.svg)
EMVCo, the global technical body for card payments, has said in the year ahead it will focus on the testing of its contactless kernel specification, investigating opportunities in omnichannel payments and enhancing e-commerce.
2022 closed with a number of milestones reached, EMVCo said in its recently published annual report.
Last year, the body published its first contactless kernel specification, which provides a single set of functions for payment acceptance devices to process contactless transactions, and updated the EMV 3DS specifications to help issuers and merchants mitigate growing card-not-present fraud risks.
It also updated its secure remote commerce (SRC) specifications to support a more flexible online checkout and published a guide to use cases for EMV payment tokenisation.
Building on this work, EMVCo will focus its efforts on three main areas in 2023: enhancing the EMV chip; supporting changing payment preferences; and promoting seamless and secure e-commerce payments.
Initiatives to evolve EMV chip
Following the publication of the contactless kernel specification, EMVCo is now working on a supporting testing programme.
As reported by VIXIO, there are more than 20 different payment system contactless kernels in use around the world, which adds complexity and heightened costs to contactless card acceptance.
Over time, the specification can help reduce the number of contactless kernels that stakeholders need to support and maintain, creating opportunities for merchants, hardware providers and payment systems to reduce costs, and improve rollout speed and time to market.
EMVCo anticipates that test tools will be available for development and debugging in the first half of 2023, with the full testing suite to follow in 2024.
The body said that the contactless kernel specification, along with an update to enable elliptic curve cryptography (ECC) on EMV chip cards, was a “strategic decision to enable EMV chip to keep pace with classical attacks without impacting performance”.
ECC was enabled in October 2021 and its main purpose is to make payments more efficient by reducing transmission and computing time.
EMVCo is planning to publish updated EMV chip security guidelines in 2023, which will address the use of ECC across the specifications.
In addition, it will share a new book on security and key management of EMV contactless specifications for payments systems with its associates in Q1 2023.
The document will define the approaches and cryptographic methods, including ECC, to ensure adequate security functionality.
Associates, which include large market players such as Ant Group, eftpos, the European Payments Council, FIS, Google, the National Payments Corporation of India, Nets, Square, Stripe and The Clearing House, will then have an opportunity to review and discuss the book.
The report notes that “each passing year brings the payments industry closer to a truly post-quantum world”, and EMVCo continues to explore the potential risks of quantum computing on current cryptography.
According to the body, there were 12bn EMV chip cards in global circulation in 2021, and in June 2022 around 92 percent of all card-present transactions conducted globally used EMV chip technology.
Supporting changing payments preferences
Supporting the delivery of secure, quick and convenient checkout experiences, regardless of how consumers pay, is an ongoing priority for EMVCo, the body said.
Payment cards have already seen widespread digitalisation, which enables consumers to pay with their smartphones, wearables and other mobile devices.
The body said it continues to evolve its Level 1 testing requirements to support the use of different form factors at the point-of sale (POS).
At the same time, digitalisation is also becoming more common in payment acceptance, with smartphones and tablets increasingly used in place of traditional POS terminals.
In 2022, EMVCo concluded the TapToMobile Early Adopter Programme, which aims to support the use of consumer mobile devices for contactless payment acceptance.
The body is now assessing the data gathered and exploring the definition of “acceptance criteria” to ensure a good user experience.
It is also planning to publish a white paper exploring the data and security considerations of the use of wireless technologies, such as wifi, ultra-wideband (UWB), bluetooth low energy (BLE) and mobile data for in-store payments across various use cases.
“As the importance of ‘omnichannel’ grows, EMVCo will continue to investigate opportunities to enhance the EMV specifications in line with evolving expectations and industry feedback from our advisors,” the organisation says.
E-commerce payments
A number of EMV specifications support technologies that are used in e-commerce payments.
A testing framework for the latest version of EMV 3DS v2.3.1 is expected to be available from January 2023 and the body is actively consulting on key features to be included in version 2.4 of the specification.
In addition, EMVCo plans to publish a white paper in Q2 that provides payments stakeholders with examples and use cases for key 3DS features and support implementation.
The report recognises that changing browser privacy requirements impact the use of consumer data throughout the transaction process and says that EMVCo works with the FIDO Alliance and the World Wide Web Consortium (W3C) to ensure that the organisations’ respective technologies can continue to provide a seamless and secure online payment process while promoting consumer privacy.
EMVCo was created by Visa and Mastercard in 1999 to administer the new specification, enhance payment security and support seamless payments. Since then, its membership has grown grew to additionally include American Express, Discover, JCB and UnionPay.
It engages and collaborates with stakeholders from the payments industry and has more than 90 associates.
