A new contactless and mobile payments software standard was approved Wednesday by the international standard-setting body EMVCo in an effort to coalesce the card industry around one approach.
The software, which EMVCo refers to as a “kernel,” allows for payment acceptance at point-of-sale terminals and ATMs for the processing of card transactions, even in instances when the card is embedded in a phone.
“The EMV Contactless Kernel Specification is the latest example of the payments industry collaborating to deliver a specification that supports marketplace needs, and advances seamless and secure payments globally,” said EMVCo Executive Committee Chair Alisa Ellis said in a release Wednesday regarding the new software standard.
There are currently some 20 different contactless payment “kernels” in use by merchants around the world so the new specification is aimed at reducing complexity and costs.
The effort is driven by the owners of EMVCo, including the namesake companies Europay, Mastercard and Visa, as well as the U.S. card companies American Express and Discover Financial Services, plus JCB of Japan.
Invisible to the consumer
Switching to the new software may or may not require a merchant to swap out a POS device, depending on whether it can be done remotely by a merchant acquirer, said Stewart Watterson, a strategic analyst for Aite-Novarica Group who specializes in retail banking and payments. As for the consumer experience, Watterson said in an interview that he doesn’t see that changing much as a result of the new software, at least not for the moment.
EMVCo, which is controlled by the world’s biggest card companies, said in the release that the benefits of the new software include more security for channel privacy, eavesdropping prevention, and protection of sensitive data; card authentication via elliptic curve cryptography; biometric and mobile card verification support; optimization for use with cloud technology; and on-card data storage for privacy and integrity protection.
While the new software could improve fraud-prevention and efficiencies for card processing, it mainly guards against more sophisticated technical data breaches that aren’t very common, Watterson said. The new generation standard isn’t a big benefit now, or controversial either, for that matter, but it could be in the future as a stepping stone to more significant improvements, he said.
Little financial incentive to change
Merchants may not even have much financial incentive to pay for the switch anytime soon, given merchant acquirers are likely to charge for the upgrade, Watterson said. That’s because four of the five benefits, with the exception of cloud optimization, largely accrue to the card issuer, with less benefit for acquirers, so there’s less reason for the latter to rush adoption.
Still, the nation’s largest bank, JPMorgan Chase, operates on both sides of the equation, as a card issuer and merchant acquirer, but there still might not be much return on investment at this point, Watterson said. Other major acquirers include Fiserv, Global Payments and Adyen.
One of the biggest benefits of the new software might be with respect to rising use of biometrics for consumer authentication and fraud prevention. The new standard will let a POS device access biometric information more directly, providing another tool to check a user’s identity, Watterson said.
The new standard will likely be rolled out faster in Europe, where such technical upgrades tend to catch on faster, than it will be in the U.S., he said.
Approval process
EMVCo, the company behind the contactless symbol at payment terminals, took input from outsiders on the software specification in recent months after it issued a request for feedback in May on a draft of contactless specifications.
The 312-page draft issued earlier this year was reviewed by EMVCo associates, including major payments processors such as FIS, Adyen and Fiserv as well as big tech companies like Microsoft and Google and newer fintechs such as Stripe and Square. Merchants, such as Target and Amazon, are also associates, according to the EMVCo website.
As part of the software approval process, the specification was subject to meeting discussions among the EMVCo associates, a full associate review as well as the public review, said Alistair Cochrane, a spokesperson for EMVCo. In conclusion, it was approved by a vote of the EMVCo board, which includes merchants, card issuers and acquirers, payment networks, financial institutions, and testing laboratories, among others, he said.
The new specification is “significant because it is the first industry standard kernel that simplifies global acceptance of contactless payments for merchants, payment systems, and solution providers,” American Express Executive Vice President Matthew Robinson said in an emailed statement, adding that the company is beginning to transition to the technology.
