PCI Watch

Tracking changes across the Payment Card Industry

SB nº SU-65 : CPA Last Online Transaction Not Completed (Spec Change)

v1.0 Specification Bulletins

Specification Update Bulletin No. 65 First Edition May 2008 CPA Last Online Transaction Not Completed This Specification Update Bulletin describes changes to the EMV Common Payment Application (CPA) Specification for Payment Systems. This change corrects the resetting of the ‘Last Online Transaction Not Completed’ indicator when a transaction gets an online response. The changes in this bulletin will be incorporated into version 1.0.d of the CPA Card Type Approval documentation (that is, Test Cases, Card Images, and Implementation Conformance Statement). Testing to this bulletin is optional for all CPA cards effective 1 November 2008. Testing to this bulletin is mandatory for all CPA cards effective 1 November 2010.

Applicability

This Specification Update Bulletin applies to:

  • EMV Common Payment Application Specification Version 1.0

Related Documents

  • EMV Integrated Circuit Card Specifications for Payment Systems Version 4.1 Book 3, Part CCD

Description

If the issuer authentication requirements (chosen by the issuer) are not met for an online transaction, CPA may be inconsistent with CCD rules regarding setting of the ‘Last Online Transaction Not Completed’ bit in the CVR. This is a result of the ‘Last Online Transaction Not Completed’ bit in the Previous Transaction History (PTH) for CPA being used for two purposes: 1) Persistent within a transaction from the first GENERATE AC to the second GENERATE AC of the same transaction: If the application requests to go online (an ARQC), the ‘Last Online Transaction Not Completed’ bit in the PTH is set just before sending the first GENERATE AC command response. It is expected to be reset during the second GENERATE AC command processing of the online transaction, regardless of the issuer authentication results, because the online transaction did receive the second GENERATE AC command. If the bit does not get

reset, then the application did not receive a second GENERATE AC command after going online. 2) Persistent between transactions from the first GENERATE AC of one transaction to the first GENERATE AC of a subsequent transaction: The ‘Last Online Transaction Not Completed’ bit in the PTH is checked during Card Risk Management in the first GENERATE AC command processing. If it is set, a previous online transaction did not receive the second GENERATE AC command after requesting to go online. The application will set the ‘Last Online Transaction Not Completed’ bit in the CVR to indicate to the issuer that a previous online transaction did not receive the second GENERATE AC command after going online. Once the CVR bit has been set, issuer authentication requirements chosen by the issuer must be met before the CVR bit can be reset, so the issuer authentication requirements also apply for resetting the ‘Last Online Transaction Not Completed’ bit in the PTH. Currently, CPA only resets the ‘Last Online Transaction Not Completed’ bit in the PTH if issuer authentication requirements are met. In description 1) above, if the issuer authentication requirements are not met, the ‘Last Online Transaction Not Completed’ bit in the PTH would not be reset. This results in the ‘Last Online Transaction Not Completed’ bit in the CVR being set erroneously during first GENERATE AC command processing of subsequent transactions, and remaining set until the issuer authentication requirements (chosen by the issuer) are met. The correction to CPA adds a check early in processing of the second GENERATE AC command for whether the ‘Last Online Transaction Not Completed’ bit was set in the CVR by card risk management of the first GENERATE AC command. If the bit in the CVR was not set, then the ‘Last Online Transaction Not Completed’ bit in the PTH can be reset during second GENERATE AC regardless of issuer authentication requirements (this reset is added by the change). If the bit in the CVR was set, then the ‘Last Online Transaction Not Completed’ bit in the PTH can only be reset if issuer authentication requirements are met (this reset is already included in CPA). Specification Change Notice Please make the following changes to EMV Common Payment Application Version 1.0. Add the following immediately after the text of requirement 17.8: “Req 17.90 (Update PTH, Last Online Transaction has completed) If the ‘Last Online Transaction Not Completed’ bit in the CVR has the value 0b, then reset the ‘Last Online Transaction Not Completed’ bit in the PTH to the value 0b25.” With the following text in the footnote 25 referenced at the end of the new requirement 17.90: “If the ‘Last Online Transaction Not Completed’ bit in the CVR has the value 0b, then the ‘Last Online Transaction Not Completed’ bit in the PTH was set during the first Generate AC processing for the current transaction and must be reset in the PTH because the current online transaction was completed. If the ‘Last Online Transaction Not Completed’ bit in the CVR has the value 1b, then the ‘Last Online Transaction Not Completed’ bit in the PTH was set during a previous transaction, and can only be reset in the PTH if the necessary issuer authentication requirements are met (see sections 17.5.3.1.1, 17.5.3.1.2, 17.5.3.2).”

Replace the off-page connector “1” at the end of flow 17-1 with the following: