EMVCo Proposes Spec Changes To Accommodate Longer Issuer IDs

Payment card standards body EMVCo on Thursday disclosed proposed specifications changes to accommodate the coming of longer issuer identification numbers on credit and debit cards, changes that could affect merchants using card numbers to identify their loyalty program members in addition to processing protocols.

The changes stem from a revised standard adopted in 2017 by the International Organization for Standardization (ISO) and the International Electrotechnical Commission that supports an eight-digit issuer identification number (IIN) in addition to the traditional six. The IIN is the first part of the primary account number (PAN) on a card, which can vary from eight to 19 digits. The two standards bodies, both based in Geneva, Switzerland, added two IIN digits to accommodate the growth of card issuers globally and prevent a possible shortage of card numbers.

The change to the standard, dubbed ISO/IEC 7812-1, has downstream technical effects. What EMVCo is proposing is an extension to a data element, called ‘Tag 42-IIN,’ in its integrated circuit card specifications to reflect the longer IINs. EMVCo, which is owned by the six major global card networks, outlined the proposed spec changes in a so-called draft specification bulletin. The organization said it plans to take comments by Oct. 31 before publishing a final spec by year’s end, which would become effective in 2021.

Whether these changes will be major or minor on a practical basis for merchants and merchant acquirers was not immediately clear. 

“Point-of-sale terminals may need to be updated to ensure they recognize and have the ability to process both existing and longer IINs, or transactions may be terminated or processed incorrectly,” EMVCo said in a news release. 

The usage of card numbers for loyalty-program IDs, a common merchant practice, also may need some operational revisions. 

“Merchants sometimes use PAN or IIN as a basis to effectively identify a customer and offer relevant additional services outside of payments, such as loyalty programs,” EMVCo says in a frequently asked questions post on its Web site. “As such, other business systems beyond traditional payments may also need to be updated to ensure the longer IIN can still be used to identify a customer effectively.” 

The post also says “there may also be other proprietary use cases using this data element, and some [POS] terminals may be checking the data format of the data sent by the card beyond the defined EMVCo requirements. EMVCo is therefore seeking to avoid clashes when it extends the length of ‘Tag ’42’-IIN’ data element.”

EMVCo executive committee chairman Bruce Rutherford said in the release that “many parties within the EMV payment community are aware of these changes. Our aim in releasing the [draft bulletin] is to ensure those outside our community are informed and have sufficient time to evaluate and address any consequences that it may have on their business beyond traditional payment processing.”

The draft, including a link to a comment form, is on EMVCo’s Web site.