Payments Journal recently spoke with GlobalPlatform’s Executive Director, Kevin Gillick, and representatives from member companies Giesecke & Devrient, UL Transaction Security and Visa Inc. about the transition to EMV® chip payment technology in the United States (US). Here they share their thoughts about key decisions facing stakeholders and GlobalPlatform’s value proposition for the EMV migration.
Could you please provide our readers with some context around GlobalPlatform and its relevance to EMV?
Firstly, it is important to note that GlobalPlatform is a ‘platform’ that is leveraged by many sectors (such as financial) and for many types of applications and functions, including payments. The EMVCo card personalization process (basic perso) is based on GlobalPlatform and the development environment (Java) is well understood in the industry.
GlobalPlatform Specifications are also relevant to EMV in a number of ways. They can be utilized in EMV chip payment cards, EMV wallet applications in a mobile device and also as part of the acceptance infrastructure as we are seeing in the mobile point of sale (mPOS) area, for example.
As you can see, GlobalPlatform is relevant to many stakeholders. In this interview, we’d particularly like to focus on the impact of EMV migration on the ‘issuer’ community.
There has been much talk in the US about the transition to EMV chip payments for card and mobile platforms, and the impact the transition will have on issuers. What are some of the key decisions issuers need to address as they manage this process?
There is good news for US issuers transitioning to EMV; they are not the first to walk down this road. GlobalPlatform is a proven technology that has been widely deployed and in use for many years. A deployment strategy that utilizes GlobalPlatform makes the transition to both card and mobile payments easy. In fact, the EMV Common Personalization standards were developed by GlobalPlatform, meaning a robust high-security personalization service is already in place for cards and mobile phones. This is important for issuers as it enables them to go to market with payment as a mono-app (card) or have the payment app coexist with other applications on a shared platform (mobile).
How does GlobalPlatform technology fit in?
GlobalPlatform has a number of established technical documents relating to card, device and systems specifications. These work in harmony to create a secure end-to-end infrastructure that supports the deployment and management of secure applications, such as payments. The specifications allow issuers to choose the most suitable secure element (SE) technology for their implementation today, while also ensuring that they can migrate, if necessary, to a different card or mobile technology in the future without significant impact to the infrastructure that has already been deployed.
So, GlobalPlatform offers a platform for the chip in the card and the chip in the mobile phone to support EMV. Can you tell us more about this platform?
As a cross industry organization, GlobalPlatform defines the operating system and security framework of the EMV chip, often referred to as the SE in mobile applications. Over the years, GlobalPlatform Specifications have evolved significantly while remaining independent of the functional features of the underlying application (i.e. the EMV payment application). Broadly, GlobalPlatform defines a process for maintaining security and managing applications in a multi-tenant environment. This means that issuers can maintain and control the security of the chip as an issuer / owner or be part of a multi-ownership environment, when the SE is compliant to the GlobalPlatform Specification.
The advantage offered to issuers by GlobalPlatform is the ability to provision the same credential to a standard EMV chip card and to a mobile device over the air. On top of this, a payment application developed, tested and proven for the card form factor can be used on any other device that aligns with GlobalPlatform Specifications. This is possible because the same Java Card-based OS is used in GlobalPlatform-compliant EMV chip cards and in SEs integrated into mobile handsets.
Following the success and experience gained through using this framework for over a decade, the organization continues to standardize new security technologies such as the trusted execution environment (TEE). The TEE helps to extend security beyond the chip for much more feature rich devices, such as smart phones. The TEE is needed as these handsets allow consumers to interact with their payment credentials through peripheral devices such as touch screens, keyboards and fingerprint sensors.
Do you think issuers in the US will have any difficulty using GlobalPlatform for their EMV chip deployments?
Not at all. On the contrary, many (if not all) EMV technology companies offer EMV chip cards compliant to GlobalPlatform Specifications making it the best-known and widely-deployed platform in the payment and mobile industries. Personalization bureaus, issuers and technology vendors for EMV data generation, and personalization equipment, all know how to work with it and are very familiar with its requirements. Issuers can therefore benefit from quick time to market with less effort required for product development and the EMV configuration process. GlobalPlatform’s simple, transparent and proven EMV issuance process is widely embraced globally. It offers assurance that issuing an EMV chip solution on GlobalPlatform-compliant platforms today will be both robust and ‘future proof.’
Issuers can also reduce long-term costs with GlobalPlatform. It is a given that EMV technology evolves over time and new products become available on a regular basis from all technology providers. Having a chip platform that is built on GlobalPlatform technology allows new EMV cards and devices to be backwards compatible. This reduces the migration effort and cost allowing issuers to quickly and easily benefit from the most advanced EMV technology.
There will be issuers that may wish to source from multiple chip suppliers to mitigate chip supply risks. Can this be done?
The value of industry standards such as GlobalPlatform becomes apparent when pursuing a ‘second source’ strategy. Sourcing EMV chips from multiple chip suppliers may give issuers better control over their supply chain. A second source strategy allows issuers to distribute card production capacity over multiple vendors, which reduces dependencies on a single provider. Or, a second supplier can be a backup in case the primary, preferred supplier cannot deliver. GlobalPlatform compliant chips are, to a large degree, interchangeable and therefore enable a ‘plug and play’ experience in EMV data preparation, personalization and key management processes.
Additionally, some issuers are concerned about the ability to change card suppliers three or four years down the road without significant impact on their personalization process. Will a change in suppliers necessarily require modification of the issuer’s personalization process?
Answer: If implemented correctly, GlobalPlatform technology helps issuers to avoid getting ‘locked in’ with a single chip supplier. For example, if the systems, data definitions and protocols in a card personalization environment are GlobalPlatform-compliant, it is fairly straightforward to swap out one component with another. The chip itself is a good example of a component that can be swapped, even four years down the line!
There may be some issuers in the US who have an interest in deploying services to consumers on both card and mobile platforms. What does GlobalPlatform offer issuers that have this vision?
GlobalPlatform is the de facto industry standard for SEs embedded into any form factor, be it cards, mobile phones or wearable devices. This enables easier development cycles and standardized personalization. The services facilitated by GlobalPlatform can therefore reside in both cards and mobile devices, behaving the same in either environment. Furthermore, due to the widespread use of the GlobalPlatform Specifications, many vendors offer qualified products. This ensures there are numerous options when ordering card or mobile products.
Any final comments on GlobalPlatform’s role in supporting the transition to EMV chip payments in the US, on cards or mobile devices?
GlobalPlatform is a widely deployed and proven technology, with more than 150 GlobalPlatform-qualified products available in the marketplace today. EMV issuers can therefore choose from a wide range of suppliers. The compliance process ensures consistency in the performance of applications and provides protection for issuer’s investments through product interoperability and scalability.
Service providers who would like to learn more about the specifications should consider taking the Card Specifications Online Training course or attend an instructor-led session held at various locations throughout the year, or at the client’s location if requested. To learn more about Card Specifications Training, they can visit http://www.globalplatform.org/training.asp.