Terminal Quality Management Overview 2010

Agenda Scope Requirements Benefits Process Recommendations for TQM implementation Fees Contact

TQM scope overview Scope Requirements Relevant devices: Terminal Level 1 Components - for contact: InterFace Modules (IFMs) - for contactless: Proximity Coupling Devices ( PCDs) Relevant Vendors: Vendors developing products embedding an IFM or a PCD Requirements Same structure as ISO 9001 Focus on configuration management Methodology Based on assessment of questionnaires with surveillance by audits.

TQM scope - EMV Level 1 Vs Level 2 OSI Model EMV Specifications Product Components 7 Application Level 2 Level 2 Component = Application 6 Presentation 5 Session 4 Transport Level 1 Component = IFM for contact Or PCD for contactless 3 Network layer Level 1 2 Data link layer The part of the testing process which is concerned by TQM is the interoperability testing. The Terminal functionalities required to obtain Card-Terminal interoperability are described in the EMV specifications. These specifications are structured following the OSI layers model. [Click on the indicator to show the separation between level 1 and level 2] The communication layers are divided in two parts in the EMV specifications. The Level 1 and the Level 2. Level 1 handles communication from the physical layer to the transport layer whereas Level 2 handles communication from the session layer to the application layer. TQM and the Terminal Type approval level 1 sub-processes focus only on the Level 1 functionality. 1 Physical layer TQM only focuses on Level 1 Component (s)

TQM scope - Product Configurations in the field Terminal PCD/IFM Level 1 Level 2 • Fully Integrated Terminal Terminal Card Reader • Terminal and PCD/IFM Intelligent Card Reader Level 1 Level 2 This slide explains the three different Product configurations that can be found in the field. [Click on the indicator to show the first Product configuration] Fully Integrated Terminal: PCD – or IFM for contact products- is fully embedded within the terminal covering also Level 2 requirements. [Click on the indicator to show the second Product configuration] Terminal and Intelligent Card Reader: PCD- or IFM- is embedded in a stand-alone card reader connected to the terminal with the card reader covering all Level 1 and Level 2 requirements. [Click on the indicator to show the third Product configuration] Terminal and Transparent Card Reader: PCD – or IFM- is embedded in a stand-alone card reader connected to the terminal with the reader only covering Level 1 requirements and the terminal part covers the Level 2 requirements. • Terminal and Terminal Card Reader Transparent Card Reader PCD/IFM Level 1 Level 2 = Products subject to TQM PCD = Proximity Coupling Device IFM = InterFace Module

TQM scope - Terminal Type Approval Level 1 Terminal Type Approval Level 1 testing TTA L1 Success Terminal Level 1 Valid only for the tested sample: Specific Level 1 component containing specific HW + SW Embedded in specific product (s) Is compliant with the relevant specification One sample Prototype/ Pre-series The vendor has been able ONCE to develop ONE compliant product configuration

TQM scope - Terminal Level 1 within a Product A change in one of these parts may impact the PCD/IFM functionality Level 1 component: PCD or IFM The PCD or IFM is the combination of software and hardware responsible for the EMV specifications compliance. But to work properly, the PCD/IFM must be provided with a correct working environment by the Product in which it is embedded. Let’s call the Product subpart responsible for this correct working environment, the PCD/IFM interface. The compliance to EMV Specifications depends on the PCD/IFM itself but also on the Product in which it is embedded. Level 1 Component interface Product Part without impact on PCD/IFM functionality

TQM scope - EMVco policy on changes Major change does require new Type Approval Vendor is responsible for assessing whether the change is minor or major and for demonstrating to the Acquirer that the change is minor. Source EMVco bulletin 11

TQM requirements TQM requires the vendor to have implemented a Configuration Management System ensuring that: The identification of the PCD/IFM and the PCD/IFM interface is sufficient and allows efficient impact analysis of changes on EMV compliance Appropriate processes are implemented to control and improve the Product configuration management from R&D to maintenance.

TQM requirements - Configuration management MasterCard needs to be confident that: Product configuration is controlled by the Vendor Identified Recorded Checked Impact of changes is assessed Subsequent unauthorized alterations are prevented (guidelines for maintenance, process for information release to manufacturing sites, etc..) That is the TQM purpose

TQM added value A TQM Label gives confidence that products are compliant with level 1 spec. products manufactured in volume, products which embed an approved IFM or PCD, but different from the tested model, products which embed an updated version of an approved IFM or PCD,

Benefits For the Acquirer Vendor change management is reliable and takes into account EMVCo change policy Configuration management of the products will be controlled and continuously improved by the vendor . Interoperability issues will be managed following a controlled process by the vendor. For the Vendor A means to demonstrate to Acquirers that changes done on their products are only minor changes. Allow more design flexibility with less cost for approvals. Give a marketing advantage.

TQM process - Overview Subcontracted to Assessment Body Renewal Mandatory process Conditional process Vendor Registration with Assessment Body Subcontracted to Assessment Body Product Registration Renewal Completion of TQM Questionnaires TQM Compliance Assessment TQM Audit Test of Product Samples TQM Label Recommendation and Preparation MasterCard TQM Label TQM Label Granting by MasterCard

TQM process - Outsourcing MasterCard has arranged for its Terminal Quality Management scheme to be administered by TÜV Product Service. From now on, the TQM primary contact is: Mr Dale WHITAKER tqmtuv@tuvps.co.uk +44-1489-558342 All your requests for registration, product plan number, documentation, granting of labels, TQM project management, etc. should be sent directly to tqmtuv@tuvps.co.uk

TQM process - Product registration Objective Identification of each Vendors IFMs or PCDs requiring a TQM label. Agreement on submission timescale Key Steps Vendor completes an Application Form listing all IFMs/PCDs that need a TQM label) and proposes dates for submission of TQM Questionnaires. Assessment Body confirms the schedule or agrees with the Vendor on a modified schedule. Assessment Body assigns a TQM Project Plan number for each PCD or IFM that needs one. Outcome Acknowledgement granted by granting of Project Plan number*. ( * formerly called action plan number)

TQM process - TQM is not required for Terminals not subject to TIP, (Terminal Integration Process) End-of-life products (no longer being manufactured)

TQM process - Questionnaires Vendor Organizational Description (VOD) Valid whatever the PCD or IFM Objectives: Configuration Management System description Identification of organizational changes done after last assessment Corrective actions follow up, Type Identification Description (TID) Specific to one PCD or to one IFM Objectives: Description of the TTA L1 tested configuration Description of all the PCD/IFM “evolutions” Description of all the PCD/IFM implementations within products Identification of product changes done after last assessment Corrective actions follow up, Based on self-assessment

TQM process - Recommendation to MasterCard Objective The assessment body to make a recommendation to MasterCard concerning the TQM Label* granting Key Steps Assessment Body send to MasterCard: The list of IFMs/PCDs involved in the TQM project A management summary of the TQM project The final audit report(s), if any A recommendation for the granting of TQM label(s). *Note that “TQM Label” means a unique reference allocated to an IFM/PCD following MasterCard’s acceptance of the TQM recommendation. Vendors will receive a “Statement of Compliance” listing all their TQM Labels. A physical label is not required to be attached to a terminal.

Recommendations for TQM implementation: Keep written documentation simple No need for translation into English Shorter is better Just improve existing documentation when needed Use existing processes Just improve existing process when needed Use existing tools

TQM pricing for EMV Contact and PayPass services Amounts in EUR Initial Fee Annual Renewal Fee Fee 1 TQM Program Fee (Note 1) 6 500 € 3 500 € Fee 2 Per additional VOD 2 000 € 1 000 € Fee 3 Per additional TID 1 250 € 800 € Fee 4 Per additional Manufacturing Site Fee 5 Audit Defined by TUV-PS Delivered by TÜV Product Service Note 1: Vendor Registration + 1 or 2 VODs + First TID

Contact TQM assessment body contact: tqmtuv@tuvps.co.uk MasterCard contact (for escalation purpose only): tqm@mastercard.com