Issuer Identification Number Extension: EMVCo Evolves Contact Card Specification to Support ISO and IEC Changes
In 2019, EMVCo began work to change the EMV Integrated Circuit Card Specifications for Payment Systems to support a new version of the ISO/IEC 7812-1 standard which enables Issuer Identification Numbers (IINs) to be expanded to eight-digits. The new format reflects the growth of customers and services that are operating globally. Changes of this nature, however, could potentially impact merchant environments beyond payments that use card details to identify and reward customers. So how did EMVCo approach this challenge?
The Issuer Identification Number (IIN) is the part of the primary account number (PAN – the long number on the front of the card) which identifies the financial institution that issued the card. It has two main functions:
- For authorisation processes, it identifies the issuer to enable evaluation of the risk linked to the cardholder associated with the payment.
- For settlement processes, it identifies the issuer and account where the money originates from.
As the global payments marketplace continues to expand with new services and customers, it is vital that the financial institutions that are responsible for the payment continue to be accurately and consistently identified.
The International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) published a new version of the ISO/IEC 7812-1 standard in which IINs could be expanded to eight-digits to enable more IINs to be used across new services. This would result in payment cards having either six or eight-digit IINs.
The payments industry needed to identify how it could evolve its systems to adopt the ISO/IEC extensions consistently, as well as understand the wider implications for the payment community.
From a payment perspective, it was recognised that the technical functionality of terminals would need to evolve to recognise the extended IIN. Routing principles would also need to be adapted to address the changes. These could be undertaken over several years as system maintenance updates are completed.
Merchants and/or service providers sometimes use PAN or IIN as a basis to effectively identify a customer and offer relevant additional services outside of payments, such as loyalty programmes. This meant that other business systems beyond traditional payments may also require updates to ensure the longer IIN could still be used to identify a customer effectively.
In acknowledgement of the wider impact, EMVCo issued an external statement to advise all parties of the changes needed to align with ISO/ICE standards, to evaluate their systems and requested feedback on this impact.
In EMV® Integrated Circuit Card Specifications for Payment Systems, there is a data element defined as Tag ‘42’ – IIN, which supports six-digit IINs. EMVCo recommended extending the existing Tag ‘42’ – IIN to support both six and eight-digit IINs.
Following the call-to-action to request industry feedback concerns were raised that some payment terminals may consider a Tag ‘42’ longer than six digits as invalid data and terminate the transaction. To address this, the decision was made to assign a new Tag ‘9F0C’, allowing terminals to identify both.
An update to the EMV Integrated Circuit Card Specifications for Payment Systems has now been officially published and can be downloaded. The approval process to confirm payment terminals can recognise the new Tag is also live.
EMVCo does not mandate the use of its specifications and industry stakeholders are free to choose from any or all of the related EMV Specifications to address their customer and marketplace needs. This means that EMVCo will support six and eight-digit IINs while there is a requirement within the payment community.
EMVCo is also continuing to inform merchants, processors and other stakeholders that they need to ensure time is taken to evaluate how they use IIN and/or PANs and that systems are updated appropriately.
 Please note that only the limitation of the Tag ’42’ IIN is addressed by this specification update. The other EMV data objects that include the IIN, such as the Application Primary Account Number (Tag ‘5A’), Track 2 Equivalent Data (Tag ’57’), Issuer Public Key Certificate (Tag ’90’), ICC Public Key Certificate (Tag ‘9F46’), and ICC PIN Encipherment Public Key Certificate (Tag ‘9F2D’), can already accommodate an IIN up to eight digits.