FAQ: Expanded Issuer Identification Numbers – General Questions

Expanded Issuer Identification Numbers (IIN) Frequently Asked Questions (FAQ) 1. What is an Issuer Identification Number (IIN) and what has changed? The IIN is the part of the Primary Account Number (PAN) which identifies the financial institution that issued the card. It uniquely identifies the issuer. Its main role is to help identify the account used for the card’s transactions. International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) published a new version of the ISO/IEC 7812-1 standard in which IINs can be expanded to eight-digits. This will result in payment cards having either six or eight-digit IINs. In EMV^® Integrated Circuit Card Specifications for Payment Systems, there is a data element defined as Tag ‘42’ – IIN, which supports six-digit IINs. Following industry consultation, EMVCo is considering assigning a new Tag for the extended data length to support eight-digit IINs. 2. Why has the number of digits been expanded by ISO/IEC? The change by ISO/IEC reflects the growth of customers and services that are operating globally. 3. What are the consequences of this change? From a payment perspective, routing principles will be adapted. The payment community will address this in the coming years as system maintenance updates are undertaken. Merchants sometimes use PAN or IIN as a basis to effectively identify a customer and offer relevant additional services outside of payments, such as loyalty programmes. As such, other business systems beyond traditional payments may also need to be updated to ensure the longer IIN can still be used to identify a customer effectively. There may also be other proprietary use cases using this data element and some terminals may be checking the data format of the data sent by the card beyond the defined EMVCo requirements. EMVCo is therefore seeking industry feedback regarding the upcoming changes and to determine whether payment terminals recognise and accept both six and eight-digit IINs during a transaction. 4. What is the focus of EMVCo? EMVCo’s specifications focus exclusively on payments. Assigning a new Tag to support the length extension is detailed in the 2nd Draft Specification Bulletin (DSB). The activity © 2020 EMVCo, LLC. All rights reserved.

is part of EMVCo’s ongoing maintenance to ensure worldwide interoperability and acceptance of secure payments transactions. 5. What is a DSB, and why has EMVCo published a 2nd version? An EMV DSB offers insight into an upcoming EMV Specification Bulletin for review and comment by the EMV community. Once finalised and published on the EMVCo website, the Specification Bulletin becomes an official update to a specification. Over time, once a number of specification bulletins have been made, an editorial update is undertaken to include the bulletins into the larger specification document. For IIN length extensions, this would be the EMV^® Integrated Circuit Card Specifications for Payment Systems, Book 1 and Book 3. EMVCo’s 1st DSB on this topic suggested extending the existing Tag ‘42’ - IIN to support both six and eight-digit IINs. Industry feedback raised concerns that some payment terminals may consider a Tag ‘42’ longer than six digits as invalid data and terminate the transaction. Assigning a new Tag would address this concern. The 2nd DSB details this new approach. 6. Will EMVCo provide any guidance to merchants? No, this is outside of EMVCo’s scope. It is, however, keen to ensure all parties that may be impacted by this change are well informed, have an opportunity to comment and have sufficient time to evaluate and update systems as required. The most recent DSB on this topic is available on the EMVCo website and provides this detail. 7. Can EMVCo provide further detail on how a merchant’s system might be impacted? No, as these systems are unique to individual businesses and are outside of EMVCo’s payment expertise and specification work. EMVCo’s message to merchants, processors and other stakeholders is to ensure that they take time to evaluate how they use IIN and/or PANs and ensure systems are updated if needed. 8. When will the updated EMV Specification Bulletin be available? EMVCo is working to release a new specification bulletin in 2020. The specification will be available to all parties royalty-free and without charge from the EMVCo website. 9. Will EMVCo mandate use of the long IIN number? No. EMVCo does not mandate the use of its specifications and industry stakeholders are free to choose from any or all of the related EMV Specifications to address their customer and marketplace needs. © 2020 EMVCo, LLC. All rights reserved.

EMVCo does, however, expect that the Terminal Type approval process will be updated once the specification bulletin is published and effective to ensure that terminals can recognise Tags that support both six and eight-digit IINs. EMV^® is a registered trademark in the U.S. and other countries and an unregistered trademark elsewhere. The EMV trademark is owned by EMVCo, LLC. © 2020 EMVCo, LLC. All rights reserved.