Prime Factors Helps Issuers Keep EMV Data In-House

As the U.S. EMV deadlines loom, the temptation issuers face to send their EMV data prep to a third party bureau is great. Prime Factors today is helping put an end to that practice, announcing the release of their new EMV data prep module for the Bank Card Security System (BCSS), allowing issuers to keep their EMV prep data in-house. PYMNTS.com spoke with Dave Tushie, product manager for BCSS at Prime Factors, to learn more about Prime Factors’ new solution, and to understand what his company saw in the market that led them to develop such a solution.

PYMNTS.com: You’re making some big news today that issuers will certainly want to pay attention to as the EMV deadlines loom. Tell us about the software Prime Factors is announcing.

Dave Tushie: Our new software is an EMV data preparation module for the Bank Card Security System (BCSS) that reduces the complexity of EMV card issuance, allowing issuers to perform EMV data preparation in-house.  It makes EMV data prep as familiar and routine as magnetic stripe card issuance is on your legacy systems. With BCSS you maintain more control of your card holder data and just as importantly – the keys and certificates – by performing EMV data preparation in-house.

Let’s get into the technical details a bit. Exactly how does your EMV data prep module work, and how can issuers integrate it with their existing systems?

The new EMV module runs on all major operating systems including the IBM z/OS used by most issuers. Most issuers house their cardholder management system on legacy mainframes where they prepare data for magnetic stripe card issuance. For EMV issuance, they typically send the cardholder data to a secure personalization bureau which does the data preparation and then produces the card.

The new module for BCSS lets issuers perform EMV data preparation using their existing magnetic stripe issuance platform and cardholder management system. The new module pulls application data, cardholder data and keys from many sources and creates a file that can be securely sent to a service bureau. Any card personalization system, regardless of the IC card and personalization equipment employed, can interpret the file for processing.

Tell us how this helps to cut costs, then. How can issuers actually save money by using this software?

Issuers who run their business on mainframes have just one option if they want to do data preparation in-house – develop it themselves. This requires an in-depth understanding of EMV in order to create a flexible enough system to handle the complexity of many different card programs. Our new module eliminates eight to 12 months of programming as well as the time and cost of maintaining an in-house developed data preparation software. In addition, we have used our knowledge of EMV and technology to create a solution that adapts easily to any customer requirement.

The new EMV data preparation module is an extension of BCSS which is highly-specialized middleware that cuts costs by reducing the amount of programming required to develop and maintain a secure card issuance platform. BCSS includes a key management system, Thales HSM (hardware security module) integration and both key generation and derivation for the variety of keys needed for magnetic stripe and EMV IC cards, as well as their verification during transaction authorization.

In addition to cutting the cost of development and maintenance, issuers who perform their own EMV data preparation benefit from competitive pricing when they select a service bureau. They aren’t locked into one service bureau, and can select their service bureau based on cost and productivity.

You emphasize that keeping EMV data prep files in-house is hugely important. Why is that, and why do many companies fail to do so today?

Many issuers globally have outsourced EMV smart card issuance due to its complexity compared to magnetic stripe card issuance, thereby relying on others to keep secure cardholder data and associated keys. Key management is the biggest contributor to EMV’s complexity. It requires the generation and management of many more keys than magnetic stripe issuance, and therefore, the chances of a compromise are significantly higher. In-house data preparation reduces this risk. Who better to protect issuers’ most valuable assets – cardholder data and associated keys – than the issuers themselves?

What led you to create this platform? Is this something Prime Factors created based on issuer requests, or is this a gap in the market you saw and wanted to fill?

Input from our customers and the fact that most issuers – about 80% – run their issuance platform on legacy mainframes. BCSS and its predecessor (PIN Management System) have been used by leading issuers and secure personalization bureaus throughout the world for more than 30 years. Customers have developed their own proprietary issuance platforms and use BCSS for key management and to create and authorize security codes and PINs.

Many international customers are using BCSS to generate the data elements, keys and certificates required to issue EMV payment cards. However, they have to know the detailed EMV requirements for their specific card program to be able to know which library function calls to make in assembling their emboss file.  With this new version of BCSS, we eliminate that complexity by providing a new application layer that has a single function call to generate all of the EMV data.

Finally, tell us what sort of impact you feel technology like this can have as the U.S. shifts towards EMV migration. What does this do for the industry as a whole?

It removes the veil of complexity so issuers who run their business on mainframes have a choice – they can outsource EMV data preparation or they can do it in-house. While we think there are benefits to doing data preparation in-house as discussed in previous questions (see No. 4), there may be good business reasons to outsource some or all of it. Our new EMV module gives issuers the flexibility to consider the best option based on a variety of factors. They protect their investment in magnetic stripe issuance, and can use the same processes to perform EMV data preparation.   

Dave Tushie

Product Manager for BCSS at Prime Factors

Dave Tushie has been involved with EMV payment solutions for more than 20 years, and pioneered development of EMV issuance software. As product manager for BCSS, Dave is responsible for product strategy, development and marketing. His EMV expertise is highly sought after, and he provides consulting to the International Card Manufacturing Association. Dave co-founded UbiQ Inc., a smart card issuance software provider, and Magellan Consulting, Inc., which specializes in smart card based payment and ID systems. He has also worked for Datacard and NBS Technologies.