Transaction processing of EMV cards

Processing – own or third-party: pros and cons

A processing center (PC) is an organizational and technological division of a financial institution or a specialized company that maintains the life cycle of banking products based on plastic cards. The list of functions performed by the PC includes card lifecycle maintenance, connection and monitoring of a network of terminal devices, capture and technical processing (processing) of transactions, preparation of data for mutual settlements (clearing) with customers and counterparties. A separate function, which in some cases is also performed by the PC, is the personalization of cards.
When implementing projects using plastic cards, there are three main technological schemes – using in-house processing, third-party or, in accordance with the terminology of international payment systems, third—party processing (third party processor or member service provider), as well as a combined scheme.
In the first case, all technological functions related to the maintenance of plastic cards are performed by the staff of a financial institution using a hardware and software complex belonging to it.
In the second case, the main technological functions are outsourced to a third-party organization certified by payment systems for the provision of such services — a third-party processor (third party processor or member service provider).

In the third case, part of the functions (for example, support for the issue and product range) is performed directly at the technological capacities of the bank, and the other part (support of the terminal network, maintenance of connections to payment systems, preparation of data for clearing) is performed by a third-party processor.
The choice of a processing scheme for a bank’s plastic project is determined primarily by economic reasons, but an important role in making a decision is also played by an assessment of the potential risks of the alternatives under consideration — both business and technical. Therefore, by the time a decision is made on the technological part of the project, the bank should have a clear concept of business development with plastic cards, drawn up in the form of a business plan with a perspective for the next few years, in which at least the following parameters are indicated:
* product range and positioning of the bank in the market (what trends are there in the market, what products the bank is going to offer, what market share it plans to occupy and what it expects to earn);
* issue parameters (which cards of which payment system are selected for the project, the ratio of transactions in their own and in someone else’s network, card usage coefficients);
* economics of products (cost and revenue parts);
* characteristics of the terminal network (the presence of its own terminal network and the terminal network of other banks operating in the region; the cost of access to someone else’s terminal network at the rates of the payment systems present in the region);
* financial capabilities and ambitions of the bank (how much we are willing to invest in the infrastructure of this project).
To understand the share of the technological component, let’s briefly consider the typical economy of a project for the production and maintenance of products with plastic cards. The bank works with clients and makes a profit from their service — the revenue and expenditure components can be approximated in the form of the following table

The assessment of technological and business risks plays an essential role in choosing a solution for transaction processing. In particular, when choosing a third-party processor, you should pay attention to factors such as the size of the business and the organizational structure of the company, the product range offered, the technological solutions used, the existing customer base of the processor in your region (which financial institutions and with which product range). Particular attention should be paid to the contractual basis — the presence of prescribed interaction procedures, the terms of the service level Agreement (SLA – Service Level Agreement). An unpleasant surprise for the bank may be the presence of an exit fee in the contract with the processor — an obligation to compensate for certain costs, or to pay a fine in the amount of the estimated turnover for the term of the contract in case of its early termination.

The main arguments in favor of a particular decision

Another limitation when choosing a processor for banks entering into payment systems under the sponsorship of another financial institution is the fact that usually the terms of the sponsorship package provide for implementation on a processor affiliated with this financial institution.
Currently, there are a sufficient number of players in the processing services market in Russia, both domestic (CJSC United Credit Card Company, a number of banks offering processing services as part of sponsorship packages) and foreign (First Data Inc., Global Payments Inc.) with competing tariffs. Therefore, it seems that the choice of a technology partner for the implementation of a card project, if there is a clear understanding of its intended economy, should not present difficulties.

Technology of operation of a financial institution with a processor

It is obvious that some of the processes listed in Table 4 can be performed by the processor, some by the bank.
There are two limiting cases – offline (Fig. 2, 3) and online interaction of the bank with the processor. With an online connection, the authorization of transactions takes place in real time against the actual values of the balances on the client’s accounts in the ABS of the bank. Some of the functions of the processor staff are delegated to the bank’s divisions using remote access to the front and back office processor subsystems. Nevertheless, the main exchange of information with financial implications (orders for issuing cards, clearing files, etc. P.) is made by files using a notarized document flow. The advantages of this method of working with the processor is the promptness of data access, which brings the bank’s capabilities closer to the possibilities of working with its own processing, without the need to build the latter and, as a result, lower risks. The disadvantages are higher communication costs and the need in some cases to have qualified personnel duplicating processor personnel.

Verification of card details and financial authorization is carried out by the processor, maintenance of devices connected to the processor host, and settlements with Payment systems are performed by the bank.

The account is authorized by the ABS of the bank, the card is checked by the processor host, the devices connected to the processor host are serviced, and the bank performs calculations with Payment Systems.

When interacting offline with a financial institution, the processor authorizes transactions according to limits provided with a certain frequency. The bank also processes transaction reports provided by the processor and records transactions in its back office. All data exchange with the bank is also carried out by means of a notarized document flow. The advantage of this method is extremely low initial costs for starting a card program (in fact, the purchase of a card back office software compatible in data exchange formats with the processor). The disadvantages are higher risks and lack of flexibility — the product range is limited by the possibilities of interaction with the service provider, and the service provided by the capabilities of its customer service.
It should be noted that in real life, at present, a purely offline scheme is practically not used. The use of remote access to processor resources and the organization of several sessions of file exchange with the processor per day bring it closer to online capabilities.

Construction of the bank’s processing center

The construction of the bank’s processing center is a multi-stage project, during the implementation of which it is necessary to solve a set of tasks for the design and preparation of premises, engineering infrastructure, the choice of a software and hardware platform, the development of organizational procedures.
Special attention at the design stage should be paid to the issues of physical, logical and information security, since making changes to already implemented structural elements and infrastructure based on the results of audits (premises, elements of the hardware and software complex) can be associated with significant financial and time costs. Involving external consultants and suppliers familiar with audit procedures and payment system requirements in the design process will help to avoid possible errors and additional costs for their elimination.
In the process of building and commissioning a processing center, as in the creation of any automated control system, several stages can be distinguished (Table 5).
A separate issue when building a PC is the choice of a software and hardware platform, since it determines the user characteristics of the entire system. There are a sufficient number of providers of solutions for processing transactions using plastic cards in the world. An interested specialist will easily make a list based on publications in the profile press (“European Card Review”, “PLAS”) or on catalogs of industry exhibitions such as CARTES (www.cartes.com ). It is gratifying that along with foreign ones (ACI, Euronet Worldwide, Tieto Enator, M2M, CardTech, etc. vendors in this row are also domestic companies (OpenWay, BPC, Compass Plus) familiar with the specifics of the implementation of Russian projects (such as multicurrency in devices and calculations, formats of interfaces with local service providers – cellular operators, etc., legislation and accounting standards).

As a general specificity, it is worth considering that Western suppliers only invest in the term “card system back office” to support the life cycle of the card, while Russian customers usually expect that in addition to this function, the card back office will perform the functions of a retail application and accounting system.

A significant assistance in this process will be provided by the presence of a statement document reflecting the concept of the development of the card project on the scale of the bank as a whole and the processing system (see Fig. 5) in particular. The document must:
• define the purpose and scope of the project, to define its functionality (supported range, the functions performed by the processing centre to support emission/acquiring a list of functional requirements for the application software, etc.);
• to ascertain the current state of Affairs on the results of the survey system (products, solutions used, the availability of qualified personnel, limitations, structures, communication resources, etc.);
* list the major tasks of the project (installation, launch of personalization, issue, acquiring, integration with the banking system, connection and certification of interfaces to payment systems);
* identify the limitations under which the tasks will be solved (the need for training (involvement) of personnel, restrictions on the hardware and communication platforms used, performance and scaling requirements of the system);
* specify the deadlines for solving these tasks and the departments that perform them;
* determine the necessary costs and possible risks.