EMVCo has announced that it is developing an EMV® Contactless Kernel Specification to simplify and advance global contactless payment acceptance. Following a detailed review with EMVCo Associates in February and March, a draft specification is now available on the EMVCo website for public review until 20 June 2022. In this post, EMVCo Contactless Kernel Task Force Chair, Alan Clark, answers key questions about the EMV Contactless Kernel Specification.
What is a contactless kernel?
A contactless kernel provides a set of functions for payment acceptance devices (such as point-of-sale terminals and ATMs) to process contactless transactions for a specific payment system.
Currently, there are more than 20 different payment system contactless kernels in use around the world. Kernel and device vendors provide products based on these kernels that enable merchants to accept contactless payments.
What is the EMV Contactless Kernel Specification?
The EMV Contactless Kernel Specification is a set of technical requirements for developing an EMV contactless kernel that can be used globally for seamless and secure contactless acceptance. Like the EMV Contact Chip Specification, the EMV Contactless Kernel Specification will be owned and managed by EMVCo and licensed by EMVCo royalty-free.
How will the EMV Contactless Kernel Specification simplify and advance global contactless payment acceptance?
The current multi-kernel environment for contactless is complex for all industry stakeholders, including merchants and hardware terminal vendors to support and maintain.
The EMV Contactless Kernel Specification aims to deliver an EMV contactless kernel that can be used for global contactless payment acceptance. Over time this can help reduce the number of contactless kernels that stakeholders need to support and maintain, creating opportunities for merchants, hardware providers and payment systems to reduce costs, and improve roll-out speed and time to market.
By incorporating new security and payment technologies, the EMV Contactless Kernel Specification provides a strong foundation for delivering secure contactless payments into the future.
Will the EMV Contactless Kernel Specification replace existing payment system contactless kernel specifications?
It will be up to each respective payment system to determine whether they continue using their own kernel specification or potentially, over time, replace it with the EMV Contactless Kernel Specification.
Payment systems that use the EMV Contactless Kernel Specification will also determine their own transition timeline for supporting the EMV Contactless Kernel Specification.
What are some of the specific features of the EMV Contactless Kernel Specification that support secure contactless payments?
The draft specification incorporates the latest in security features to help protect against fraud threats, including the use of Secure Channel for privacy protection of sensitive data against eavesdropping, man-in-the-middle and relay attacks. The specification also supports Elliptic Curve Cryptography (ECC) for card authentication, and biometric and mobile card verification methods.
What has been the process for developing the EMV Contactless Kernel Specification?
As with all EMV Specifications, the development of the EMV Contactless Kernel Specification is shaped by the needs of the payments industry. EMVCo has engaged extensively with EMVCo stakeholders and the wider payments industry to understand marketplace needs and determine the best approach for a contactless kernel specification.
This included a feasibility study, conducted by two independent consulting research firms. The development process has included a number of consultative meetings with EMVCo Associates, a request for comments from EMVCo Associates, and a public review. The Board of Advisors will review the final specification and vote on whether to approve its publication.
Will the EMV Contactless Kernel Specification be supported with testing?
EMVCo will provide approval testing for the EMV Contactless Kernel Specification through EMVCo accredited and audited laboratories, using EMVCo qualified test tools, exactly as the payment industry has relied on EMVCo to do for EMV Contact Chip for over 25 years.
Additionally, the EMVCo website will publish the list of all approved EMV contactless kernels that are able to pass EMVCo’s robust testing process. EMVCo will announce the availability of approval testing for the EMV contactless kernel at a later date.
Will the EMV Contactless Kernel Specification require an upgrade or replacement of devices?
The EMV Contactless Kernel Specification is based on the existing contactless terminal architecture. It does not force reissuance of cards or require new hardware.
When will the EMV Contactless Kernel Specification be available?
The public review period ends on 20 June. EMVCo will then review comments received and make any necessary updates to the draft. The aim is to release the final specification in the second half of 2022, subject to the review process and once its publication is approved by the EMVCo Board of Advisors.
by Arman Aygen
by Simon Kleine