EMV Implementation for Issuers: 7 Decisions You Must Make Before Issuing Your First Chip Card

Even if your organization has been issuing magnetic stripe cards for years, you realize the switch to issuing chip cards (sometimes referred to as EMV cards, ICCs [integrated circuit cards], or smart cards) is much more complicated than simply adding a microchip to your card design specs and choosing a chip card manufacturer to produce the plastics. You realize the move to chip cards will ultimately affect every aspect of your institution, from your branch operations to your payments batch processing. Even so, as a card issuer, focusing first on chip card issuance can be a logical starting point in planning your EMV implementation. This article addresses seven key decisions your organization must make before issuing its first chip card.

1. How will the inclusion of a chip change the graphic design of the card? Where does our logo appear? How do we preserve our brand?

   It’s likely that your organization has spent considerable time and devoted resources to developing your unique brand; that is, the “look and feel” of your magnetic stripe cards. Because regulations specify the exact placement of the microchip on your chip cards, you may find you cannot re-use the design of your magnetic stripe cards without relocating graphics or text that will otherwise be displaced by the chip.

   Note that in addition to the chip, you will also typically include a magnetic stripe on your new chip cards to enable your cardholders to use their cards at devices that are not chip enabled.

2. Which applications will we include on the chip?

   As part of planning your card personalization, in addition to making decisions about the manufacturing of the plastics (embossing, magnetic stripe encoding, and so forth), you must also make decisions about the applications contained on the card’s chip. Chip cards can contain multiple applications. For the purposes of our discussion, let’s focus on the financial and payments applications on your cards.

   Some card applications are associated with a card associations’ scheme (such as MasterCard, VISA, American Express). Other applications are associated with financial networks and switches. For your chip cards to be used at a chip-enabled terminal by your cardholders, there must be a match between one of your card applications and one of the applications that the chip-enabled terminal supports.

   You may discover that mandates from your card association, regional switch network, or even government may largely determine the applications you must have on your chip cards. If you do have options regarding the applications to include, consider the following.

   • If your card issuing organization belongs to a card association (such as MasterCard, Visa, American Express, etc.) or switch network, your organization must work with representatives from those card associations or networks to determine which applications are to be included on chip cards bearing their logos. Card associations and networks typically require formal functional certifications for chip cards, as well as inter-member certifications. Choosing to include an existing, pre-certified application will enable you to get your cards into production faster.
   • In addition to any required network-level applications, you may choose to develop your own ICC application. Note, however, that any new application must be based on an existing ICC application and must be certified with the appropriate association (that is, applications based on Visa standards must be certified by Visa, and applications based on MasterCard standards must be approved by MasterCard, and so forth). Achieving that certification may result in substantial delays in getting your cards into production; therefore your organization will need to carefully consider the consequences of developing and certifying a new chip application.
   • Card associations have very strict regulations about how cardholder data is to be provided to chip card manufacturers and secured during the card personalization process. Your institution must conform to all of these regulations, in addition to existing PCI DSS (Payment Card Industry Data Security Standards) regulations.

Copyright © 1996-2010, Paragon Application Systems