SB n° 209: Clarifications for EMV® Book 3 (Version 4.3), offline-only terminals processing

EMV^® Specification Bulletin No. 209 First Edition January 2019 Clarifications for EMV^® Book 3 (Version 4.3), offline-only terminals processing This Specification Bulletin contains clarifications for Book 3.

Applicability

This Specification Bulletin applies to:  EMV^® Integrated Circuit Card Specifications for Payment Systems, Book 3 Application Specification, Version 4.3, November 2011 Related Documents  None Effective Date  Immediately

Description

The EMV^® Specifications allow for different implementations of an offline-only terminal, specifically on how Terminal Action Analysis is performed. However, offline-only terminals shall comply with requirements that are clarified in this bulletin.

countries.

The following is inserted before the last paragraph of section 10.7 Terminal Action Analysis: Offline only terminals may be implemented in different ways but shall always check, at least, (1) the Terminal Action Code – Denial and Issuer Action Code – Denial and (2) the Terminal Action Code – Default and Issuer Action Code – Default. When processing the first GENERATE AC command, for each bit in the TVR that has a value of 1, the offline-only terminal shall check the corresponding bits in both the Issuer Action Code – Denial and the Terminal Action Code – Denial. If the bit in either of the action codes is set to 1, the terminal shall request an AAC from the ICC. If an AAC is not requested based on the Issuer Action Code – Denial and the Terminal Action Code – Denial processing above, the offline-only terminal continues processing according to one of the options below: (1) The offline-only terminal uses the Terminal Action Code – Online and Issuer Action Code – Online. For each bit in the TVR that has a value of 1, the terminal shall check the corresponding bits in both the Issuer Action Code – Online and the Terminal Action Code – Online. If the corresponding bit in either of the action codes is set to 1, the terminal shall request an ARQC from the ICC in the first GENERATE AC command. Otherwise, if ARQC is not requested based on the IAC-Online and TACOnline processing above, the terminal shall use the Action Code – Default. For each bit in the TVR that has a value of 1, the terminal shall check the corresponding bits in both the Issuer Action Code – Default and the Terminal Action Code – Default. If the bit in either of the action codes is set to 1, the terminal shall request an AAC from the ICC in the first GENERATE AC command. If the ICC returns an ARQC in the first GENERATE AC response then the terminal shall use the Action Code - Default. For each bit in the TVR that has a value of 1, the terminal shall check the corresponding bits in both the Issuer Action Code – Default and the Terminal Action Code – Default. If the bit in either of the action codes is set to 1, the terminal shall request an AAC from the ICC in the second GENERATE AC command. (2) The offline-only terminal skips the Issuer Action Code – Online and Terminal Action Code – Online check, and shall check the Issuer Action Code – Default and the Terminal Action Code – Default. For each bit in the TVR that has a value of 1, the terminal shall check the corresponding bits in both the Issuer Action Code – Default and the Terminal Action Code – Default. If the corresponding bit in either of the action codes is set to 1, the terminal shall request an AAC from the ICC.

countries.

Legal Notice

The EMV^® Specifications are provided "AS IS" without warranties of any kind, and EMVCo neither assumes nor accepts any liability for any errors or omissions contained in these Specifications. EMVCO DISCLAIMS ALL REPRESENTATIONS AND WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT, AS TO THESE SPECIFICATIONS. EMVCo makes no representations or warranties with respect to intellectual property rights of any third parties in or in relation to the Specifications. EMVCo undertakes no responsibility to determine whether any implementation of the EMV^® Specifications may violate, infringe, or otherwise exercise the patent, copyright, trademark, trade secret, know-how, or other intellectual property rights of third parties, and thus any person who implements any part of the EMV^® Specifications should consult an intellectual property attorney before any such implementation. Without limiting the foregoing, the Specifications may provide for the use of public key encryption and other technology, which may be the subject matter of patents in several countries. Any party seeking to implement these Specifications is solely responsible for determining whether its activities require a license to any such technology, including for patents on public key encryption technology. EMVCo shall not be liable under any theory for any party’s infringement of any intellectual property rights in connection with the EMV^® Specifications

countries.