With just six months to go before the EMV liability shift deadline, just how ready are credit unions? The answer depends on how members want to pay.
Most CUs' credit card portfolios are well prepared for the October shift, after which the liability for card-present fraud falls to whichever party is the least-EMV compliant in a fraudulent transaction, say industry insiders and analysts.
Art Harper, director of card payment solutions at PSCU, noted that of the CUSO's more than 500 credit clients, more than 100 are currently using EMV, and another 300 are scheduled to be ready by October.
"We're way ahead of the game," Harper said, citing an Aite Group report last year that projected 70% of U.S. credit cards could be enabled by the end of this year. But that article is now nine months old, and Harper projected that things will be closer to 90% by the end of 2015.
Similarly, Barney Moore, portfolio consulting services manager at Card Services for CUs, noted that about 75% of CSCU's credit union clients have already rolled out credit EMV or are in the process of doing so, with the remaining 25% either delaying for their own reasons or because they are rolling out EMV independent of CSCU.
"Overall, credit unions are in pretty good shape," asserted Moore. "Not all of their cards will be issued by Oct. 1, but they'll be in a position to at least have begun issuing, on the credit side, a substantial portion."
One observer even said CUs have done well to get the jump on the community banking sector when it comes to EMV readiness.
"I see credit unions as having a head start, because so many credit unions happen to live in the world of credit, and have started looking to EMV-enabled credit programs because of their viability in the U.S. market," said Allison Edwards, director of product delivery and support for card services at Fiserv.
Debit cards, however, are another story. The same Aite study PSCU's Harper referenced suggested that barely 40% of U.S. debit cards would be ready by October, and many analysts took a similar view. The hang-up with debit lies in the high number of routing networks which must all be EMV-ready—a process that won't be finalized until at least sometime next year.
"We've got 15-20 different regional PIN debit networks," explained Brandon Kuehl, manager of product development at The Members Group, noting that other countries that have rolled out EMV haven't had to deal with transitioning so many debit networks.
"Credit was easy—we followed what the rest of the world did," he said. "On debit we had to build our own solution and implement it. We're 12-24 months behind on debit from where we are on credit."
To be sure, if retailers aren't ready for EMV it won't matter how many consumers have chip-enabled cards. While no one expects chip cards to be universally accepted at every single merchant nationwide, PSCU's Harper said that 60%-70% of "tier one" merchants—big box retailers such as Walgreens, Walmart, CVS and Best Buy—will be ready this year. Regional merchants, or "tier two," are expected to be in the 50% range, whereas local "tier three" shops are only in the 35% range.
"The round-the-corner bodega, Larry's Dry Cleaners, they're lagging," said Harper. "There's a lot of education being provided to those tier threes, so that number will obviously jump up, because they couldn't afford to handle a compromise event without possibly basically almost going out of business."
TMG's Kuehl projected that about 40% of all merchants will be ready by October.
"Walmart is turned on right now and they've got 5,000 terminals," Kuehl said. "Target's going to be turned on. Some of these large merchants are going to be turned on before the liability shift date and they're going to make up a lot of the 35%."
He added that while the percentage is low, "the actual number of terminals out there accepting EMV is going to be pretty high. The mom-and-pop shops are going to be 2016, 2017, maybe later; fuel dispensers are going to be 2017, 2018. It's easier for the big box stores than some others, [but] as a whole, most merchants are on board with EMV."
But, cautioned Fiserv's Edwards, that doesn't mean they'll be ready for EMV debit come October.
"If you go to Walmart today and try to use a debit EMV card, you're not going to transmit," she said. "Whether or not big box retailers by and large will figure that out in time is very much something we have to see." She noted that Target is in a similar position as Walmart, whereas Home Depot has deployed debit acceptance in about 50 stores, with plans to roll out to 100 later this year. "But they tend to be more the outlier than the norm."
Time for Action Is Now
For those CUs that aren't ready yet, analysts were unanimous that the time to move is now. Not only do they need to review their card design to ensure that their logo doesn't infringe on the space where the chip needs to be, said PSCU's Harper, but credit unions must also work on getting EMV plastics in stock—a struggle right now, since "the supply chain is a little constricted because you've got all the issuers here in the U.S. trying to get card designs approved and chips into the plastics and plastics created and onto the shelves."
The best-case scenario, observers say, is a five- or six-month lead-up time before cards are in members' hands—and that's assuming everything moves quickly and according to plan.
"If you start now, you're probably going to miss the liability shift date, which isn't a big deal, but you need to get moving now," said TMG's Kuehl.
While the October deadline somewhat arbitrary—no one will punish an institution that isn't prepared by then—observers warned that noncompliance could harm credit unions. Not only do the face possible liability in the event of fraud, but the fraudsters are watching to see which FIs have made the switch and which have not.
There's also reputational risk at stake for those that haven't made the jump to more secure plastic, as other cards may go top of wallet.
"I may not choose to use XYZ credit union's card anymore because I feel like they're not looking out for my best interests as a consumer," said Harper.
No Leapfrog Effect
While EMV has been a hot topic of conversation in the payments space for many years now, the rise of mobile payments has been discussed with equal fervor. But one thing analysts agreed on is that ApplePay and other mobile payments methods won't leapfrog EMV.
"When you think of ApplePay, we don't have an influx of merchants that have adopted it" in the same manner that they have EMV, said Harper. "Walmart hasn't adopted it because they don't have the NFC technology; they choose not to offer NFC right now because it costs a bit more to process an NFC transaction than it does a regular plastic/EMV transaction."
If nothing else, said TMG's Kuehl, far more consumers have plastic—whether EMV-enabled yet or not—than have an iPhone 6.
"In payments you have to work on the lowest common denominator and make sure the lowest common denominator is as secure as it can be," he said. "We have to fix the plastic world, because there are still hundreds of millions or billions of plastics out there in the market. We have to secure that channel before we can go into ApplePay and tokenization."
But observers say that one technology will lead to the other, and credit unions that can do so should get on board with both.
"We're recommending that credit unions of substantial enough size, if they're serious enough about the business, that they pursue ApplePay, because we think that's where payments is migrating to in terms of the form factor," said CSCU's Moore. "But I think EMV and the technology around that is very closely related, and the technology we're using for tokenized transactions is really built around the EMV specification. If credit unions are serious about being in the business, they need to move forward with EMV migration plans and then incorporate things like ApplePay and other mobile wallet functionalities that come along subsequently."