Not too early to make ATM EMV migration plans

While the liability-shift deadline for migrating EMV—or chip card—specifications into automated teller machines isn’t until October 2016, it’s not too early to start planning exactly how to do that.

In fact, the first of such shifts will occur in October 2015, for lost, stolen, or counterfeited cards, so such planning ought to be close to mind already.

Adapting the new software and hardware to ATMs is considered more technically challenging, however, than the first stage, thus resulting in the extended deadline. To put it into perspective, those who operate automated fuel dispensing pumps at gas stations have until October 2017 to come up to speed.

“EMV migration can be a nine- to 12-month project (or longer) from inception to implementing the first EMV-enabled ATM in the field,” advises a new white paper published by the EMV Migration Forum. "There will probably be some prerequisites before beginning the project; these can vary depending on whether the ATM operator drives their own ATMs, goes through a processor, and other factors.”

“ATMs are an extremely important component in the U.S. migration to chip technology. Though migrating may seem like a daunting task, thorough planning, communication, and coordination will help to ensure success,” says Randy Vanderhoof, director of the EMV Migration Forum, in an introduction to the white paper. (You can download the white paper, Implementing EMV at the ATM: Requirements and Recommendations for the U.S. ATM Community.)

The paper provides detailed information about:

• Fundamental EMV concepts.

• Basic EMV requirements for ATMs.

• Migration planning.

• General considerations.

• Recommended and suggested best practices.

• ATM transaction processing with EMV.

“Each ATM owner/operator will need to make their own business decision, based on factors such as the cost of migration, liability shift dates, their tolerance for risk, and other projects currently on their plate, such as Windows 7 migration. Some ATM owners may decide not to upgrade a particular ATM to EMV until they must replace the ATM according to their regular replacement cycle. Or until they have to replace a broken card reader. If an ATM needs to be replaced before EMV migration begins, the owner/operator may wish to consider including a chip reader as part of the replacement; it is much less costly to include the chip reader when purchasing the ATM than installing it later,” the white paper says.

As a framework for planning an ATM EMV migration, the forum recommends these general guidelines:

• Formulate business requirements, to include which cards will be acquired, which networks are supported, which transactions will be supported, and anticipated transaction paths.

• Create a business requirements document and/or project charter.

• Consult with hardware/software vendors, processors, and payment network representatives for their recommendations and advice.

• Work closely with the vendors during the implementation process.

This includes verifying that: components have passed EMVCo Level 1 and Level 2 approval testing; the vendor has a software kernel that meets business requirements; and that the processor has completed and secured all the required testing and certifications for their platform and all applicable end-to-end configurations. Rely on the vendor to help with the technical details of EMV, and obtain the EMV-compliant hardware, software, and processing components.

• Coordinate project activities with payment network representatives.