EMV® UPDATE

October 2014

© 2014 Fiserv, Inc. or its affiliates. 2

Discussion Topics

Hear important information regarding Fiserv support for the transition to the EMV standard.  Fiserv deployment plans and support initiatives will be announced to provide you with insight into our approach for addressing impending payment card changes.

• Market landscape overview• What actions should financial

institutions be taking• What is the Fiserv Solution• What is the time line to

transition your card and ATM program to EMV

© 2014 Fiserv, Inc. or its affiliates. 3

Improved security

Better experience

for international

travelers

Worldwide interoperabilit

y

Positioning the industry

for future forms of

payments and security (tokenizatio

n)

EMV Adoption in the U.S. Why It Makes Sense

© 2014 Fiserv, Inc. or its affiliates. 4

Liability Shift Dates

P.O.S. October 2015 October 2015

ATM October 2017

April 2013 Specific to cross border Maestro transactions where the issuer is

Non-U.S. at a U.S. ATM

October 2016All transactions on any

MasterCard network

Pay at Pump/Gas

October 2017 October 2017

© 2014 Fiserv, Inc. or its affiliates. 5

State of the Union2013 in Review

Debit Issuers Credit Issuers ATM Deployers Merchants

• “Wait and See approach”

• Progress dependent on legal outcomes around Reg II and PIN network engagement in EMV

• Visa reports 3.5M EMV cards issued in US as of 1Q13. 0.5% of all US issued cards.

• Large credit issuers have begun issuance mostly to business, commercial traveler segments (Bank of America, Citibank, JPMorgan Chase, US Bank)

• Some credit unions have begun issuance (Andrews FCU, United Nations FCU)

• Handful of US based ATMs accept EMV

• Most terminal owners deploying readers but not enabled through kernel software

• Windows 7 convergence driving some movement to “single dip” manufacturer costs

• Big box retailers are beginning EMV deployment

• Wal-Mart terminals EMV enabled but en masse lack the software kernel to process EMV transaction

• Best Buy and Home Depot announced plans to be EMV compliant

• Most smaller retailers taking a wait and see approach

• Impact of compromise and threats of future ones

© 2014 Fiserv, Inc. or its affiliates. 6

• Scale and depth of recent merchant compromises influencing the market view on EMV• Debit issuers desire a path forward to mitigate Card Present fraud• Merchants fear being “next”• EMV has entered the consumers conscience• Visa and MasterCard commitment to announced liability shift dates

• A regulatory compliant path for debit issuers• Accel™ Debit Payments Network from Fiserv

agrees to license the MasterCard and Visa offering UAID (Universal Application Identifier)

• EMV Migration Forum developed an EMV specification that future proofs regulatory requirements

EMV Landscape

© 2014 Fiserv, Inc. or its affiliates.

EMVAnswering the Top Compromise Questions

• Did the fact that the US was not EMV-enabled influence the breach?• Yes. Fraudsters will focus on the payment system of least resistance.

• Would EMV have prevented the data being compromised?• No. EMV would not have thwarted the fraudsters’ efforts. In these situations the data

compromised was card data housed on merchant systems.• Would EMV have mitigated the compromise impact?

• Yes. EMV would prevent the fraudsters from creating new plastic with the stolen information. The chip on an EMV card has certain information programmed to the chip that would make counterfeiting of that particular card very hard to do. Each EMV transaction creates data that is unique to that transaction. Replication is virtually impossible.

• Does EMV protect against all forms of fraud? • No. EMV cards do not protect/prevent Card Not Present (CNP) fraud.

• When will EMV prevent counterfeit fraud? • It is a journey. In reality EMV would need to be broadly deployed in the US across

cards issued, merchant devices and ATM machines to materially combat Card Present fraud.

7

© 2014 Fiserv, Inc. or its affiliates. 8

Consumers Are Drawn to the Enhanced Security of ChipFeatures and Benefits Offered by Chip Cards

Source: Harris Interactive, EMV Chip Card Research, June 2013, commissioned by MasterCard

© 2014 Fiserv, Inc. or its affiliates.

Fiserv, MasterCard reach EMV debit routing agreement March 12, 2014

MasterCard, Fiserv Partner on Debit EMV for Accel Network March 12, 2014

MasterCard, Fiserv Enter Pact on EMV Debit Routing March 12, 2014

MasterCard EMV debit cards to run over

Accel network March 12, 2014

9

Fiserv, MasterCard Agreement Advances Debit EMV Adoption in the U.S.

March 12, 2014

Fiserv to Advance Debit EMV Adoption in the U.S. through Visa’s Common Solution

March 17, 2014

How Fiserv's Long, Rigorous EMV Path Led It to

MasterCard March 13, 2014

Bowing to EMV’s Urgency, Accel Adopts MasterCard’s Common

Debit Solution March 12, 2014

© 2014 Fiserv, Inc. or its affiliates. 10

Fiserv in the News

© 2014 Fiserv, Inc. or its affiliates. 11

EMVAnswering the Top AID Questions

• What is an AID?• An identifier instantiated within terminal kernel software and personalization in the payment

application. A matching AID must exist between the card and terminal to enable an EMV transaction (e.g. Visa, MasterCard have defined AIDs distributed globally).

• Does the AID control routing? • No. Bin-level routing will continue in an EMV environment, preserving merchants’ right to least cost

route.• What is the UAID?

• It is a unique identifier that has been created specifically to represent debit in the US Market. It is not brand-specific. This identifier will enable all players in the payment landscape to utilize a single identifier to associate any debit network they issuer or accept. This identifier must be broadly deployed in all debit accepting devices and personalized on all debit card products for licensed networks.

• Why is the Accel announcement so significant? • Accel is the first debit payments network to license both the Visa and MasterCard UAID, offering its

merchant and issuer communities a path forward to transition to EMV. These agreements provide a regulatory compliant solution for all stakeholders in market.

• What if my unaffiliated network is not Accel? • Fiserv is not in a position to speak to what the other debit networks in the US markets plans are to

support the transition to EMV nor their status relative to licensing the Visa and MasterCard solutions.

© 2014 Fiserv, Inc. or its affiliates. 12

Recommendations for EMV Deployment

• Migrate card portfolios and ATMs to EMV enablement over timeTransitional approach

• Deploy EMV with the capabilities required for security benefits/compliance protection; extras can come later

Go with a compliant strategy

• Time to plan for action is nowPlan on a course of action

• International traveler segment Focus on cardholder expectations

• Focus on credit first.• Issue debit cards personalized with the UAID to

avoid reissuancePrioritize

• ATM upgrades as part of a larger initiative to upgrade ATM relative to end of life of Windows XP operating systems

Evaluate investments as part of a larger initiative

© 2014 Fiserv, Inc. or its affiliates. 13

What Can/Should You Be Doing

Understand your card personalizationoptions and associated expenses

• Contact vs. Dual Interface• Online vs. Offline• Chip Size (12k vs. 16k)

Address how you assign PAN numbers• EMV requires each cardholder to utilize

a unique PAN for application transaction counter (ATC) increment authentication

© 2014 Fiserv, Inc. or its affiliates. 14

What Can/Should You Be Doing

Review Your Card Designs

© 2014 Fiserv, Inc. or its affiliates. 15

What Can/Should You Be Doing

Analyze your portfolio -Identify international travelers that may likely want/need to be early adopters

Evaluate current reissuance cycles - Consider reducing the

duration to more closely align with liability shift dates

Budget, plan and educate - Create internal awareness and engage your partners

© 2014 Fiserv, Inc. or its affiliates. 16

EMV Return on Investment?

Expense Current State Future EMV State

Fraud Cost3BPs*

8BPs**

• An EMV chip card is only authenticated in a card present transaction. Chip cards do not offer security benefits for CNP transactions.

Program Implementation Cost

N/A

• One time fee from all vendor and partner engagements

• Visa and MC fees est. $1000 per BIN• Cardholder education, internal training

Per Card Cost <$1.00 • Est. $3.00 for contact, single application card

Incremental Transaction Authentication Fee

N/A • $.005 - $.009 per transaction

Device Upgrades• POS• ATM

N/A• $30-$300 depending on device type• $2000-$5000 (Fiserv solution requires ATMs utilize a

Windows 7 OS)

Instant Issuance Equipment Upgrade Cost

N/A• Varies per supplier• As high as $25,000 per branch location

*Fiserv Risk Office client best-in-class average** Federal Reserve Board published card fraud average

© 2014 Fiserv, Inc. or its affiliates. 17

EMV Deployment Timeline

2014Accel Network Announcements

2Q14-4Q14*UAID Proliferation

Multi-AID Deployment in Market

3Q14-4Q15 (and beyond)*FI and Merchant EMV Deployments

October 15Initial Network POS Liability Shift Commences

* Timelines estimates based on forecasted market readiness

© 2014 Fiserv, Inc. or its affiliates. 18

The Fiserv Solution

• Offer a streamlined, compliant, and cost effective path to EMV debit card issuance

• Align EMV solution with the front of card brand (Visa and MasterCard) while driving value and growth of Accel PIN and No PIN transactions

• Integrated and standardized card personalization with Fiserv Output Solutions

• Best Practice authorization processing to mitigate transaction risk

• A transitional approach to EMV card issuance

• Assist in internal and cardholder awareness and education

© 2014 Fiserv, Inc. or its affiliates. 19

Recommended Issuer Guidelines

EMV Options Visa MasterCard Fiserv Solution

Card Interface Issuer choice

Dual-interface or contact chip card with companion contactless mobile application

Issuer choice

Dual-interface recommended for best cardholder experience

Contact Only

Card Authentication

Online Online DDA/CDA if offline is supported (issuer choice)

Online Only

TransactionAuthorization

Online Online Offline if issuer opts to support

Online

Cardholder Verification

Issuer choice Signature, online PIN (debit), no CVM

Issuer choice Signature, online PIN, offline PIN, no CVM

Credit Card: Signature preferredDebit: Issuer Choice

Source Smart Card Alliance: Card Payments Roadmap in the United States: How Will EMV Impact the Future Payments Infrastructure? 1/23/2014

© 2014 Fiserv, Inc. or its affiliates.

ATM VendorATM Operating

SystemATM Application

Software

EMV Supported

MasterCard (MChip)

Visa (VSDC)

Universal Application Identifier (UAID)

American Express (AEIPS)

Discover/ Diners (DPAS)

Other(US

Regional Networks

Non UAID)

Diebold Windows 7 Agilis 3.0 Yes Yes TBD No No TBD

NCR Windows 7APTRA Edge 5.0

SMIYes Yes TBD No No TBD

NCR* Windows 7APTRA Advance

4.01No No No No No No

Nautilus Hyosung*

Windows 7 MoniPlus2s No No No No No No

Nautilus Hyosung (retail)*

Windows CENautilus Hyosung

Triton NativeNo No No No No No

Wincor-Nixdorf* Windows 7 ProCash Flex 3 No No No No No No

GRG* Windows 7 YDC 3.1.3 No No No No No No

Triton (retail)* Windows CE Triton Native No No No No No No

Fiserv SolutionATM EMV Enablement

EMV is not supported on ATMs using Windows XP or OS2 operating systems.* Dates for EMV enablement support to be determined for 2015 or 2016 delivery

20

© 2014 Fiserv, Inc. or its affiliates.

EMVAnswering the Top Fiserv Readiness Questions

• Are Fiserv EMV solutions ready?• Yes. Fiserv payment systems and personalization capabilities have been enhanced and

readied for EMV issuance and acceptance. However, general availability of a standardized solution requires pilot issuers and terminal owners to certify the standard solutions with Visa and MasterCard for all card program types and terminal deployments. These certifications are in process or need to commence.

• What is the timeline to implement EMV solutions?• As EMV deployments in the US Market are still in their infancy, early adopter

implementation timelines are expected to take at least 6 months.

• Can cards be issued and can terminals accept the UAID?• The proliferation in market of the UAID is still a work in progress. The business

agreements to accept this EMV solution took nearly 2 years to materialize. The specifications and standards that define the UAID implementation have been developed by the EMV Migration Forum but there is still work to do by all payment players including ATM and POS software vendors, card manufacturers etc. to enable the technology to support these defined standards.

• Can I submit projects to get in the queue? • Yes. Although pilot and certification activities are still in process, projects can be

submitted so that initial milestones both at Fiserv and at your bank can commence.

21

© 2014 Fiserv, Inc. or its affiliates. 22

Additional Resources and Next Steps

• Resources

• Fiserv EMV Website: www.fiserv.com/emv

• Contact your Fiserv Card Services or Fiserv Output Solution Account Executive

Thank you