EMVCo

EMVCo
663highland · Public domain · source
Name	EMVCo
Formation	1999
Headquarters	Paris
Type	Standards body
Region served	Global

EMVCo is a technical body that manages specifications and testing for interoperable payment card and payment terminal technologies used worldwide. It develops and maintains technical requirements that align implementations across networks such as Visa, Mastercard, American Express, Discover Financial Services, JCB, and UnionPay. EMVCo’s work affects stakeholders including bank, merchant, terminal manufacturer, software vendor, acquirer bank, and issuer bank communities, shaping interactions across infrastructure like point-of-sale terminal, automated teller machine, contactless payment, and mobile payment systems.

History

EMVCo was established in 1999 following collaboration among major payment networks: Europay International, Visa International, and MasterCard International to create common technical standards after widespread adoption of chip payment initiatives such as those promoted by Gemplus, Nokia, and Siemens. Subsequent consolidation involved entities like American Express joining formal coordination efforts as chip migration accelerated after incidents like the Heartland Payment Systems breach influenced emphasis on secure transaction architectures. Major milestones include publication of initial chip specifications paralleling work by organizations such as International Organization for Standardization, International Electrotechnical Commission, Payment Card Industry Security Standards Council, and later alignment with contactless efforts tied to technologies from NXP Semiconductors, Infineon Technologies, and STMicroelectronics.

Governance and Membership

EMVCo is governed by shareholder members drawn from global payment schemes including Visa, Mastercard, American Express, JCB, Discover Financial Services, and UnionPay. The governance model coordinates technical committees and working groups with participation from companies such as Thales Group, Gemalto (now Thales) , Intel Corporation, Samsung Electronics, Apple Inc., Google LLC, and Microsoft Corporation. Standards development interfaces with testing laboratories like UL Solutions, Intertek, and SGS and academic and policy stakeholders tied to institutions like Massachusetts Institute of Technology, Stanford University, University of Cambridge, and regulators including European Central Bank, Bank of England, Federal Reserve System, European Banking Authority, and People's Bank of China.

Standards and Specifications

EMVCo publishes specifications covering chip card and terminal protocols for Integrated Circuit Card, contact EMV, contactless EMV, and tokenization schemes related to 3-D Secure and Secure Remote Commerce. These specifications reference cryptographic mechanisms such as RSA (cryptosystem), Elliptic-curve cryptography, and standards from ISO/IEC 7816, ISO/IEC 14443, and ISO/IEC 8583. Workstreams coordinate with initiatives like NFC Forum, GlobalPlatform, FIDO Alliance, and World Wide Web Consortium for secure element, mobile wallet, and authentication interoperability, and align with fraud mitigation frameworks from Europol and Financial Action Task Force. EMVCo releases transaction flow definitions for authorization, authentication, and risk management that integrate with network message formats used by SWIFT, ACH (Automated Clearing House), and card processors such as Fiserv, TSYS, First Data.

Certification and Testing Programs

EMVCo operates conformance testing programs and publishes test plans used by independent laboratories and manufacturers. Certification covers chip cards, terminals, mobile implementations, and protocols including contactless and mobile proximity transactions. Accredited testing bodies such as UL Solutions, Bureau Veritas, and DNV execute test suites that reference compliance procedures employed by payment processors like Global Payments and Worldline. Certification criteria intersect with security validation frameworks including Common Criteria evaluation, Payment Card Industry Data Security Standard assessments, and cryptographic module testing associated with NIST guidance. The lifecycle includes lab evaluation, vendor interoperability events similar to plugfests run by IEEE, and production monitoring akin to surveillance activities by agencies like Consumer Financial Protection Bureau.

Adoption and Industry Impact

EMVCo specifications underpin chip migration programs in markets following incidents such as the 2008–2009 Great Recession that accelerated focus on fraud reduction and risk transfer mechanisms adopted by acquirers and issuers including Barclays, HSBC, JPMorgan Chase, Citigroup, and Bank of America. Adoption trends include rapid uptake of contactless EMV in regions influenced by operators such as Transport for London and retailers like Walmart, Carrefour, Tesco and payment service providers like Square (company), Adyen, and Stripe. The standardization enabled cross-border interoperability among cardholders traveling between markets served by networks like Interac and Eftpos Australia. EMVCo’s standards have also catalyzed innovation in mobile wallets from Apple Pay, Google Pay, and Samsung Pay and contributed to tokenization initiatives led by Visa Token Service and Mastercard Digital Enablement Service.

Security and Compliance Considerations

EMVCo specifications define cryptographic protocols and key management practices that rely on implementations of Public Key Infrastructure and hardware secure elements from vendors such as NXP Semiconductors and Infineon Technologies. Security considerations address skimming, relay attacks, and card-not-present fraud through mechanisms integrated with 3-D Secure flows and device attestation frameworks promoted by FIDO Alliance and GlobalPlatform. Compliance regimes intersect with national regulatory regimes like Payment Services Directive 2 and supervisory guidance from Office of the Comptroller of the Currency and European Banking Authority; risk management practices incorporate tokenization, authentication, and transaction velocity controls used by fraud analytics providers such as Kount and ThreatMetrix. Continued evolution responds to threats highlighted by incidents involving magnetic stripe compromise and emerging attack vectors targeting contactless and mobile channels documented in advisories from CERT Coordination Center and Europol.

Category:Payment systems