How Ready Are Deployers for the Next Big Operating-System Conversion for ATMs?

Microsoft Corp. will stop supporting its Windows 7 operating system next January, and that’s set off the latest dash by ATM deployers to convert to the next OS while there’s still time. For most deployers, that’s Windows 10, but some might be in a better position to meet the deadline than others.

Independent ATM owners’ decision to eschew Windows 7 in favor of Windows CE years ago has significantly decreased the odds of a mad dash by these ATM ISOs, says Bruce Renard, executive director for the National ATM Council Inc., a Jacksonville, Fla,-based trade group. About 60% of the 470,135 ATMs in the United States are owned by independent operators, and the majority of those machines run Windows CE, according to the NAC.

Generally speaking, there are two reasons independent ATM owners began embracing Windows CE. One is that CE is well-suited for ATMs that only dispense cash, which independent ATM deployers favor. Further, the OS is not subject to the upgrade or replacement schedules for Microsoft’s flagship Windows operating systems, ATM experts say. Most players view conversion to the latest OS as compulsory as developers will no longer issue updates and security patches for the outgoing system.

“Thanks to independent ATM operators, most of the ATMs in the U.S. are protected from the potential issues [and delays] around converting to Windows 10,” says Renard.

Bank-owned ATMs are another story, ATM experts say. That’s because banks own the largest concentration of ATMs running Windows 7.

Although numbers are hard to come by for the percentage of ATMs running Windows 7 that have been converted to Windows 10, ATM experts say financial institutions, especially those with large ATM fleets, are already far along in the conversion process. Too many waited too long back in 2014 to convert from Windows XP to Windows 7 when Microsoft stopped supporting XP, and don’t want to repeat the experience, observers say.

“Large banks not only have the resources to move projects like this along quicker, they want to avoid the risk associated with not meeting the conversion deadline,” says Sam Ditzion, president and chief executive of Tremont Capital Group Inc., a Boston-based consultancy.

The question is whether they are far enough along. ATM experts estimate it takes 12 to 15 months to upgrade to Windows 10. Given that timeline, ATM deployers waiting until the 11th hour or moving too slowly to convert to Windows 10 could wind up blowing the deadline by months because of a backlog of availability for technicians to complete the conversion. “ATM deployers can’t wing this, they need a thoughtful and comprehensive conversion plan,” Ditzion says.

With about six months to go before the deadline, the question for ATM deployers lagging behind is, how much risk are they willing to absorb by continuing to wait. “ATMs are getting hacked,” Renard says. “Without security updates and patches, ATM deployers continuing to run Windows 7 have greater exposure. Criminals are looking to relieve ATMs of their contents and will find the machines that are vulnerable.”

One option for lessening the ATM industry’s reliance on operating systems that get phased out every five years or so is to move toward open-architecture operating systems, such as Linux or Android, that can make ATMs more app-driven, a la smart phones and tablets.

“As next-generation ATMs are developed, it’s time to lay the foundation for moving away from operating systems that have to be constantly updated or that get phased out after a few years,” says David Tente, executive director, USA and Americas for Sioux Falls S.D.-based ATM Industry Association.