EMV Evolution: A Journey through History and the New EMV Contactless Kernel Specification C-8

EMV/Chip Background

EMVCo

In response to the growing Magstripe card fraud problem worldwide, international payment systems jointly started the development of global chip specifications, and in 1996 EMV Chip Specifications are released. In 1999, EMVCo was formed by Europay, Visa, and MasterCard to maintain and enhance the EMV Chip specifications.

EMV Contact Chip

To facilitate worldwide interoperability and acceptance between cards, payment terminals, issuers, and acquirers, EMVCo first published EMV Contact Chip Specifications which are listed in Emvco (Book 1, Book 2, Book 3 and Book 4). Today, over %90 of card-present payments are made using EMV Chip cards.

EMV Contactless

MasterCard Contactless technology PayPass was first introduced in September 2004 with the Pilot program launched by Mastercard and Orient Corporation in Japan. The standard was based on EMV/Chip technology, but card and reader communication was based on RF. For better user experience, EMV transaction flow was optimized to complete the transactions in less than 500 ms.

In 2005, to ensure that cards and terminals supporting any card scheme undergo the same testing and certification processes and to establish interoperability, MasterCard and Visa reached an agreement to share PayPass ISO/IEC 14443 implementation protocol for the low-level(L1) card and reader communication. Then MasterCard assigned the PayPass ISO/IEC implementation specification to EMVCo. But sadly, contrary to EMV Contact Chip specifications, in the application layer(L2), each card scheme released its own standards.

· MasterCard Contactless (PayPass) / EMVco C-2 Kernel

· Visa Contactless(payWave) / EMVco C-3 Kernel

· American Express (ExpressPay) / EMVco C-4 Kernel

· Discover Contactless (DPASS) / EMVco C-6 Kernel

Global Contactless payment adoption rapidly increased in the world in recent years. Especially Covid-19 boosted the increase in contactless payments. And for a while, EMVCo has been working on a new shared contactless specification.

EMV Contactless C-8

Having different standards for each card scheme has been a big issue for the payment industry (issuers, acquirers, and terminal/card software vendors). For a better illustration;

Terminal with EMV Contact:

· L1 Certification (ISO7816)

· L2 Certification — EMVCo (Book1, Book2, Book3, Book4)

· L3 Certification

Terminal with EMV Contactless:

· L1 Certification (ISO14443)

· L2 Certification — MasterCard / C-2

· L2 Certification — Visa / C-3

· L2 Certification — AmericanExpress / C-4

· L2 Certification — JCB / C-5

· L2 Certification — Discover / C-6

· L2 Certification — UnionPay / C-7

· L3 Certification

This means terminal vendors will need to go through 6 different certifications to support all big card schemes` contactless standards on their terminals. It means there will be an additional 3–6 months for each certification on top of the project timeline, and terminal vendors will need to consider test tools and certification (TA) fees for each card scheme.

As a significant move towards a common platform for EMV contactless payment transactions, EMVCo finally published the C-8 specification in October 2022. During the transition period, the C-8 Contactless EMV specification will co-exist with legacy kernels and will use existing terminal architecture which is defined in Book A and Book B. For the licensing and royalty fee conditions, it will work in a similar way as the EMV contact Chip Specifications.

Considering the changes in technology and security needs, the new specification comes with the following key features.

· Secure Channel

· Elliptic Curve Cryptography(ECC)

· Biometric Card Verification Methods

· Mobile Card Verification Methods

· Optimizations for Cloud kernel and Cloud operations

· On-Card Data Storage option

With the common new C-8 standard, terminal vendors, merchants, issuers, and acquirers will invest, develop and support one Contactless payment specification, which will also make the manufacturing and deployment process easier, less costly, and more straightforward.