GB nº 42, EMVCo Type Approval Restricted Renewal Process for Kernels and IFMs

General Bulletin No. 42 First Edition, October 2009 This Bulletin is Effective: Immediately EMVCo Type Approval Restricted Renewal Process for Kernels and IFMs This document describes the introduction of the optional EMV process for restricted renewals of EMV Type Approvals for Kernels and IFMs.

Applicability

This General Bulletin applies to:

• EMVCo Type Approval Terminal Level 1 Administrative Process
• EMVCo Type Approval Terminal Level 2 Administrative Process

Related Documents

This General Bulletin should be read in conjunction with:

• EMVCo General Bulletin No.34 EMVCo Type Approval Renewal Policy for Kernels and IFMs

Description

To address market requirements, EMVCo is introducing an optional process to allow kernels and IFMs to receive a “restricted renewal” if they fail full renewal testing but pass all significant tests. The “restricted renewal” period for kernels is three years and for IFMs is four years. This process applies only to approved kernels/IFMs that qualify for renewal testing. Restricted Renewals A category of “restricted renewals” which allows a one-time extension of three years for kernels, four years for IFMs will be introduced. Kernels and IFMs that fail renewal testing may apply for this new process. (The current renewal testing involves full delta testing up to Test Plan 4.2.a plus Regression Testing for kernels and full delta testing up to Test Plan 2.1 plus Regression Testing for IFMs) The test results of the failed kernel or IFM can optionally be submitted to an independent third party qualified by EMVCo (“Reviewer”) for assessment where the failure of a test will be graded as critical or non-critical. Please refer to “List of Reviewers” in the appendix for details. The criteria for a non-critical failure response are: Copyright © 2009 EMVCo, LLC. All rights reserved.

• The erroneous behavior is not considered serious:
• The situation being tested is unlikely to ever occur (e.g. card personalization that is completely erroneous.)
• The difference between the expected results and the actual behavior is not critical to the transaction disposition
• Although the behavior of the kernel or IFM under test is incorrect, its actual behavior mitigates the error; for example, a transaction which is expected to be approved or declined offline instead, is sent online for authorization but results in a correct approval or decline.
• The online cryptogram and corresponding data is not corrupted.
• There is no significant security exposure. Most unwarranted declines or approvals, transaction terminations, and online cryptogram failures would be considered critical. The assessment report produced by the Reviewer will be evaluated by EMVCo who will accept or reject the report. An acceptable report that only includes non-critical failures would result in the kernel or IFM being assigned a “restricted renewal” and listed as such on the EMVCo website in a dedicated list. All evaluation results will be retained by EMVCo to ensure consistent assessments across kernels and IFMs. A product can receive only one extension (three years for kernels, four years for IFMs) as a “restricted renewal.” Kernels and IFMs must always be submitted for full renewal testing prior to consideration for restricted renewal. For an overview of the process flow, please refer to the “Restricted Renewal Process Flow” diagram in the appendix. Details of this process will be documented in the revised EMVCo Type Approval Process Documentations. Copyright © 2009 EMVCo, LLC. All rights reserved. Appendix [List of Reviewers] - Smart Consulting - TBD [Restricted Renewal Process Flow] Restricted Renewal Process Flow Kernels/ IFMs reaching renewal date Apply for renewal t est ing? NO YES All tests passed? NO Request for Restricted Renewal Review? YES Are the failures crit ical? YES Renewal date extended for another 3/ 4 years NO Approval revoked YES Approval revoked NO One- time extension of 3/ 4years granted as " restricted renewal" Approval revoked Copyright © 2009 EMVCo, LLC. All rights reserved.