What EMV Means for Retailers

With most regions in the world already adopting EMV, a global standard for credit and debit payment cards based on chip card technology, the U.S. is a sitting duck when it comes to customer present card fraud. This isn't good news for the country’s retailers and it’s clear that something needs to be done.

EMV has proven to be a highly effective solution to eliminate customer present fraud. The technical standards behind EMV are mature and its successes can be seen in many countries worldwide. The question isn't will EMV hit U.S. shores, it’s when. Having played an instrumental role in the introduction of retailer chip and PIN solutions in the U.K., I can provide some practical advice for retailers implementing EMV solutions.

One of the most significant impacts on retailers will be the technical complexity of implementing and running an EMV solution. The actual cost of implementing such solutions can be significant — the software upgrade, purchase of PIN pads and cost of accreditation all need to be considered. Retailers who choose to run their own in-house payment systems will need staff skilled in both EMV and their chosen vendor’s software. These retailers will have more control over their point-of-sale processes and the general customer experience. They'll also be able to architect their infrastructure to ensure the fastest possible transaction speed and integrate their payment solutions more closely with other associated retail systems.

For many retailers, however, the cost of running their own payment system will become excessive. They'll opt to move to a merchant processor with expertise in chip and PIN. There are two models available: The first is a hosted solution where the processor will run the retailer’s payment solution for them. The second is a shared solution which is, in effect, a single payment solution provided by the processor but shared by multiple retailers.

A hosted solution allows retailers to preserve many of the benefits of running their own system. The solution can still be tailored to their specific needs but, on top of this, they're able to draw on the processor’s EMV skills and experience. As the processor will be running systems for several retailers, it will have standardized processes and procedures within its data centers. For retailers, this means a reduction in the cost and effort associated with PCI DSS (Payment Card Industry Data Security Standard) accreditation.

A lot of retailers just want to accept payments in the simplest, cheapest way possible. A shared merchant processor service is a cheap standard solution that's already accredited. Integration is straightforward and retailers can be live in as little as a day or two days. Much of the PCI DSS accreditation falls under the processor’s remit and, if end-to-end encryption and tokenization is used, the scope of PCI DSS for the retailer can be significantly reduced. The processor will supply PIN pads which are compatible with their solution, removing a major logistics headache for the retailer.

Choosing the Right Solution
Whether running your own payment solution or outsourcing to a processor, there are a broad range of factors that you need to consider. For example, retailers running their own solution will need to think carefully about which licensed software they select. Has it been proven in a chip and PIN environment? What's the transaction speed at point of sale? Which PIN pads does the solution support and are these acceptable? Is the solution PA DSS (Payment Application Data Security Standard) approved? Are end-to-end encryption and tokenization supported? How will the PIN pad logistics be managed? Who will manage software upgrades and key management?

Similarly, retailers who outsource to a processor will need to consider which PIN pads are supported, bearing in mind that only a small number may be available. What's the transaction speed at the point of sale and how long does it take to process the payment for authorization? How does the processor perform in terms of system uptime and availability? What service-level agreements are they prepared to offer? What management information is available and is it sufficient for the retailer’s needs?

Retailers will face a range of decisions when implementing EMV solutions. It’s perhaps understandable that some are nervous about its introduction — the learning curve to understand the EMV standard is steep, to say the least. For the majority of retailers, the main impact will be the cost of the implementation. When chip and PIN was introduced into countries such as the U.K., I saw a lot of retailers move towards using processors. One thing does seem clear, however: The move to EMV is imminent. My advice to retailers is start preparing!

John Rozek is director of Polar Moment, a provider of business and technical consultancy to the payment industry.