2016 Convention “New” Secure Transactions…What are the Differences? 1

Agenda Introduction to New Secure Technologies EMV Tokenization Visa Checkout Payments of the Future Glossary 2

Introduction to “New” Secure Technology Card payment options for your members have changed radically since the 1960s– 1970s, when the only choices were magnetic-stripe plastic cards and relatively simple merchant terminals and ATMs 3

Introduction to “New” Secure Technology For a long time, U.S. issuers effectively managed fraud in the zero floor-limit (always online) environment using online fraud detection tools. The rapidly changing fraud landscape and the scale of recent data breaches make EMV a compelling long-term solution. The value of EMV is that it devalues static magnetic stripe track data and introduces a secure dynamic element into each and every transaction. 4

Introduction to “New” Secure Technology What do these four things have in common? 5

EMV What is EMV ? The key element of EMV involves including dynamic digital data in every transaction. This makes these types of transactions extremely secure and reduces the risk of fraud. How does EMV reduce fraud?  Payment transactions are getting smarter. And at the heart of these smarter transactions is dynamic authentication, which incorporates unique information in each transaction making it virtually impossible to replicate.  The EMV standard has already been adopted by more than 80 countries where it has significantly reduced counterfeit card fraud, saving hundreds of millions of dollars. 6

EMV-How Does it Work? An EMV transaction authorization follows this process:  A cardholder inserts an EMV chip card into a reader.  The POS terminal identifies what payment brand’s application is on the card.  The terminal selects the appropriate EMV application and uses a data set associated with each payment brand to enforce the brand’s application requirements.  The card and terminal follow an EMV-specified protocol process to conduct a dialog that allows each of them to execute their respective risk management processes.  One of the key attributes of EMV is the ability to authenticate the card to be sure that it is not a clone or counterfeit of the card 7

EMV-Where is the U.S.? Initial card issuance efforts focused primarily on consumer and commercial credit cards, with debit cards now following quickly. Although the early adopters were mainly large issuers, many of the 10,000-plus financial institutions in the U.S. have either begun issuing chip cards or have active issuance projects underway. Some of the most recent projections of the estimated number of EMV chip cards and acceptance locations or devices that will be in the market are below:  Smart Card Alliance reported as of September 2015, the U.S. has over 200 million EMV cards issued.  The Payments Security Task Force (PST) eight financial institution members (representing approximately 50 percent of U.S. payment card volume) reported that 60 percent of their U.S. consumer credit and debit cards will contain EMV chips by the end of 2015, expanding to 98 percent by the end of  Visa reported in September of 2015 that approximately 57 percent of consumers have at least one chip card in their wallet. The merchant community has been somewhat slow to adopt EMV, due primarily to two factors:  Residual uncertainty regarding the U.S debit solution (merchants want to avoid multiple terminal or software upgrades). Although specifications for the U.S. debit solution have been published, some industry participants are still in the process of debit testing and certification.  The number and variety of merchant terminals and the fragmentation of the merchant community. 8

EMV-Why the Switch? The major global brand networks announced that starting in October 2015, fraud liability may shift to the party with least security. This means merchants who are not equipped to accept EMV transactions will become liable for some types of fraudulent transactions initiated using an EMV enabled card. An EMV chip payment transaction is more secure than a magnetic stripe transaction, resulting in stronger fraud prevention for card present transactions. As an issuer, if your cards are not EMV enabled fraud liability will remain as it is today. 9

EMV-What is the U.S. Experiencing? Credit Cards Credit Unions have been enabled since August to issue EMV cards. The U.S. was able to apply the technology that has been established in other countries to the implementation of credit card EMV. As with all new technology there have been changes to the way things were expected to work. Transactions are approving as EMV and credit unions are using a variety of issuance strategies based on business plans. As a whole the industry is seeing few problems with EMV for credit cards. Debit Cards The Durbin Amendment is a federal law with several provisions regulating the debit card industry in the U.S. One of the provisions mandates that merchant acquirers provide a choice of networks to merchants for routing debit card transactions. The law requires that all debit cards support at least two unaffiliated networks. The EMV specification uses an Application Identifier (AID), which is a string of characters that identifies the network and the specific type of card. This AID is proprietary to the card brands and cannot route to different networks. Various EFT networks proposed the creation of a common AID that would apply to any network and allow routing to a merchant's preferred network according to a table of Bank Identification Numbers (BIN) that would identify which networks the card issuer belongs to and which networks the merchant prefers. The technology for the common AID for debit is new and has not been used before. There have been reports of different experiences by cardholders at POS terminals. 10

EMV-Fraud Moves to New Channels 11

EMV-Near Field Communications Simultaneously with the U.S. move to EMV chip card payments, Near Field Communication (NFC) technology is emerging as a useful accessory for consumer transactions. NFC is not a payment technology; it is a set of standards that enables proximity-based communication between consumer electronic devices such as mobile phones, tablets, and personal computers. NFC supports an extremely simple man-machine interface, facilitating its use for a number of functions, including mobile payment. NFC technology is compatible with the current contactless payment acceptance infrastructure—an NFC-compliant mobile device can communicate with a point-of-sale (POS) system that currently accepts contactless payment cards. NFC and EMV are companion technologies. NFC applies to how devices communicate; EMV applies to payments made with contact and contactless chip cards or with a mobile NFC device emulating a contactless chip card. Contactless payment transactions made using mobile NFC devices use the same infrastructure as contact and contactless EMV chip card transactions. While EMV chip migration is driven by the need to reduce payment card fraud, the use of mobile NFC devices is motivated by their ability to support mobile payments and value-added services. 12

What is Tokenization? 13

14 Tokenization-How does Tokenization Reduce Fraud?

15 Tokenization – What is the transaction flow?

Apple iPhone 6, 6 Plus, 6S and 6S Plus, Apple Watch, iPad Air 2, iPad Pro and iPad Mini 3 and 4 Samsung Galaxy S7, S7 Edge, S6 Edge+, Galaxy Note 5, Galaxy S6 and S6 Edge Android phones with NFC and HCE support running KitKat (4.4) or higher US and UKUS, South Korea and ChinaUS Fingerprint (TouchID) authenticationFingerprint or PIN authenticationNo fingerprint authentication Works with NFC terminals and in- app purchases Works with NFC, magnetic stripe or EMV terminals Works with NFC terminals and soon for in-app purchases Credit, debit, selected loyalty cardsCredit and debit cardsCredit, debit, loyalty and gift cards Wide variety of FI’s.American Express, Visa, MasterCard through Bank of America, Chase, Citi, US Bank, Wells Fargo-issued cards. Merchant cards through Synchrony Financial. American Express, Discover, Visa, MasterCard through Bank of America, Citi, Discover, Navy Federal Credit Union, PNC, Regions, USAA, US Bank, Wells Fargo 16 Tokenization - What are the options?

Earlier in 2015 Samsung acquired mobile payment company LoopPay which developed the specific MST technology used for Samsung Pay.Samsung acquired mobile payment company LoopPay Samsung Pay uses Near Field Communication (NFC) technology to process payments at tap-to-pay terminals. However, the system also works with almost all other magnetic stripe terminals as well. These older systems are widely deployed throughout retailers in the US. Samsung Pay uses Magnetic Secure Transmission (MST) when the phone is held against one of these registers. The phone emits a magnetic signal that simulates the magnetic strip found on the back of a credit or debit card. 17 Tokenization – Samsung Pay

HCE Host Card Emulation (HCE) describes on-device technology that permits a phone to perform card emulation on a Near Field Communication (NFC)-enabled device without relying on access to a secure element. SE SE (Secure Element) can be considered a smart card in the phone which is isolated from tampering by a restricted access interface and strong encryption. This also limits fraud opportunity to each device. Tokenization - What is the difference? 18

19 Visa Checkout

What is Visa Checkout? Visa Checkout makes online shopping more enjoyable by making it easy to complete your purchase. Simply enter your username and password and speed through your online shopping experiences with a single account that can be used across all your devices. No need to re-enter your card number or address. And you can store and use any major credit or debit card. Some benefits of Visa Checkout include: Reducing the number of payment screens to just two, eliminating the need to reenter shipping and billing addresses. Offers a consistent, simple experience across desktop, mobile web and apps Shoppers never leave the merchant’s website to complete a purchase. Cardholder can pay with any major debit or credit card For more information about Visa Checkout, visit: 20 Visa Checkout

Visa Checkout Value Proposition Consumers Merchants Issuers  Increase sales  Cross channel commerce  Attract new consumers  Value added analytics  Reduce fraud + Convenience + Security + Ease of use + Customized Preferences + Targeted, relevant offers + Protect from disintermediation + Expand relationship with cardholders + Gain new relevance in the digital economy + Drive brand impressions within digital space + Gain additional insight on cardholders 21

Visa Checkout is attracting top retailers, including: Note: All brand names and logos are the property of their respective owners, are used for identification purposes only and do not imply product endorsement. About $63B (1) in TAPV from live and signed merchants including 20+ merchants from Internet Retailer’s top 100 Why merchants partner with Visa Checkout: Visa brand recognition and trust No fees No change in transaction flow Simple integration Account verification at enrollment Customer never leaves the merchant site Device fingerprinting Consistent web, mobile-web, in-app customer experience Support for network level tokens (coming soon) Potential issuer partnerships

Payments of the Future 23

24 Payments of the Future – Selfie-Pay MasterCard says it plans to bring "selfie pay" security checks to more than a dozen countries. Last year, the company started trialing the technology — which uses facial recognition to authenticate users' identity — but now says it has firm plans to roll the feature out to users after positive reactions from testers.

Glossary APIApplication Program Interface is a set of routines, protocols, and tools for building software applications EMVEuropay, MasterCard, VISA is a global payment system which places a microprocessor chip into credit, debit and prepaid cards. MSTMagnetic Secure Transmission technology patented by LoopPay generates an alternating current through an inductive loop of changing magnetic fields. This does not require merchants to make changes to their existing payment system if they already offer NFC. SE Secure Element can be considered a smart card in the phone which is isolated from tampering by a restricted access interface and strong encryption. This also limits fraud opportunity to each device. HCEHost Card Emulation (HCE) describes on-device technology that permits a phone to perform card emulation on a Near Field Communication (NFC)-enabled device without relying on access to a secure element. NFCNear Field Communication – Standards-based wireless technology allowing data to be exchanged between devices that are within close proximity MDESMasterCard Digital Enablement Service PIIPersonally Identifiable Information VDEPVISA Digital Enablement Program TEETrusted Execution Environment BLTEBluetooth Low Energy 25