1. Presented by David Cole CVM Methods

2.  CVM Methods in the End-to-End Process  What is a CVM List?  Risk protection tool  Types of PIN processing  CVM list considerations  Visa recommendations  Summary Agenda

3. Chip End-to-End process ATC checking Online CAM Script processing Cardholder Verification Method Terminal Risk Management Card Risk Management iCVV checking ISSUER HOST Online PIN AUTHORISATIONS Offline PIN Validation

4. What is a CVM List?  Card contains a list of methods of cardholder verification in priority order  Terminal checks to see if it can support the method accordingly  Card’s CVM list contains  Condition  Type  Code Cardholder Verification Method

5. What is a CVM List? CVM Condition CVM Type CVM Code When the CVM should be used Describes the CVM method What to do if the CVM fails Examples: Always If terminal supports If transaction is cash or cash-back If transaction is less than X or more than Y Type: Biometric Offline Enciphered PIN Offline Plaintext PIN Online PIN Signature No CVM Apply the next CVM in the list Fail the CVM now Card defines Cardholder Verification Method

6. Risk protection tool Cardholder Verification Method Traditional Fraud Method Traditional prevention Chip prevention (additional to traditional methods) Lost and stolen / cards not received Activation processes Secure transportation Domestic online PIN Offline Plaintext PIN Offline Enciphered PIN Online PIN

7. Types of PIN processing  Online PIN as per today’s processing  Offline Plaintext PIN (new with EMV)  Offline Enciphered PIN (new with EMV) Cardholder Verification Method

8. PIN MethodProcessCard characteristics Offline Plaintext PINPIN entered in PIN PAD Terminal passes PIN securely to the card Card validates Card does not require an RSA crypto-processing Offline Enciphered PINCard provides terminal with Card Key (RSA) PIN entered in PIN PAD Terminal encrypts PIN with Card Key and sends to the card Card decrypts PIN and validates Card requires an RSA crypto- processor Types of PIN processing Cardholder Verification Method

9. CVM lists (considerations) Cardholder Verification Method  Do you want to perform Offline PIN?  Do you want to perform Online PIN?  Infrastructure devices available  POS  ATM  Unattended devices (Kiosks, Petrol, Parking etc.)  Is your market 100% online (zero terminal floor limit)  Visa guidelines are available in card perso-templates

10. CVM lists (considerations) CVM MethodCVM Condition CVM Code Offline Plaintext PIN If terminal supportsYes / No Online PINIf terminal supportsYes / No SignatureIf terminal supportsYes / No No CVMIf terminal supportsYes Apply each device to the table Decide the order of CVM

11. CVM lists (considerations) CVM MethodCVM Condition CVM Code SignatureIf terminal supportsYes / No Online PIN If terminal supportsYes / No Offline Plaintext PIN If terminal supportsYes / No No CVMIf terminal supportsYes Apply each device to the table Decide the order of CVM

12. CVM lists (considerations) Steps to defining a CVM list Choose card CVM functionality (type) Agree when the CVM should be performed (condition) Decide on any Fallback processing based on transaction type (code) Refer to Visa recommendations for assistance

13. Visa recommendations Card TypeRecommended CVM List Online Visa Electron with offline Plaintext PIN Offline Plaintext PIN Online PIN Signature Offline capable Visa Electron with Plaintext PIN and Issuer Authentication Offline Plaintext PIN Online PIN Signature No CVM (optional) Offline capable Visa Electron with DDA, Enciphered Offline PIN and Issuer Authentication Offline Enciphered PIN Online PIN Signature No CVM

14. Visa recommendations Card TypeRecommended CVM List Visa Debit Credit with Offline Plaintext PIN and Issuer Authentication Offline Plaintext PIN Online PIN Signature No CVM Visa Debit Credit with DDA, Enciphered Offline PIN and Issuer Authentication Offline Enciphered PIN Online PIN Signature No CVM

15. Summary Cardholder Verification Method  CVM processing is an offline EMV method  Very important part of the cards functionality  Need to assess your market conditions  EMV enables PIN validation offline  Follow Visa guidelines but make the right decision for your Bank