GB nº 60: EMV Contact Chip Features Sunsetting

2024-07-30T00:00:00+00:00 v2.0 General Bulletin

Contact Acceptance Device

EMV® General Bulletin No. 60 Second Edition, July 2024 EMV® Contact Chip Features Sunsetting This Bulletin describes EMVCo’s plans for sunsetting certain features in the EMV Contact Chip Specification The 2nd edition of this General Bulletin:

adds biometric Cardholder Verification Method and tags as Phase 2 sunset candidates
changes sunset timing of Plugs and Sockets from Phase 1 to Phase 2
applies minor editorial updates and corrections Changes made in the 2nd edition of this bulletin are shown using strikethroughs and red text.

Applicability

This Bulletin applies to:

EMV Integrated Circuit Card Specifications for Payment Systems – Books 1/2/3/4.

Description

In the late 1990s, certain EMV Contact Chip Specification features were designed to support the rollout of the technology in various marketplaces. While these features played an important role at the time, the evolution of card payments technology and the acceptance landscape means that some are no longer required to ensure seamless and secure payments. In response, EMVCo has worked closely with EMVCo Associates and Subscribers to identify specification features that could be sunsetted and to explore the respective benefits, implications, and considerations of such an action. Following this process, the following features have been selected to be sunsetted with the aim of collectively improving security, optimising the usability of the specifications, simplifying editorial understanding, and removing obsolete or unused features: Security ⚫ Velocity checking ⚫ Static Data Authentication (SDA) ⚫ Offline Plaintext PIN Optimisation ⚫ Combined Cardholder Verification Method (CVM) Editorial ⚫ Plugs and Sockets Obsolete ⚫ Transaction Certificate Data Object List (TDOL) ⚫ Biometric Cardholder Verification Method ⚫ Unused Tags Unused Tags to be sunsetted in Phase 1: o ‘9F04’ (Amount, Other (Binary)) o ‘9F3A’ (Amount, Reference Currency) o ‘9F3B’ (Application Reference Currency) o ‘9F43’ (Application Reference Currency Exponent) o ‘81’ (Amount, Binary) © 2023 - 2024

countries.

o ‘97’ (Transaction Certificate Data Object List (TDOL)) Unused Tags to be sunsetted in Phase 2: o ‘9F45’ (Data authentication code) o ‘A1’ (Biometric Header Template. BHT) o ‘7F60’ Biometric Information Template. BIT) o ‘90’ (Biometric Solution ID) o ‘82’ (Biometric Subtype) o ‘BF4C’ (Biometric Try Counters Template) o ‘81’ (Biometric Type) o ‘DF50’ (Facial Try Counter) o ‘DF51’ (Finger Try Counter) o ‘DF52’ (Iris Try Counter) o ‘BF4A’ (Offline BIT Group Template) o ‘BF4B’ (Online BIT Group Template) o ‘DF53’ (Palm Try Counter) o ‘BF4D’ (Preferred Attempts Template) o ‘DF50’ (Preferred Facial Attempts) o ‘DF51’ (Preferred Finger Attempts) o ‘DF52’ (Preferred Iris Attempts) o ‘DF53’ (Preferred Palm Attempts) o ‘DF54’ (Preferred Voice Attempts) Sunsetting Strategy To avoid excessive updates to the specifications and mitigate the impact on industry stakeholders, EMVCo plans to complete the sunsetting process in two three phases, although the dates may be subject to change. Phase 1 – Features to be sunsetted starting in January 2025 ⚫ Offline Plaintext PIN (unattended) ⚫ Combined CVM ⚫ Plugs and Sockets ⚫ TDOL ⚫ Unused Tags to be sunsetted in Phase 1 (excluding Tag 9F45) Q1 2025 – Publish Specification Bulletin for Phase 1 in Q1 2025 (Effective date: January 2026) Phase 2 – Features to be sunsetted starting in January 2027 ⚫ Offline Plaintext PIN (attended) ⚫ SDA (including Tag 9F45) ⚫ Velocity checking ⚫ Plugs and Sockets ⚫ Biometric Cardholder Verification Method ⚫ Unused Tags to be sunsetted in Phase 2 Q1 2027 – Publish Specification Bulletin for Phase 2 in Q1 2027 (Effective date: January 2028) H2 2027 – Publish Version 4.5 of EMV Integrated Circuit Card Specifications for Payment Systems – Books 1/2/3/4 Type Approval Strategy As part of EMVCo’s standard ongoing maintenance and evolution of the EMV Contact Chip Specifications, any updates to the specifications published prior to April are addressed in the corresponding EMVCo Type Approval annual release the following January. This existing process will ensure that sunsetted features are no longer supported. ⚫ Phase 1: January 2026 – Type Approval update to address features sunsetted in Q1 2025 Specification Bulletin. ⚫ Phase 2: January 2028 – Type Approval update to address features sunsetted in Q1 2027 Specification Bulletin. © 2023-2024

countries.

It should be noted that product providers developing new products should not pre-empt the specification and Type Approval updates before the applicable effective date of Specification Bulletins by removing features that are currently mandatory. However, EMVCo expects that features that are being sunsetted for security reasons can be removed at any time after the specification releases (to be confirmed when the drafts of the specification are made available to the Associates) or as soon as their support is optional in an Implementation Conformance Statement (already the case of the plaintext PIN in the current ICS). Letter of Approval (LoA) Restricted renewal will be possible with a maximum validity of 4 years from the renewal request or 4 years from the Type Approval activation, whichever comes first (so that the validity cannot extend beyond 31st December 2029 for features sunsetted in Phase 1 and 31st December 2031 for features sunsetted in Phase 2). Queries Any queries should be submitted via the Query System to the appropriate Working Group: -

To “EMV Contact Specification” for any Specification related queries;

Legal Notice

The EMV® Specifications are provided “AS IS” without warranties of any kind, and EMVCo neither assumes nor accepts any liability for any errors or omissions contained in these Specifications. EMVCO DISCLAIMS ALL REPRESENTATIONS AND WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT, AS TO THESE SPECIFICATIONS. EMVCo makes no representations or warranties with respect to intellectual property rights of any third parties in or in relation to the Specifications. EMVCo undertakes no responsibility to determine whether any implementation of the EMV® Specifications may violate, infringe, or otherwise exercise the patent, copyright, trademark, trade secret, know-how, or other intellectual property rights of third parties, and thus any person who implements any part of the EMV® Specifications should consult an intellectual property attorney before any such implementation. Without limiting the foregoing, the Specifications may provide for the use of public key encryption and other technology, which may be the subject matter of patents in several countries. Any party seeking to implement these Specifications is solely responsible for determining whether its activities require a license to any such technology, including for patents on public key encryption technology. EMVCo shall not be liable under any theory for any party’s infringement of any intellectual property rights in connection with the EMV® Specifications © 2023-2024

countries.