Visa International Operating Regulations

LIABILITY SHIFTS

ALL NEW CHIP CARDS AND ACCEPTANCE DEVICES EMV COMPLIANT

EARLY vs. FULL

CHIP and PIN

REGIONS

Domestic Liability Shift

Intra-regional Liability Shift

Bi lateral Liability Shift

All new devices must be EMV*

All devices must be EMV*

All chip Cards must be EMV compliant

Global dates Regional noncompliance penalty Jan 2008 - all chip issuers to support iCVV and all newly issued chip cards have to have iCVV. Also the CVV on other (nonm/s) technologies must differ from CVV on the physical m/s

All New ATMs

ACQ Hosts certified for EMV data

Start of EMV rollout, Chip and PIN enabled

AP Region Chip requirement only Issuers must issue chip for 80% of their total new card base once they reach a predefined chip maturity - Taiwan, Malaysia, & Japan to begin from Jan 2007, Singapore Jan 2008 and Thailand Apr 2008 Market Trial for all Issuers and Acquirers July 07 Feb. 08 Device rollout 2005+ Card Rollout Q407 + Natural Reissuance

AP

1. Jan 2005 Malaysia 2. Jan 2006 Taiwan / Korea / India / Indonesia 3. 1 April 2006 The rest of the markets in AP 4. 1 July 2006 Thailand& Pakistan 5. 1 July 2007 Hong Kong & Macao

Jan 2006

N/A

From 2003 Stand-alone POS From Jan 2006 All POS Devices

All ATM devices have to be upgraded to be chip capable (nonEMV) by end 2004 Taiwan & Malaysia

2003 New chip acquirers; 2006 all chip acquirers

Canada

Oct 2010

Tri-Lateral Liability Shift with EU and CEMEA presently under Regional review

Full Data Only Acquirer Certifications occur between June 2005 and Dec. 2006

03/29/2007

Visa Public

-1-

Visa International Operating Regulations

LIABILITY SHIFTS

ALL NEW CHIP CARDS AND ACCEPTANCE DEVICES EMV COMPLIANT

EARLY vs. FULL

CHIP and PIN

REGIONS

Domestic Liability Shift

Intra-regional Liability Shift

Bi lateral Liability Shift

All new devices must be EMV*

All devices must be EMV*

All chip Cards must be EMV compliant

All New ATMs

ACQ Hosts certified for EMV data

Start of EMV rollout, Chip and PIN enabled

01 Jan 2006 Acquirer must ensure all onlinecapable chip reading merchant devices support both plaintext PIN verified offline and enciphered PIN verified offline CEMEA 01 Jan, 2006 01 Jan, 2006 Europe 01 Jan 2006 Acquirer must ensure all onlineonly chip-reading merchant devices support enciphered PIN verified online if these devices do not support both plaintext PIN verified offline and enciphered PIN verified offline Oct 2001 Existing chip July 2002 Existing chip and CEPS 2001 01 Oct 2004 Full EMV

Europe

2005

2006 CEMEA

2001 PIN from Jan 2005 if online capable

2001

2001

03/29/2007

Visa Public

-2-

Visa International Operating Regulations

LIABILITY SHIFTS

ALL NEW CHIP CARDS AND ACCEPTANCE DEVICES EMV COMPLIANT

EARLY vs. FULL

CHIP and PIN

REGIONS

Domestic Liability Shift

Intra-regional Liability Shift

Bi lateral Liability Shift

All new devices must be EMV*

All devices must be EMV*

All chip Cards must be EMV compliant

All New ATMs

ACQ Hosts certified for EMV data

Start of EMV rollout, Chip and PIN enabled

LAC

2006 POS 2007 ECR Mexico

Liability shift 2 years after 50% of regional credit card sales volume is chip based trigger approach Not including ATMs 2007 Critical mass 2008

2004 (EMV L1) + Variable length PAN capable

2004

2004 (EMV L1)

2004 Early EMV

US

NA

NA

NA

NA

NA

NA

NA

2000 Early EMV

NA

03/29/2007

Visa Public

-3-

Visa International Operating Regulations

LIABILITY SHIFTS

ALL NEW CHIP CARDS AND ACCEPTANCE DEVICES EMV COMPLIANT

EARLY vs. FULL

CHIP and PIN

REGIONS

Domestic Liability Shift

Intra-regional Liability Shift

Bi lateral Liability Shift

All new devices must be EMV*

All devices must be EMV*

All chip Cards must be EMV compliant

All New ATMs

ACQ Hosts certified for EMV data

Start of EMV rollout, Chip and PIN enabled

Global

Support variable length (up to 19 digits) PAN capable by 1 Jan 2005

Support variable length (up to 19 digits) PAN capable by 1 Jan 2007 + DDA Active (unless for Online Auth)

1 January 2001

03/29/2007

Visa Public

-4-