The EMV® Payment Tokenisation Specification - Technical Framework v1.0 has been published by EMVCo. The technical document - which will be of interest to all industry participants including merchants, acquirers, card issuers and new payment entrants engaged in the mobile and digital secure payment ecosystem - is designed to allow market implementers to develop interoperable tokenisation solutions.
The global technical body is encouraging interested parties to download the document from the EMVCo website and engage in the ongoing payment tokenisation development activity.
EMVCo, which is collectively owned by American Express, Discover, JCB, MasterCard, UnionPay and Visa, announced that it would expand its scope to lead the payments industry in its work to standardise tokenisation in January 2014. The new specification will help provide the payments community with a consistent, secure and globally interoperable environment to make digital payments when using a mobile handset, tablet, personal computer or other smart device. This will encourage industry efficiencies and security enhancements for digital commerce.
The EMV Payment Tokenisation Specification - Technical Framework v1.0 describes the payment tokenisation landscape, the types of entities whose participation is key to supporting payment tokenisation, sufficient detail to implement multiple use cases, and the benefits of adopting a unified approach.
From a technical perspective, the document provides an insight into the role the specification will have in facilitating broad-based acceptance of a payment token as a replacement for a traditional card account number. This includes data message formats to ensure the interoperability of tokens and the consistent approach that should be used to route and authenticate a payment token. The framework also explains how security can be improved by limiting payment tokens for use in a specific environment, and how an existing ecosystem can advance to become globally interoperable.
Dave Meadon, current EMVCo Executive Committee Chair, comments: "It is vital that we have a consistent approach to identify and verify a payment token request, which is supported by industry agreed channel controls to manage where and when the payment token can be used. This level of consistency eliminates data vulnerabilities at key points in the transaction, which ultimately enhances security."
EMVCo has publically released this document to encourage industry adoption of the specification and aid its evolution. Christina Hulka, current EMVCo Board of Managers Chair, adds: "There are a variety of tokenisation systems in existence already. Within EMVCo's role to facilitate global interoperability and acceptance of secure payment transactions, our specification work will aim to provide a globally aligned technical framework for payment tokens. This will ensure consistency in data fields and the ability for transactions to gateway successfully throughout the payment ecosystem. By engaging with interested parties we can ensure that industry needs are met across stakeholders. This will enable us to create a standardised, secure and reliable environment across all payment channels."
The new specification from EMVCo will maintain compatibility with the current payment infrastructure and will be complementary to the existing EMV Chip Specifications to ensure consistency across all payment environments. Moving forward, EMVCo will actively solicit Associate, Subscriber and public feedback to support enhancements and inclusion of additional use cases. The specification framework will evolve with industry input collected to broaden its applicability and relevance to marketplace needs.
To fully engage in EMVCo's payment tokenisation activity and provide feedback on global interoperability and security requirements, join EMVCo's established Associates and Subscriber Programme which is open to all industry stakeholders.
Tokenisation is also a key topic that will be covered at the EMV User Meeting, 25-26 June in Kuala Lumpur. This annual interactive forum brings together senior EMVCo representatives, payment card issuers, acquirers, merchants, processors, card and terminal vendors, networks, and their respective associations. Interested parties can register now.