Experiences On Developing National Payment Card Standard

by David Lee
VP of Sales Castles Technology Co. Ltd.

Payment Systems Seminar 2009 Bangkok 22nd December 2009

Agenda
Why National Payment Card Standard ? National Payment Card Standard in neighbouring countries :(1) Malaysia (2) (3) Taiwan Indonesia

Summary & Recommendations

Why National Payment Card Standard ?

One standard for all - minimize the redundancies Interoperability interbank, international payment scheme Robustness and time to market Cost savings

Experiences in Malaysia Evolution of e-Payment Landscape

1980s ATM cash withdrawal services was introduced 2000 Interbank GIRO was launched Internet banking gained huge acceptance

2007 Mobile banking service was introduced

1980

1990

1998

2000

2001

2003

2004

2007

1990s Merger of 3 switches, creating 1 network switch for domestic banks Introduction of proprietary Debit cards as an extension to the ATM services.

2001 Domestic banks entered into the interbank Debit network, operated by MEPS 2004 Establishment of Internet-based multi-bank payment system Financial Process Exchange (FPX)

1998 e-Purse (MEPS CASH) introduced during Commonwealth Games

Experiences in Malaysia
ATM & Debit Card
2007 More than 7,000 ATMs and 22 million chipbased ATM cards in circulation

2001 1980s ATM service introduced

Card fraud reached its peak in Malaysia. BNM initiated migration from magnetic stripe to chip-based cards

1980
1990s

1990

2001

2003

2004

2007

Malaysia experienced a high rate of ATM card related fraud vis--vis card cloning and card skimming

2003 Migration exercise completed in October. No reports of ATM card related fraud since then. 2004 - 2006 BNM mandated EMV compliance for cards and card readers by end 2004 and end-2005 respectively. MasterCard International and Visa Asia Pacific: number of fraud cases in Malaysia below world average; total credit card fraud lowest level since 2002. By 2006, there were almost 88 million financial cards in circulation in Malaysia. 5

Experiences in Malaysia
ATM Card in Malaysia
The ATM magnetic stripe card was first introduced in the early 1980s with standard traditional ATM functions like cash withdrawal and balance inquiry. ATM now offers rich functionality such as inter/intra bank account fund transfers, mobile prepaid top-up. MEPS has established links with four countries (Indonesia, Thailand, Singapore and China) thus facilitating cross-border ATM cash withdrawal transactions. MEPS also currently working towards enabling regional funds transfer and regional debit in Q3, 2008. In 2006, the number of ATM transactions rose steadily by 21% from 961 million in 2001 to 1.2 billion in 2006. Malaysian consumers are using their ATM cards (Bankcards) more frequently, but for smaller value transactions. This trend is consistent with regional trends across most of Asia.

Experiences in Malaysia
Debit Card in Malaysia
Almost all of the ATM cards issued by Malaysias domestic banks are Debit enabled, whilst the international debit cards are either VISA Electron and/or Mastercard Electronic. Usage of Debit cards is low as there is little awareness on the debit application of the Bankcard, which can be transacted at merchants that accept debit payments. In 2007, debit card operators began aggressively conducting marketing and promotional efforts to educate and encourage consumers on the benefits and convenience of Debit cards usage. The banks are also actively recruiting more merchants to accept Debit as a mode of payment. However, debit card acceptance when compared to credit cards remains relatively low limited by consumers concerns about the lack of terminals available for transactions and keying their PIN in public. With recent mandate by Malaysia Government to imposed special tax on Credit Card will then boost the usage of debit card.

Experiences in Malaysia
ATM and Debit Card Implementation Roles & Responsibilities
Developed ATM & Debit application on smart card Developed ATM and merchant terminals to interface with ATM & Debit application on smart card Developed bank host systems to interface with upgraded ATM and merchant terminals Set-up personalization centres * Vendors Developed and managed standards and specifications of ATM & Debit application and of personalization centres Managed card supply and personalization operations for member banks Coordinated upgrade process of member banks host systems Managed card conversion exercise Managed and upgraded the National ATM & Debit switch system Certification body for cards and personalization centers Developed standards for key management Lead various awareness initiatives on behalf of member banks Participating Banks

Introduced framework on the development and improvement of payment systems infrastructure Developed industry-wide best practices and security standards, Introduced measures to increase the efficiency and reduce risks in payment systems Introduced a conducive regulatory framework

Developed the banks user requirements for ATM & Debit application Upgraded/installed infrastructure to meet the requirement of ATM & Debit application on chip card Conducted card conversion exercise
8

Experiences in Malaysia
ATM and Debit Card Implementation
Card Platform
During initial implementation, the ATM and Debit application specification was developed on a native OS card which conformed to ISO 7816 Part I IV standard. As at 2004, ported to coexist with the EMV related application on an open platform card, namely on JCOP and MULTOS.

Card Interface
The ATM and Debit applications in Malaysia are on the contact interface. The contact communication protocol used by the ATM and Debit applications is the T = 0 protocol which is based on ISO7816 Part III. In 2006, Hybrid cards were introduced to support the ATM and Debit applications on the contact chip and VISA/Mastercards credit application on the contactless chip.

ATM / Debit Application

In 2001, MEPS developed its own smart card application specification

Experiences in Malaysia
ATM and Debit Card Implementation Challenges
Challenges Slow Participation by the Banks The banks had other priorities i.e. internal projects in parallel with the smart card implementation High Cost of Migration The Banks incurred large capital investments to replaced all magnetic stripe cards to smart cards and enable their ATMs, EDC terminals, Card Issuance systems and Bank Host systems to support smart cards Mitigation Bank Negara Malaysia mandated for all Banks to migrate all magnetic strip cards to smart cards and upgrade their related infrastructure to support smart cards for all domestic ATM and Debit transactions. Bank Negara Malaysia undertook the following initiatives to reduce the financial burden of the Banks: Obtained tax exemptions for smart card peripherals from the Ministry of Finance; Set up a special fund to offer one EDC terminal for every EDC terminal converted by the Banks Approved for the Banks to charge customers a maximum of RM8 annually per smart card issued.

10

Experiences in Malaysia
ATM and Debit Card Implementation Challenges cont.
Challenges Shortage of Chips Worldwide In mid-2002, there was a worldwide shortage of chips which affected all industries including the financial industry Mitigation MEPS coordinated the smart card procurement directly from the manufacturer to achieve the following benefits Bulk order price for all smart cards supplied Constant supply of smart cards to meet the card orders from the Banks Forecasted and placed orders for the Banks to meet anticipated high demand for smart cards close to deadline in order Customer Awareness and Acceptance MEPS coordinated and executed awareness campaigns to urge the public to convert their cards to smart cards early.

11

Experiences in Taiwan
Evolution of e-Payment Landscape
1990s Taiwans first attempt to implement smart cards was initiated in the mid-1990s Unsuccessful due the high costs involved and a low demand, arising from issuers concerns regarding security. 2005 Deployment of contactless infrastructure by Taipei Smart Card Company, which issued 5 million contactless MIFARE cards used for the Taiwan public transit

1980

1990

1998

2000

2001
2004

2003

2004

2007

2001 In Feb 2001, The Bankers Association of The Republic of China (BAROC) initiated and set up the Chip Migration Task Force to evaluate the feasibility of a Chip Migration Project and develop the related specifications

Banks switching from ATM to smart card due to increasing ATM frauds Proximity Mobile Transaction Service Alliance of Taiwan officially launched contactless Near Field Communication (NFC) technology into mobile handsets, so that commuters can pay with a wave of their phones instead of the contactless "EasyCards" in existence at that time.

12

Experiences in Taiwan
ATM Card in Taiwan
Taiwan began the replacement of magnetic stripe ATM cards in 2004. The conversion to smart cards has resulted in a slight drop in the total ATM cards in circulation.
2001 No of Trans (mil) 462.0 475.3 482.2 470.0 449.7 483.1 Trans Value (NT mil) 1,767 1,800 1,807 1,741 1,646 1,744 No of Cards in Circulation (mil) 53.20 58.40 63.80 68.20 73.40 71.50

The combination of market saturation and slow population growth is likely to contribute to the slowdown in the growth in ATM card numbers from 2007 - 2011. According to statistics compiled by the Financial Information Service Co. (FISC) reported in May 2007, the internet accounts for 13%-15% of overall ATM transactions.
80.0 70.0 60.0 50.0 40.0 30.0 20.0 10.0 0.0 2001 2002 2003 2004 2005 2006 58.4 53.2 68.2 63.8 73.4

2002 2003 2004 2005 2006

71.5

The FISC said the cross-bank ATM money transfer via the internet currently reached 1.2 million accounts per month, compared to the nine million accounts for the overall cross-bank ATM money transfer.

13

Experiences in Taiwan
Debit Card in Taiwan
No of Trans (mil) 2001 2002 2003 2004 2005 2006 1.8 2.6 3.6 5.5 8.1 9.1 Trans Value (EUR mil) 2,100 3,050 4,100 6,030 8,620 9,482 No of Cards in Circulati on (mil) 17.20 25.40 29.00 31.80 35.30 33.50

Debit card function only began to grow in mid-2004 after a series of promotional campaigns by Visa International Service Association. Two types of debit function cards in Taiwan, including Maestro and Visa Debit. Visa Debit is purely a debit card whereas Maestro is only offered as a secondary function on ATM cards. Maestro, introduced in Taiwan in 1995, has been mass issued with the number of cards in circulation reaching just over 39 million in 2006.
40.0 35.3 35.0 30.0 25.4 25.0 20.0 15.0 10.0 5.0 0.0 2001 2002 2003 2004 2005 2006 29.0 33.5 31.8

Lack of education remains the major obstacle for the development of debit function cards. The growth of debit transactions was also contributed by Visas debit promotional efforts. Most debit cards are used for domestic spending. The largest portion of debit card spending in Taiwan is through retailers, which includes supermarkets and hypermarkets.

17.2

14

Experiences in Taiwan
ATM and Debit Card Implementation
Card Platform
Adopted Multos, Java and Native platforms. However, most of the ATM/Debit applications are on the Native platform. The platform was chosen based on the following criteria: Application Cost Efficiency

Card Interface
All banks prefer to use T=1 to leverage on better processing speed as T=1 is block based as opposed to T= 0 which is character based. ATM cards are designed for online transactions only and offline PIN verification is required. All ATM/Debit cards adopt the contact interface.

ATM / Debit Application

A dedicated application which will not change in the near future and the Native platform would provide simplicity of implementation and cost savings.

15

Experiences in Taiwan
ATM and Debit Card Implementation Challenges
Challenges Slow Participation by the Banks Banks would need to spend up to NT$15 billion (U.S. $430 million) to migrate the ATM card system, including cards, ATMs and back end systems, from magnetic stripe to chip. High Cost of Migration The Banks incurred large capital investments to replaced all magnetic stripe cards to smart cards and enable their ATMs, EDC terminals, Card Issuance systems and Bank Host systems to support smart cards Mitigation The Ministry of Finance (MOF) ruled in October that the more than 600 million magnetic cards currently in circulation must be converted into more secure chip-based cards by June 2005.

FISC offering a special transaction fee as the incentive for the member banks to complete the migration.

16

Experiences in Taiwan
ATM and Debit Card Implementation Challenges
Decision on Magnetic Strip on the Chip Card
If local banks adopt integrated circuit (IC) cards, which combine cash withdrawal, credit, cash advances and smart debit features on one card, it will be easier for Taiwanese consumers to connect to future international standards. The MOF-funded Financial Information Service Co. requested that IC cards should retain their magnetic stripes for cardholders' convenience when abroad. The retained magnetic stripe on the IC card's back will facilitate Taiwan's cardholders using IC cards for money withdrawals or transfers at overseas ATMs with Cirrus or Plus functions

Slow Participation by Banks in Chip Card Migration

International credit card issuers like Visa and MasterCard also promoted the conversion of current magnetic credit cards into IC ones by 2006.

17

Experiences in Indonesia
Understanding of the Requirements
ISO 7816
ISO 7816 is an international standard related to electronic identification cards, especially smart cards, managed jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC).

The design and architecture of the proposed National Standard Indonesian Chip Card Specification (NSICCS) will focus on the ATM and Debit application. The detailed standard and specification will make reference to ISO 7816, EMV 2000 version 4.1 and Global Platform version 2.1.1. The proposed card application will be independent from any card manufacturer / application and can be used / adopted by various type of cards / manufactures and personalization centers.

EMV compliance is a written and published test requirements and test cases for the terminal to chip card interface (level 1) and for the payment application (Level 2) EMV EMVCo, LLC, was formed in February 1999 by Europay International, MasterCard International and Visa International to manage, maintain and enhance the EMV Integrated Circuit Card Specifications for Payment Systems.

Multiple card distributors would be able to supply the cards, thus would ensure competition and price efficiency.

GlobalPlatform is an independent, not-for-profit international association, focused on establishing and maintaining interoperable specifications for single and multi-application smart cards, acceptance devices and systems infrastructure that deliver benefits to issuers, service providers and technology suppliers. These specifications are known as the standard for smart card infrastructure, a combination of technical superiority and business justification.
18

Experiences in Indonesia
Overall Solution Guidelines
ISO 7816 Contact Card Std

ISO 14443 Contactless Card Std

Adheres to the international recognized standards and specifications: ensures card and smartcard reader compatibility ensures cards issued are interoperable amongst the three switching operators ensures common transmission protocol for the smart cards ensures common behavioral reaction to the readers

19

Experiences in Indonesia
NSICCS Preliminary Concept Design ATM & Debit Application Structure

Compliant with ISO7816 and EMV2000 on a Global Platform Backward compatible to be able to work on Native cards; must be a hybrid with Magnetic Stripe Contact or combination of contact and contactless; i.e. combi card
EMV Contact Interface

VSDC

ATM/ Debit

MChip Stored Value Apps

Reserved Post Issuance

Can co-exist with other applications or exist on its own

Card Operating System

Certified by local Certification Authority, the relevant certification bodies for other applications

Diagram: ATM and Debit Application on a native card

20

Experiences in Indonesia
Current Status for NSICCS

Phase 1 (1st 3rd month) Requirements Study & Specification esign

Phase 2 (4th 6th month)

PHASE 3

Proof-of-Concept (POC)

Implementation & Roll-Out

21

Summary and Recommendations

Must have a strong business case Input from all member banks Co-operation among the banks and vendors (ATM machine, bank-end host) Be able to consider future trend : SVC, Internet Banking Project Scheduling (Timing) Certification Body

22

Thank You

David Lee VP of Sales Castles Technology Co. Ltd. david_lee@castech.com.tw

23