Eating the US EMV elephant

Last week, Visa announced that it would eliminate the requirement for eligible merchants to annually validate their compliance with the PCI DSS for any year in which at least 75 percent of the merchant’s Visa transactions originate from chip-enabled terminals.

Visa Europe also announced a program to reward investment in EMV that reduces EMV chip merchants’ PCI DSS compliance resource requirements. Both programs are aimed at providing a strong incentive for remaining magnetic stripe-only merchants to migrate to EMV chip acceptance technology. However, few merchants accept Visa cards alone. As a result, it’s hard to see how merchants will fully benefit from these incentives unless other card schemes follow suit.

Of course, the Visa Inc program only applies outside the US. Despite the US being extremely active in investing in end-to-end encryption, tokenization and other measures to improve security, it remains stubbornly a magnetic stripe environment for lots of reasons.

However, the amount of interest in when, whether and how the US may move to EMV grew exponentially last year. The paper “Card Payments Roadmap in the U.S.: How Will EMV Impact the Future Payments Infrastructure?” released by the Smartcard Alliance (of which Thales is a member, and to which Thales contributed) is extremely timely. For the first time, here is a paper that looks comprehensively at the various roadmap options available for moving to EMV.

Given the elephantine size of the US payment industry, changing to EMV is still not a walk in the park. However, the report concludes that the wide availability of EMV technology and products means that migration will be less complicated than it would have been a decade ago.

If fraud increases further in the US and criminals take advantage of the country as a softer target than the EMV-enabled rest of the world, a US move to EMV may become more likely.

Many acquirers/processors have already put in place the EMV infrastructure to support customers in Canada and other countries, and many new POS terminals are now EMV compatible as standard. These factors mean that the US payments industry is in fact already beginning to eat the EMV Elephant, a piece at a time, and may find that should it decide to migrate, it is not quite such an insurmountable task after all.

Author: Steve Brunswick, Director of Product Strategy at Thales e-security