

1Considering/beginning migration to PIN2Migrated to PIN after initial EMV migration

21

22 Visa ConfidentialVisa Confidential

Path Forward

Chip Migration Contactless Evolution

Road to Dynamic

Data

• Will take several years for U.S. to reach full chip adoption

• On average, it took Brazil, Canada and Australia 6 years to reach 90%+ chip penetration after the liability shift date

• F2F counterfeit fraud tends to decrease by two-thirds or more

• Installation of NFC hardware as part of chip upgrades lays foundation for broader contactless acceptance

• Concerns over speed at the POS likely to drive issuance and acceptance of contactless technology following chip migration

• Mobile payment technology also driving demand for contactless acceptance

Removing Static Data

Tokenized Chip Cards

• New authentication technologies likely to displace traditional static methods, specifically PIN

• Dynamic data sources such as mobile geolocation provides more powerful real-time predictive analytics capabilities

• Biometric authentication of mobile payments adds additional layer of security

• Exploring new ways to merge chip technology with tokenization

• Removing static PAN provides merchant environment additional protection from data breach

• Streamlines payment security investments, effectively removing need for encryption solutions

23

Marketing and Communications


• Educate about benefits of chip

• Turnkey tools for cardholder education

• Educate about chip usage

• Reach consumers at “moments that matter”

• Educate about chip adoption and usage

• Reach merchants at “moments that matter”

• Educate about chip in context of security

• Reach influencers through third parties and directly

Stakeholder needs:

ConsumerClient Merchant Policy Influencers

Chip Education for All StakeholdersIndustry Collaboration is Needed to Optimize Chip Education Across Stakeholders


Key Activities UnderwayEducating stakeholders, influencing policy

• 20 city Small Business tour kicked off Mar 13 in Austin

• EMF/Payments Security Taskforce (PST) industry-wide efforts toward EMV migration and the consumer experience, microsite to launch April

• www.visachip.com microsite for issuers, acquirers, processors, merchants and consumers with FAQs, videos, links to more resources

• Turnkey materials card carriers, POS materials

• Merchant implementation toolkit an online, standalone kit with tips and resources and turnkey tools to educate consumers at the POS

• Search & Social campaigns running through end of September on Google, Yahoo, Bing for those using search terms such as “Visa chip card” or “chip credit card”

• Media outreach to consumers about chip via mainstream media and viral content

• Policy influencers - PR, high-profile articles, hill engagements, Bloomberg Digital Trust series, Hill Lunch and Learns, speaking events, agenda-setting industry reports

http://www.visachip.com/


Visa in Action

Credit card giant moves to devalue hacked dataPayment card giant Visa will announce Friday at the White House Cybersecurity Summit a move to make hacked credit card data far less valuable to hackers.-February 12, 2015

“Technology mandates not only become obsolete in a short matter of time, but they tend to weaken the security landscape and inhibit innovation because companies may hesitate to deploy new tools that do not meet specific statutory mandates even though such tools may better meet evolving threats and are more consumer-protective.“ March 24, 2015 Letter from Information Technology Industry Council to House Energy & Commerce Subcommittee on Commerce, Manufacturing, and Trade

“In the U.S., the infrastructure to support PINs across the ecosystem for purchases is not operational for credit, and more than two-thirds of U.S. retailers are not currently equipped to accept PIN transactions (even in the absence of chip). For many types of merchants, such as restaurants, accepting PINs is impractical; plus, it adds additional merchant costs to protect them within their computer systems. . . even if the entire industry agreed to adopt PIN or it was mandated by the government, it technically wouldn’t be operational for several years.” February 3, 2015 Letter from Charlie Scharf to Sen. Warner (D-VA)

“In our role as supervisor, the Federal Reserve does not mandate use of a specific technological approach to payment card security in recognition of the evolving nature of payment card fraud threats and of the variety of tools that can be employed to address these threats. “ March 5, 2015 Letter from Federal Reserve Chair Janet Yellen to Sen. Warner (D-VA)

Visa Steps Up with EMV Education with City-by-City Tour 20-city tour designed to help small businesses understand how and why they should prepare for accepting chip payment cards.-March 13, 2015

26


Visit www.visachip.comOnline destination for merchants, acquirers, issuers and consumers


Video

• http://visatv.trusted.visa.com/viewerportal/webcast/home.vp?programId=esc_program:7513&contentAssociationId=association:18347

•https://www.youtube.com/watch?v=tUkdqDARuEU

•https://www.youtube.com/watch?v=Nw2iTbEptHI



https://www.youtube.com/watch?v=tUkdqDARuEU


Thank you

Documents

1 usbpayment.com/emv Proprietary and Confidential New EMV Chip Technology and Compliance Mandate: Are You Ready? Moderator: Richard Ellis – State Treasurer,