Viewpoint: What a New EMV Tool Means for Payments
By David Worthington, Bell ID
Earlier this year, EMVCo introduced payment account reference (PAR) which it described as a “newly-defined data element that reduces reliance on primary account numbers (PAN) when managing security requirements and delivering value-added services.”
PAR has been introduced to overcome an inherent challenge of tokenization technology as it allows PAN-based and related token-based transactions to be linked. This enables the payments acceptance community to consistently and securely deliver value-added services–such as loyalty and couponing, manage regulatory requirements or provide transaction risk scoring–without relying on the PAN.
Although the idea underpinning PAR makes sense, industry feedback has been mixed so far. What does PAR really mean for the payments community and why is there industry hesitation?
Complexity
Implementing PAR is not going to be an easy ride. First, PAR as a new and additional data element will need to be integrated into all authorization and clearing messaging. PAR has a different length and format to the PAN, so merchants and acquirers will have to upgrade their back-end systems to support and identify this new data element as the new index for merchant loyalty and acquirer risk management.
Merchants will also have to hold lookup tables to link a PAR with the original PAN and all of the various tokens that are associated with it. In practice, this means that merchants will hold data that maps the activity taking place within the token vault. In the specifications current format, this raises various regulatory and compliance issues regarding the management and protection of data.
Further complexity is introduced by the fact that EMVCo has updated the underlying EMV specifications to introduce new tags supporting PAR for all EMV cards and terminals, as well as the OEM Pay approaches and mobile applications.
The consequences of this update are profound, as this may require a complete recertification process across the entire payments industry. For those in the United States who are currently involved in a complex and drawn-out certification process following the EMV liability shift in October 2015, the thought of recertification is a painful one.
Increased costs
Such complexity is naturally accompanied by high costs.
As PAR has been introduced to benefit merchants and acquirers, they will be expected to absorb the majority of the implementation costs. The key question, therefore, is whether the potential benefits justify the investment. In contrast, the issuer and processor community is set to gain little or no benefit from PAR, so any costs they face will be somewhat hard to swallow. As alternative options to PAR exist that also enable actors to deliver value-added services and regulatory requirements, there is a lot of work to do to convince the industry that the return on investment is sufficient.
An uncertain future
It is not easy to introduce a brand new data element into the payments ecosystem. With applications to be recertified and system updates to be made, it will be many years until PAR is fully implemented across the entire payments industry. And if the industry feels compelled to drag its feet due to the lack of commercial imperatives, this process will be further elongated. More information is required, therefore, on the expected implementation timelines.
David Worthington joined Bell ID in 2011 to advise the company and its major clients on strategic opportunities in the application of new payments, mobile and chip technologies. He has more than 20 years in the smart card, certification authority and payments industries. He can be reached at [email protected].
In Viewpoints, payments professionals share their perspectives on the industry. Paybefore presents many points of view to offer readers new insights and information. The opinions expressed in Viewpoints are not necessarily those of Paybefore.
