EMV for Application Developers
Integration with EMV acceptance devices is very different than traditional magnetic stripe readers. Because of the nature of EMV, a “conversation” has to be had between the payment application, the EMV acceptance terminal, and the chip card itself. This conversation involves dynamic data elements and detailed procedures defined by the EMVCo specifications.
Partly because of this added complexity, a payment application developer who wishes to implement EMV and integrate directly with a chip acceptance device is required to have their solution certified by the four major card brands: an acquirer or acquirer-processor’s “Class B” certification is not alone sufficient for EMV. Some of the brands charge fees for these EMV certifications.
Because full or direct integration of EMV can be daunting in terms of technical requirements as well as monetary and time investment, Heartland has leveraged our broad partnerships to launch several types of “Out of Scope” solutions in 2015 which can accelerate the path to EMV acceptance for a software vendor.
Out of Scope (Semi-Integrated)
Heartland’s Out of Scope solutions offer an easy and fast path to EMV acceptance for POS and other payment application developers. Essentially Heartland Out of Scope provides a pre-certified middleware component that takes over the duties traditionally belonging to the payment application in terms of processing and transmitting card or chip data. That middleware application exposes a very simple API that allows the POS application to request that a payment be received on a device, and which provides a response to the POS indicating whether or not the transaction was approved.
Throughout 2015 Heartland will be releasing support for several of the “semi-integrated peripheral” solutions which have been pre-certified with the card brands for EMV and which require minimal incremental development, time, and money, to integrate into your application. In each case, Heartland has worked with the terminal equipment manufacturers to leverage their existing device SDKs in order to further facilitate ease of integration.
Fully Integrated Solutions
In a fully integrated EMV solution your payment application is responsible for processing the EMV transaction, including communicating with the chip through the terminal manufacturer APIs, and certifying for this functionality with the card brands.
In order to successfully execute the card brand certifications and EMV test cases a software vendor requires both the appropriate test cards and a means of capturing, logging, and validating the interaction between the terminal and chip card. Such packages of software tools and test cards (or a test card emulator) are often referred to as “EMV test tools”.
While either of these tools (or another approved by the card brands) may be used to complete the card brand certification tests, Heartland internally uses the Collis Brand Test Tool. If you choose to purchase the Collis tool, Heartland can apply knowledge and expertise of that tool toward facilitating your testing with the card brands.
The costs for these test tools are often significant (in the range of tens of thousands of dollars) and are one contributing factor that is driving integrators toward considering simpler semi-integrated solutions. In addition to the test tool costs, Visa, MasterCard, and Discover have implemented fees for their EMV certification processes. The approximate cost of those certifications is about $12,000 for all four brands, contact and contactless, for one kernel configuration.
Certain considerations around the merchant environment may warrant or require additional kernel configurations to be certified. For instance, if a restaurant application needs to support both unattended kiosks as well as counter service orders, that requires at least 2 distinct kernel configurations. In another example, the environment may not be suited for PIN entry even though the device may be capable of accepting a PIN, such as table service restaurant. The PIN prompt can be avoided completely in this scenario by certifying a kernel configuration that does not include either online PIN or offline PIN as supported cardholder verification methods. Each kernel configuration that you will need to support represents approximately $12,000 worth of card brand certification fees.
If you are planning on a full EMV integration and card brand certification, Heartland has implemented special “pre-certification” procedures. Effectively this process consists of performing the card brand test cases against Heartland’s own simulator only before we route the traffic to the card brands. Your certification analyst will be familiar with the card brand requirements and will be able to gauge when you are ready to perform the full card brand testing, so as to avoid multiple fees.
Heartland supports EMV on all of our major platforms, including the Exchange Host and Portico Gateway. Details for implementation of EMV on those platforms may be found within the specification or API documents for each. In addition to these host messaging specifications, Heartland also has prepared the following EMV Integrator’s Guide for those who will be developing fully integrated EMV solutions: this covers much of the necessary terminal interaction as well as other general industry considerations around EMV (such as new receipt requirements).