Observers of the U. S. card industry have long speculated about whether the United States will migrate to the EMV (Europay, Mastercard and Visa) standard. More than 60 countries have already made the switch, and the United States is the last member of the Group of 20 (G20) relying on outdated magnetic stripe technology.
For a long time, the outlook for EMV in the United States appeared to be dim, as evidenced by responses from repeated Aite Group surveys of card security executives (Figure 1). When Aite Group first posed the question in 2009 about the likelihood that the United States would migrate to EMV, more than one-third of respondents believed that the U. S. would never make that leap. Two years later, there were many more believers, with only 17 per cent of respondents opining that the U. S. would never embrace EMV.
Obstacles to EMV in the United States are disappearing
With two 2011 announcements - the August 9 Visa announcement that created incentives for merchants to deploy EMVenabled technology at the point of sale (POS) by October 2015, and the August 31 Mastercard announcement that proclaimed a liability shift at the ATM for Maestro interregional transactions - it appears EMV's arrival in the United States has changed from a matter of "if" to a matter of "when."
For years there were a number of significant obstacles to EMV from the perspectives of U. S. issuers and merchants, and fraud losses were not significant enough to offset those barriers. In the wake of the Durbin Amendment, which capped debit interchange rates in the United States and eliminated the price difference between signature- and PIN-based debit transactions, the landscape has dramatically shifted.
Many U. S. issuers have already begun a limited deployment of EMV cards to selected populations of U. S. cardholders who travel internationally, since cards with only a magnetic stripe have become increasingly difficult to use in non-U. S. jurisdictions. More than 2.5 million cards are expected to be issued in the United States in 2011 based upon this use case alone, giving issuers an opportunity to dip their toe in the water and get some deployment experience.
Since the initial infrastructure investment has already been made, this also makes the business case less onerous should these issuers decide to deploy EMV to a broader portion of their customer base.
Durbin Amendment as a catalyst
Prior to the advent of the Durbin Amendment, U. S. debit-card issuers worked hard to maximize the volume of transactions that were transacted without a PIN, because the revenue potential of signaturedebit transactions was so much greater than that of PIN-debit. The price differential will disappear in the aftermath of the Durbin Amendment, and with it one giant obstacle to the U. S. market migration to EMV. In fact, the Durbin Amendment will serve as a catalyst for quicker migration to EMV, given that debit-card issuers' profit margins will be highly compressed due to the rate cap and issuers' sensitivity to fraud losses will be heightened.
Another major factor impeding EMV adoption in the U. S. market has been the mer chant community. Upgrading terminals to support EMV requires a significant capital investment, and merchants had little incentive to take that on prior to the Visa announcement. Nevertheless, a few highly influential merchants, such as
Walmart, have been vocal proponents of bringing EMV to the United States.
Walmart has already made the terminal upgrades to support EMV in its stores, and has expressed the belief that EMV brings the highest level of security to point-of-sale payments. This sentiment is echoed by a recent Aite Group survey of card security professionals, in which EMV was deemed to be the point-of-sale technology that will have the greatest impact on reducing card losses over the next three years (Figure 2).
Visa: Moving the market forward
The recent Visa announcement, which mandates a move to EMV by October 2015, will go a long way toward helping merchants make the business case, provided that all of the networks embrace the approach outlined by Visa. This is a big question mark at this point, since Discover and American Express have not made any public statements on the issue, and the only Mastercard move relative to EMV has been specific to the ATM channel. Assuming the other networks do follow suit, the Visa approach contains incentives and penalties, which should make for a fairly compelling business case from the merchants' perspective.
The incentives come in the form of a reprieve from the obligation to perform quarterly assessments to certify compliance with the Payment Card Industry Data Security Standard. While merchants must continue to comply with PCI requirement, they will be alleviated from the annual assessment requirement, which will represent a fairly significant savings. This benefit can begin as early as October 2012, and is extended to any merchant that originates at least 75 percent of its card transactions from terminals that are enabled to support both contact and contactless EMV transactions. If the merchant accepts cards issued by other brands, however (as is the case for most U. S. merchants), this benefit will not mean much, as they will still need to demonstrate PCI compliance for the other networks unless those networks follow Visa's lead.
The cost to upgrade the POS infrastructure will be between US$25 and US$30 per terminal, although this cost varies widely based on the complexity of the model. The average replacement cycle for terminals tends to be around five years, which is one reason Visa has put forth for the 2015 date for the liability shift. The majority of the terminals that have been sold for the last year or two are already EMV-enabled, as the terminal manufacturers have standardized terminals to meet the needs of the global market. The penalties will begin to accrue in October 2015. At this time, if a chip-enabled card is presented to a mer chant that does not have a terminal that can process contact-chip transactions, then the merchant's acquiring processor will bear the liability for counterfeit fraud transactions (and this liability will undoubted be passed from the acquirer to the merchant.)
Mastercard: Pushing EMV at the ATM
As noted earlier, Mastercard also made an announcement mandating EMV in the United States, effective April 2013, at any ATM that processes transactions via the Mastercard Maestro network. For any interregional Maestro transaction, the liability for counterfeit fraud transactions that occur because a U. S. ATM lacks the ability to support contact EMV transactions will rest with the ATM owner. Non-U. S. issuers will be the immediate beneficiaries of this move by Mastercard, as they have been bearing a significant portion of the pain associated with the U. S. magnetic-stripe-based system for some time.
This seems to be among the first steps toward a more widespread deployment, as the capital upgrade required to facilitate EMV-enabled transactions on Maestro would also benefit other networks. The cost of this upgrade, between US$ 2,000 and US$ 4,000 per ATM, is not insignificant and will be borne by banks and private ATM operators. ATM skimming is a significant and rising point of pain for U. S. banks, and they would eventually reap the benefit of the more secure ATM environment as EMV cards begin to be deployed to more U. S. consumers.
Private ATM operators to stop acceptance of Maestro-cards?
Private ATM operators are less than pleased with this announcement. They are forced with the difficult decision of whether to spend the money on the capital upgrade, do nothing and bear the increased transaction risk in 2013 or discontinue acceptance of Maestro-branded cards.
Given the short time frame allotted for these changes, the latter option seems a very real possibility. A good chunk of interregional ATM transactions have been seeing decline for some time now, as issuers from overseas respond to the heightened risk environment that results from the current U. S. inability to support EMV. Given that few ATMs can support contactless, many ATM operators may wait to see what Visa's position on EMV at the ATM will be, and whether contactless will take hold in that channel; they only want to make the capital upgrade one time.
EMV: Coming soon
The question now is not whether EMV will come to the USA, but rather, what form will it take? Already there have been conflicting announcements by U. S. issuers and networks on this front. Some issuers that have begun deploying cards against the international travel use case have opted for chip and PIN, while others have chosen PIN and signature. The Visa announcement has a stated goal of pushing contactless transactions forward, while the first Mastercard announcement relative to EMV in the United States focused on contact transactions.
There is a good deal of flux still present in the market, but the aggressive targets set forth by the networks thus far seem to suggest that EMV is finally on its way to the United States.