In 2019, EMVCo began work to change the EMV® Integrated Circuit Card Specifications for Payment Systems to support the 2017 version of the ISO/IEC Identification cards — Identification of issuers – Part 1: Numbering System standard (7812-1) which defines Issuer Identification Numbers (IINs) as eight-digits. The expansion to 8-digits reflects the growth of customers and services that are operating globally. Changes of this nature impact the entire payments ecosystem. So how did EMVCo approach this challenge?
The Challenge
The Issuer Identification Number (IIN) is the number that identifies the card issuer and that forms the first part of the primary account number (PAN – the long number on the front of the card).
As the global payments marketplace continues to expand with new services and customers, it is vital that the financial institutions that are responsible for card issuance continue to be accurately and consistently identified.
The International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) published a new version of the ISO/IEC 7812-1 standard which defines IINs as eight-digits to enable the remaining supply of IINs to be used more efficiently to support more card issuers. This would result in payment cards having eight-digit IINs for IINs issued starting from January 2017.
Entities to whom 6-digit IINs have previously been assigned to prior to the new standard, were encouraged, but not required, to adopt and support the move to the 8-digit IIN. The payments industry needed to identify how it could evolve its systems to adopt the ISO/IEC 8-digit IIN consistently, as well as understand the wider implications for the payment community.
The Impact
From a payment perspective, it was recognised that the technical functionality of terminals would need to evolve to recognise the 8-digit IIN and that potentially some holders of 6-digit IINs would not migrate to the new IIN length. Routing principles would also need to be adapted to address the changes. These could be undertaken over several years as system maintenance updates are completed.
The Solution
In acknowledgement of the wider impact, EMVCo issued an external statement to advise all parties of the changes needed to align with ISO/IEC standard, to evaluate their systems and requested feedback on this impact.
In EMV Integrated Circuit Card Specifications for Payment Systems, there is a data element defined as Tag ‘42’ – IIN, which supports six-digit IINs. EMVCo recommended extending the existing Tag ‘42’ – IIN to support both six and eight-digit IINs.
Following the call-to-action to request industry feedback concerns were raised that some payment terminals may consider a Tag ‘42’ longer than six digits as invalid data and terminate the transaction. To address this, the decision was made to assign a new Tag ‘9F0C’, allowing terminals to identify both[1].
An update to the EMV Integrated Circuit Card Specifications for Payment Systems has now been officially published and can be downloaded. The approval process to confirm payment terminals can recognise the new Tag is also live.
Next Steps
EMVCo does not mandate the use of its specifications and industry stakeholders are free to choose from any or all of the related EMV Specifications to address their customer and marketplace needs. This means that EMVCo will support six and eight-digit IINs while there is a requirement within the payment community.
EMVCo is also continuing to inform merchants, processors and other stakeholders that they need to ensure time is taken to evaluate how they use IIN and/or PANs and that systems are updated appropriately.
—
[1] Please note that only the limitation of the Tag ’42’ IIN is addressed by this specification update. The other EMV data objects that include the IIN, such as the Application Primary Account Number (Tag ‘5A’), Track 2 Equivalent Data (Tag ’57’), Issuer Public Key Certificate (Tag ’90’), ICC Public Key Certificate (Tag ‘9F46’), and ICC PIN Encipherment Public Key Certificate (Tag ‘9F2D’), can already accommodate an IIN up to eight digits.
by Arman Aygen
by Jonathan Main
by Bastien Latge