Property of the EMV Migration Forum © 2013 ATM COMMITTEE Canadian Lessons Learned Bruce Renard, Execuive Director The National ATM Council, Inc.

Property of the EMV Migration Forum © 2012 General Implementation Issues -Canada had 3-4 years to implement EMV & manufacturers were forced on the front end by the banks/Interact to rewrite the software -Announcement of EMV implementation end of 2008 – time from software availability (10-09) until 100% compliance ( ) = 3 years – Liability shift phase in began A phased deadline for set % of providers’ machines to be in compliance was provided in Canada (50% - 100% benchmarks) -Timing specifics were somewhat vague – when the details were finalized & announced – very little time to get the work done -It is important for ATM providers to promptly press their manufacturers for certified hardware/software solutions -“Touch” in Canada (= NFC ) has a $100 limit– then cardholder needs to reenter PIN – enabling Touch feature is optional for ATM operator in Canada -Need to determine what will be different for EMV standards/handling as between Canadian and the US -Need a widespread/open ISO communication pipeline to disseminate info on EMV related issues/fixes -Given all the different networks/banks/processors in the US – vs. the simplified structure in Canada—we have out work cut out for us -All networks must be coordinated for card standards/timing/software certification/etc. or the problems will be significant -All manufacturers/models must be certified & approved by the Processors to work on all the networks – how do we make certain this is accomplished within the applicable liability shift deadlines? -Reconciling liability shifts with hardware/software solutions throughout the food chain is critical - Must have certification across the board – then allow adequate time for software and EMV compliant machines to be shipped – & then allow adequate time for installation of new hardware/software before broad liability shift occurs

Property of the EMV Migration Forum © 2012 CUSTOMER EDUCATION -Screen graphics from manufactures informing customers of different procedures with EMV are not intuitive – the changed user experience requires clear instruction/education = Insert your card & do not remove it until after you’ve entered your PIN –Providers needed to redo their screen graphics vs. using what was provided by the manufacturer – major consumer learning curve -Removing card too early on some hardware will damage the card reader -One should consider placing physical signage at the machine location telling users to leave card in until after PIN is entered

Property of the EMV Migration Forum © 2012 HARWARE/PROGRAMMING/CONNECTIVITY -Need for ATM manufactures to provide EMV compliant terminals and upgrade kits/parts/software/etc. ASAP, including: disclosure of the software version & compatibility/interoperability (by model) -If Pin Pads are PCI compliant these should work in an EMV environment (need to confirm with manufacturer) -In Canada PCI pin pad standards are still in place & must be maintained (rationale: EMV relates to the card reader vs. the pin pad – however as a practical matter EMV affects pin pads & bezel) --- -Buffer size on non PCI compliant pin pad to small to handle EMV -Security packets with EMV can become very large and potentially service affecting depending on software -Need to implement high speed internet communications connection – or machines become too slow (90second transaction time with traditional wireline – TDM wireless a bit better – IP wireless still better) (analogy for older non IP connections = like running your brand new laptop off a dial up connection = slow) (get ATMs on high speed access - or you will get blamed & lose the account) -Card readers: Some EMV readers have had high failure rates – as high as 50%; need to have a good solid card reader -Static will cause the card to get stuck & no money to be dispensed – problem: machines are not well grounded – this was a huge issue – hardware is available to address this – mother board – ‘reset board’ provided free for some EMV card readers -ATMs must be well grounded – with a chip machine power is critical – power surge destroys mother board – investigate additional grounding options (add this at same time as EMV upgrade – to avoid making an additional visit) -Stable Power is very important in an EMV environment. “Clean” power supply devices are worthwhile for best locations ($70-100) / a power tester device will tell you how clean the power is at each location & whether this is an issue (tester costs $ ) -Upgrades: some products require laptop to do the download -Waiting until later in the transition cycle to deploy new EMV compliant machines will avoid another service visit -The internal “date” on the ATM machine must be correct – or the transaction will be declined with EMV

Property of the EMV Migration Forum © 2012 BANK/CARD ISSUES -Bank ATMs implemented EMV in Canada before IADs -How will banks handle U.S. card & ATM migration? -Will mag stripes continue to work throughout the migration period—or will issuers begin denying these at EMV ATMs as an anti-fraud initiative? -Non-uniform denials of EMV card transactions at non-EMV enabled machines & vice-versa was a real problem for the Canadian transition (“throttling”) -Will failover to mag stripe work when EMV fails?