Digital Transactions Authoritative, insightful and timely information for payments professionals
With deadlines fast approaching for U.S. merchants, acquirers, and other payments players to adopt the Europay-MasterCard-Visa (EMV) chip card standard, vendors are stepping forward with ideas to simplify readiness. One of the latest of these is a concept that asks why chip transactions can’t be managed by remote servers—why, in other words, EMV can’t be cloud-based.
The concept, presented last month at Cartes, a major chip-card trade expo in Paris, would do away with sophisticated point-of-sale terminals and replace them with so-called dumb devices in an effort to make it easier to bring merchants up on the EMV standard. “You make the terminal dumb and put all the [EMV] complexity in a data center,” says Jeremy Gumbley, chief technology officer at CreditCall, a U.K.-based transaction gateway and mobile-payments solutions vendor. “There’s a screen, a keypad, and a prompt to the cardholder, but that’s all. It’s all being driven by an app at a data center.”
A cloud configuration would also simplify software updates, Gumbley contends. Software downloads for large masses of terminals can be tricky, he says, whereas with the cloud, “You have the ability to push configuration changes out and also software updates.”
Under current card-network plans, acquirers must be prepared by April to handle EMV transactions, which differ in important respects from mag-stripe payments. EMV, for example, includes a protocol for handling cryptograms as a means of securing user credentials. By October 2015, all merchants except gas stations must have equipment in place to process EMV transactions. Those that don’t will have to accept liability for counterfeit fraud. Gas stations have until October 2017 to get ready.
Gumbley, who presented the Cartes paper on cloud-based EMV, says CreditCall has already deployed the concept with 25,000 terminals in EMV markets in Europe and Asia. It started handling transactions from the devices two years ago. “Payment is processed at our gateway, not at the terminal,” he says. Now CreditCall wants to sell the concept to terminal vendors in the U.S. The company plans to market the cloud solution to the terminal makers, which in turn could sell it through independent sales organizations and other distributors, Gumbley says.
“This will be a real advantage for new terminal entrants in the U.S., the smaller manufacturers,” he says. “We are going to aggressively market it.” He says “mid-tier” makers operating in the U.S. have shown “considerable interest” in the idea so far. “This technology is an ideal way” for these makers, many of which are off-shore companies, to pick up U.S. market share.
The EMV-in-the-cloud idea is apparently new enough that U.S. payments-industry observers who follow EMV had not heard of it when contacted by Digital Transactions News. “What else can we do in the cloud?” asks Aaron McPherson, director of the financial-services practice at IDC Financial Insights.
One issue, he says, is how the system would work when the Internet goes down, cutting off links between the terminals and the host server. “We saw this illustrated vividly with Hurricane Sandy,” he notes. “In a retail environment, where everything has to work all the time, you can’t have the down time you could have with the cloud.”
At least some acquirers and merchants might figure that would be a gamble worth taking to save time and meet deadlines. EMVCo., the standards body for EMV, has already certified the cloud configuration, Gumbley says. And CreditCall plans to build on cloud-based EMV to introduce mobile payments and loyalty. “We’re not thinking of EMV-only terminals,” says Gumbley. “EMV is a very well-tested payment infrastructure that can be built on to deliver a lot of other services.”
