Adoption of EMV cards is not the end of the journey

EMV standards were introduced by EuroPay, MasterCard and Visa (hence EMV) some years ago, mainly to reduce the risk of fraud in credit cards. EMV credit and debit cards, carrying microchips that effectively provide a computer processing platform upon the card itself are widely known as chip cards in South Africa. Stanchion says they deliver significantly improved card transaction security, even if they have not yet delivered on all the multi-application uses initially expected. However, despite the fact that South African banks and businesses have adopted EMV cards, their EMV journey is not over.

Compliance is an on-going issue

Stanchion technical director Shaun Baker and operations director Liam McDermott say EMV compliance and certification is an on-going issue mostly due to the constant evolution of the technology, but also due to changes institutions make on their platforms. Without compliance, retailers, banks and the transaction chain may find themselves liable for any fraud committed using an EMV card. But certifying the systems used for EMV transactions is generally a complex and lengthy process, and any core changes in the payment systems would typically require re-certification.

"To many, this is a 'black art', which is not very well understood," says Baker. "And because they hear it is a painful and protracted process, companies are hesitant. The minute you change pertinent parts of your infrastructure (i.e. changing a POS vendor, or moving from one payments system to another), you must re-certify it. This happens infrequently in most big organisations, but it happens.

Foundation to combat fraud

"In addition, certification and compliance are not the end-game - EMV provides a foundation for fighting fraud, allowing issuers to take charge of transactions at point-of-sale. Using these tools to effectively combat fraud requires a deeper understanding of the EMV standard and of the systems within the transaction chain. Many companies do not have the resources to ensure complete control of the value chain," he adds.

Baker says taking charge of the re-certification will fall under the responsibilities of an enterprise's compliance officer, who therefore needs to be kept informed of all relevant IT infrastructure changes. "Certification can be a lengthy process that may take as long as nine to twelve months to complete, although the typical period is around three months. Because of the perceived complexity and cost of the process, enterprises often find it preferable to use a consultancy such as Stanchion to run it," says McDermott.

Facilitating the process

"Many companies, although members of the payment associations, don't have meaningful relationships with MasterCard or Visa, or they don't know what questions to ask. Stanchion can also contribute by facilitating this process for them," says Baker.

McDermott says Stanchion is seeing growing interest in EMV migration from banks and smaller institutions across Africa, where the adoption rate of EMV and even roll-out of chip cards has been substantially lower than in Southern Africa. Stanchion is also seeing interest from numerous other businesses, who are considering the use of EMV cards for a range of products, including loyalty cards and contactless prepaid debit for low-value applications such as mass transit.

However, because EMV certification comes at a hefty price, EMV may not always be the only, or even the most suitable, solution for securitising transactions. In some cases, new technologies such as interactive transaction authentication tools may be viable replacements, he notes.