Information about this Replacement

Transcription

1 Information about this Replacement Replacement What is in this new version? The July 2008 Card Personalization Validation Guide replaces your existing document. Please refer to the Summary of Changes for a comprehensive list of changes reflected in this update.

2 Using this Document Purpose The Card Personalization Validation is a process to ensure that a Technical Product has been personalized in such a manner that it is compliant with the recommendations and the mandates expressed in the appropriate documents. This process validates that every Technical Product bearing a MasterCard brand mark offers the correct level of service, acceptance, interoperability, performance, and security to cardholders and acceptance locations. This guide details the process that you, the issuer, must perform. This process, organized into discrete subprocesses, is a sequence of activities that result in an exchange between the entities (an issuer, a CPV Service Provider, and MasterCard), and is presented as a collaboration business process. Audience MasterCard provides this guide for issuers, and their authorized agents. Specifically, the following personnel should find this guide useful: Program Managers and Project Managers for issuers implementing new or amending existing Technical Products bearing a MasterCard brand mark Personnel executing an instance of the Card Personalization Validation process Times Expressed MasterCard is a global company with locations in many time zones. The MasterCard operations and business centers are in the United States. The operations center is in St. Louis, Missouri, and the business center is in Purchase, New York. For operational purposes, MasterCard refers to time frames in this document as either St. Louis time or New York time. Coordinated Universal Time (UTC) is the basis for measuring time throughout the world. You can use the following table to convert any time used in this document into the correct time in another zone. 1

3 St. Louis, Missouri, USA Central Time Purchase, New York, USA Eastern Time UTC Standard time 09:00 10:00 15:00 (first Sunday in November to second Sunday in March 1 ) Daylight saving time 09:00 10:00 14:00 (second Sunday in March to first Sunday in November 2 ) Excerpted Text Language Use At times, this document may include text excerpted from another document. A note before the repeated text always identifies the source document. In such cases, we include the repeated text solely for the reader s convenience. The original text in the source document always takes legal precedence. The spelling of English words in this document follows the convention used for U.S. English as defined in Merriam-Webster s Collegiate Dictionary. MasterCard is incorporated in the United States and publishes in the United States. Therefore, this publication uses U.S. English spelling and grammar rules. An exception to the above spelling rule concerns the spelling of proper nouns. In this case, we use the local English spelling. Revisions MasterCard periodically may issue revisions to this document to accommodate enhancements and changes, or as corrections are required. With each revision, a Summary of Changes describes how the text changed. Revision markers (vertical lines in the right margin) indicate where the text changed. The date of the revision appears at the right of each revision marker. MasterCard may publish revisions to this document in a MasterCard bulletin, another MasterCard publication, or on MasterCard OnLine. A subsequent revision is effective as of the date indicated in that publication or on MasterCard OnLine and has precedence over any previous edition. In the event of a conflict between this document and a subsequently published edition, the subsequently published edition shall have precedence. 1 For Central European Time, last Sunday in October to last Sunday in March. 2 For Central European Time, last Sunday in March to last Sunday in October. 2

4 Organization The following table provides an overview of this document. Chapter 1, Introduction Chapter 2, The CPV Process Chapter 3, Issuer Self-Assessment Chapter 4, Contact CPV Service Provider Chapter 5, Sample Submission Chapter 6, Change Notification Submission Appendix A, Data Packages This chapter provides an introduction to Card Personalization Validation, detailing what it is, what products are subject to it, and when it should be done. This chapter provides an overview of the Card Personalization Validation process and a summary of its subprocesses. This chapter details the subprocess where you evaluate the Technical Product that you want to issue or amend and choose to either submit samples for testing or to submit a change notification for assessment. This chapter details the subprocess where you contact a CPV Service Provider and do the necessary administrative tasks. This chapter details the subprocess where you personalize a Technical Product and generate a Card Image from it which you send to the CPV Service Provider who tests it for conformance with the appropriate personalization specifications. If successful you will also be requested send the original Technical Product to the CPV Service Provider. You will receive a Personalization Compliance Report as a formal record of the result of the CPV Test, whether successful or not. This chapter details the subprocess where you provide a CPV Service Provider with a change list from an existing product and request an assessment to use the changed product. This appendix contains the data packages that group together data elements (or tags) which are functionally related and have similar CPV validation requirements. 3

5 Appendix B, How To Complete the CPV Sample Submission Form This appendix details how you should complete the CPV Sample Submission Form. Related Information The following documents and resources provide information related to the subjects discussed in this document: M/Chip Requirements M/Chip Personalization Data Specifications and Profiles M/Chip 4 Version 1.0 Common Personalization Specifications M/Chip 4 Version 1.1 Common Personalization Specifications M/Chip Qualified Test Tools Migrating Card Issuance to Chip Descriptions of these documents are available in the List of Manuals in the Member Publications product on MasterCard OnLine. Definitions of key terms used in this document are available in the MasterCard Dictionary. To order MasterCard documents, please use the Ordering Publications tool, available in the Quick Links section on the Member Publications home page, or contact the Customer Operations Services team. The following documents are available via MasterCard PayPass Mag Stripe Issuer Implementation Requirements Guide PayPass Personalization Data Specifications Adding PayPass to M/Chip Issuance 4

6 Terminology Application For the purposes of this guide an Application is a payment system application. Card Image Card Image Extractor Tool Card Personalization Validation (CPV) Change Management System CPV Management CPV Reference Number CPV Sample Test CPV Service Provider Personalization Compliance Report Personalization Profile Qualified CPV Test Tool An extract of the data from a Technical Product made using a Qualified CPV Test Tool or the MasterCard Card Image Extractor Tool. A tool from MasterCard than can be used to make a Card Image. A process to ensure that every Technical Product bearing a MasterCard brand mark offers the correct level of service, acceptance, interoperability, performance, and security to cardholders and acceptance locations. A system to maintain an audited set of changes that have been applied to a Technical Product. The functional unit at MasterCard who are responsible for managing Card Personalization Validation. A value allocated by the CPV Service Provider at the start of the Card Personalization Process to the Technical Product that will be tested and can be subsequently used to uniquely identify Technical Products that have completed the CPV process. A suite of tests performed by the CPV Service Provider on Card Images and physical Technical Products to ensure that their personalization is compliant with the appropriate standards. An entity authorized by MasterCard to deliver and invoice for the supply of the CPV Service. A report issued by the CPV Service Provider which states whether the CPV Sample Test was successful. A Personalization Profile is a set of MasterCard predefined values for chip data elements that ensure a Technical Product works in a way that conforms to a chosen behavior, such as Full Chip MasterCard Signature, Online PIN and No CVM. A test tool that a customer may use in the CPV process to generate a Card Image. The test tool must be qualified by MasterCard and such be in the Validations Tools List in M/Chip Qualified Test Tools. 5

7 Technical Product For the purposes of this document, a Technical Product defines a specific combination of Vendor Product, Application, Personalization Profile and personalization parameter settings, that will be offered by an issuer to its cardholders. An issuer may use the same Technical Product to support more than one type of cardholder offering (for example, an issuer s commercial offerings, such as Gold and Standard cards may both use the same Technical Product, subject to the guidelines published in this document). Vendor Product A Vendor Product defines a card or device with a specific application as provided by a manufacturer before specific personalization parameter settings have been loaded. 6

8 Business Process Diagram Conventions The business process diagrams in this guide use the following symbols: A pool is used to contain activities within an organization. An activity can be atomic (a task) or compound (contain multiple activities). An activity is started (or triggered) by a Start Event, a Time-based Trigger, or a sequence or message flow from another activity. Sequence flow lines (with solid lines and arrowheads) connect one activity to another, to a gateway or to an end event. Gateways signal a split in a process flow or a merger of multiple process flows. Message flow lines (with dashed lines and open arrowheads) connect activities across pools (usually via an artifact). A process contains activities interconnected by means of flow lines. 7

9 Contact Us CPV Management MasterCard is listening... MasterCard Worldwide CPV Management Chip Center of Excellence Chaussée de Tervuren 198A B-1410 Waterloo Belgium Please take a moment to provide MasterCard with your feedback about the Card Personalization Validation Guide. MasterCard continually strives to improve user documents. User feedback helps MasterCard accomplish this goal. Please provide feedback about this document to Manuals and Publications at publications@mastercard.com. Support Please address your questions about MasterCard programs and services to the Customer Operations Services team as follows. Phone: or Fax: (Spanish language support) Telex: Address: answerback: ITAC UI MasterCard Worldwide Customer Operations Services 2200 MasterCard Boulevard O Fallon MO USA Canada, Caribbean, Latin America, and United States Australia and New Zealand China, Hong Kong, and Taiwan Southeast Asia Japan/Guam customer_support@mastercard.com csd@mastercard.com helpdesk.gc@mastercard.com helpdesk.singapore@mastercard.com opetokyo@mastercard.com 1

10 Korea Europe and South Asia/Middle East/Africa Spanish language support Vendor Relations, all regions Contacting Your U.S. Member Relations Representative Member Relations representatives assist U.S. members with marketing inquiries. They interpret member requests and requirements, analyze them, and if approved, monitor their progress through the various MasterCard departments. This does not cover support for day-to-day operational problems, which the Customer Operations Services team addresses. For the name of your U.S. Member Relations representative, contact your local Member Relations office: Atlanta Chicago Purchase San Francisco Contacting Your Regional Representative The regional representatives work out of the regional offices. Their role is to serve as intermediaries between the members and other departments in MasterCard. Members can inquire and receive responses in their own languages and during their offices hours of operation. For the name of the location of the regional office serving your area, call the Customer Operations Services team. 2

11 Summary of Changes Card Personalization Validation Guide, July 2008 Description of Change The CPV process is now performed in collaboration with a CPV Service Provider, and an Purchase Order needs to be established with the CPV Service Provider before testing can be done. The CPV Sample Submission Form is now available directly from the Business Forms area within MasterCard OnLine. The use of card images during sample submission necessitating the use of a Qualified CPV Test Tool or the MasterCard Card Image Extractor Tool. The Personalization Compliance Report is digitally signed by MasterCard. Where to Look Complete document 1

12 Card Personalization Validation Guide July 2008

13 Proprietary Rights The information contained in this document is proprietary and confidential to MasterCard International Incorporated, one or more of its affiliated entities (collectively MasterCard ), or both. This material may not be duplicated, published, or disclosed, in whole or in part, without the prior written permission of MasterCard. Trademarks Trademark notices and symbols used in this document reflect the registration status of MasterCard trademarks in the United States. Please consult with the Customer Operations Services team or the MasterCard Law Department for the registration status of particular product, program, or service names outside the United States. All third-party product and service names are trademarks or registered trademarks of their respective owners. Media Address This document is available: On MasterCard OnLine On the MasterCard Electronic Library (CD-ROM) MasterCard Worldwide 2200 MasterCard Boulevard O Fallon MO USA CPV July 2008 Card Personalization Validation Guide

14 Table of Contents Chapter 1 Introduction... 1-i What is Card Personalization Validation? Products subject to Card Personalization Validation When to do Card Personalization Validation Prerequisites for doing Card Personalization Validation Chapter 2 The CPV Process... 2-i Process Overview Issuer Self-Assessment Contact CPV Service Provider Sample Submission Change Notification Submission Chapter 3 Issuer Self-Assessment... 3-i Overview Process Changes That Can Be Considered Minor Changes in Product Implementation Changes to Card Risk Management Personalization Parameter Settings Changes to EMV Data Personalization Parameter Settings Changes to Certificate and Key Data Personalization Parameter Settings Changes to Variables Personalization Parameter Settings Changes to Other Data Personalization Parameter Settings Changes to Thresholds Chapter 4 Contact CPV Service Provider... 4-i Overview Process Chapter 5 Sample Submission... 5-i Overview Process Chapter 6 Change Notification Submission... 6-i Overview Process Appendix A Data Packages...A-i Introduction...A-1 Card Personalization Validation Guide July 2008 i

15 Table of Contents Format Requirements...A-1 Data Package 1 Card Risk Management...A-2 Data Package 2 EMV Data...A-4 Data Package 3 Cardholder Data...A-5 Data Package 4 Certificate and Key Data...A-6 Data Package 5 Variables...A-7 Data Package 6 Other Data, Minor Impact...A-8 Data Package 7 Other Data, Major Impact...A-9 Data Package 8 Thresholds...A-10 Appendix B How To Complete the CPV Sample Submission Form... B-i Prerequisites...B-1 Completing the CPV Sample Submission Form...B-1 ii July 2008 Card Personalization Validation Guide

16 Chapter 1 Introduction This chapter provides an introduction to Card Personalization Validation, detailing what it is, what products are subject to it, and when it should be done. What is Card Personalization Validation? Products subject to Card Personalization Validation When to do Card Personalization Validation Prerequisites for doing Card Personalization Validation Card Personalization Validation Guide July i

17 Introduction What is Card Personalization Validation? What is Card Personalization Validation? NOTE Card Personalization Validation is a process to ensure that a Technical Product has been personalized in such a manner that it is compliant with the recommendations and the mandates expressed in the applicable documents: M/Chip Requirements (available on Member Publications Smart Card) M/Chip Personalization Data Specifications and Profiles (available on Member Publications Smart Card) MasterCard PayPass M/Chip Issuer Implementation Requirements Guide (available on PayPass M/Chip Flex Issuer Implementation Guide (available on Maestro PayPass Issuer Implementation Guide (available on MasterCard CPV Issuer Guide to Parameter Management (available on Member Publications Smart Card) By performing Card Personalization Validation you ensure that your Technical Product that bears a MasterCard brand mark offers the correct level of service, acceptance, interoperability, performance, and security to your cardholders and acceptance locations. Where applicable, data held on the magnetic stripe itself is not subject to any form of testing or validation, except for consistency checks against the magnetic stripe equivalent data that is held on the chip. Products subject to Card Personalization Validation Card Personalization Validation is applied to Technical Products that have: A contact interface A contactless interface (PayPass) The following products are therefore applicable for Card Personalization Validation: M/Chip: These products have a contact interface and a traditional magnetic stripe: CPV validates the personalization of the Application(s) via the contact interface. PayPass M/Chip: These products, when in ID-1 form factor, have a contact interface, contactless interface, and a traditional magnetic stripe: CPV validates the personalization of the Application(s) via the contact and contactless interfaces; when in a non ID-1 form factor, CPV validates the personalization of the Application(s) via the contactless interface only. PayPass M/Chip Flex: These products, when in ID-1 form factor, have a contact interface, contactless interface, and a traditional magnetic stripe: CPV validates the personalization of the Application(s) via the contact and contactless interfaces; when in a non ID-1 form factor, CPV validates the personalization of the Application(s) via the contactless interface only. Card Personalization Validation Guide July

18 Introduction When to do Card Personalization Validation PayPass Mag Stripe: These products only have a contactless interface: CPV validates the personalization of the Application(s) via the contactless interface. Common Payment Application: CPV validates the personalization of the Application(s) via a contact interface. Other Chip Platforms: these products are those Technical Products based on non-m/chip platforms (such as UKIS, VSDC, SECCOS) that bear a MasterCard brand name; CPV validates the personalization of basic EMV data as described in M/Chip Requirements and no dynamic validation testing is performed. NOTE Non ID-1 form factors are known generically as devices. For clarity, this document refers to all form factors as products. For historical reasons, some names retain references to card, such as Card Issuer Action Code, Card Personalization Validation and so forth. When to do Card Personalization Validation Card Personalization Validation is a mandatory process and must be invoked when you do any of the following: You are issuing a new Technical Product. If this is being done in the context of a Chip Migration Project refer to Migrating Card Issuance to Chip for details of where Card Personalization Validation is done in the migration process; similarly, when adding PayPass to an existing M/Chip implementation, refer to Adding PayPass to M/Chip Issuance. You have an existing Technical Product and want to amend any of the personalization characteristics (excluding cardholder related data and expiration dates as specified in Table A.5). You have an existing Technical Product and must amend the personalization characteristics due to changes in M/Chip Personalization Data Specifications or PayPass Personalization Data Specification or as the result of an Operations Bulletin. You have an existing Technical Product and want to add another application, such as CAP, to it. You have an existing Technical Product and want to change the Vendor Product. You have an existing Technical Product and want to change the Personalization Bureau. Prerequisites for doing Card Personalization Validation For M/Chip (including PayPass M/Chip and PayPass M/Chip Flex) and CPA Technical Products there are two prerequisites for CPV: You have selected a Product Manufacturer and Personalization Bureau that have completed the MasterCard Global Vendor Certification Program. You have selected an approved M/Chip, PayPass, or CPA product. 1-2 July 2008 Card Personalization Validation Guide

19 Introduction Prerequisites for doing Card Personalization Validation NOTE Certified vendors are listed in the Certified Vendors (for Card Production Services of any MasterCard, Maestro, or Cirrus Branded Card) document that is regularly published as an attachment to the Global Security Bulletin, available on MasterCard OnLine. Depending on your requirements, the approved product list is located as follows: M/Chip: M/Chip approved products are listed in the relevant table of M/Chip Approved Products that is published on MasterCard OnLine. The list of approved products only includes product information from vendors who have requested to be listed and have provided product information to MasterCard. NOTE If you want to use a product that is not listed (because not all approved products may be listed) you must obtain proof of approval from your vendor. If the vendor cannot provide all related documents, please contact chip_waivers@mastercard.com. PayPass M/Chip, PayPass Mag Stripe and PayPass M/Chip Flex: A copy of the PayPass Vendor Product Letter of Approval for each approved product is published on Common Payment Application (CPA): A copy of the CPA Vendor Product Letter of Approval for each approved product is published on M/Chip, PayPass M/Chip, PayPass M/Chip Flex, and CPA products offer many opportunities for customization during the initialization or the personalization phase. Some customization changes are considered as critical, and in these circumstances any existing approval granted to the selected product may not apply. Examples of critical customization changes are: Changes to the interface bytes of the Answer to Reset (where the product allows this) Creation of data sharing between Applications MasterCard recommends that you check with your chosen product manufacturer that the exact configuration that you intend to issue is covered by the product approval. If this is not the case, you should anticipate additional testing during your project planning. For more information, please contact chip_personalization@mastercard.com or chip_cardfunctionalcompliancetesting@mastercard.com. If you are intending to use a non-m/chip or PayPass products (such as UKIS, VSDC, SECCOS, and so on) you will also need to contact chip_waivers@mastercard.com and apply for a waiver. Card Personalization Validation Guide July

20 Chapter 2 The CPV Process This chapter provides an overview of the Card Personalization Validation process and a summary of its subprocesses. Process Overview Issuer Self-Assessment Contact CPV Service Provider Sample Submission Change Notification Submission Card Personalization Validation Guide July i

21 The CPV Process Process Overview Process Overview The Card Personalization Validation process is organized into discrete subprocesses that are a sequence of activities that result in an exchange between various entities (an issuer, a CPV Service Provider, and MasterCard), and is presented as a collaboration business process. This figure shows the process and the sequence flow between its constituent subprocesses: Figure 2.1 Card Personalization Validation Process Flow The Card Personalization Validation (CPV) process comprises four subprocesses: Issuer Self-Assessment Contact CPV Service Provider Sample Submission Change Notification Submission Issuer Self-Assessment In this subprocess you evaluate the Technical Product that you want to issue and choose to either submit samples for testing (Sample Submission) or to submit a change notice for assessment (Change Notification Submission). A prerequisite for being able to do Change Notification Submission instead of Sample Submission is that you have a Change Management System. Card Personalization Validation Guide July

22 The CPV Process Contact CPV Service Provider This subprocess is detailed in Chapter 3, Issuer Self-Assessment. Contact CPV Service Provider In this subprocess you contact a CPV Service Provider and complete the necessary administrative tasks. This subprocess is detailed in Chapter 4, Contact CPV Service Provider. Sample Submission In this subprocess you personalize a sample card, create a Card Image from it, then send, by , the Card Image to a CPV Service Provider who tests it for conformance with the appropriate personalization specifications. The Card Image is created using either a Qualified CPV Test Tool or the MasterCard Card Image Extraction Tool. If the test fails you will need to make the necessary changes and provide a new Card Image for testing. If the test is successful, you are requested to send the physical card from which the Card Image was extracted so that the CPV Service Provider perform a final check that the card and image are identical before issuing the Personalization Compliance Report. A fee is charged to you (the issuer) per iteration of testing that is done for MasterCard branded Applications via a contact interface. Currently, no fee is charged to you (the issuer) for MasterCard Applications tested via a contactless interface. This subprocess is detailed in Chapter 5, Sample Submission. Change Notification Submission NOTE In this subprocess you provide a change list from an existing Technical Product and request an assessment from a CPV Service Provider to use the changed Technical Product. This subprocess is detailed in Chapter 6, Change Notification Submission. As a result of the assessment in the Change Notification Submission, you may be requested to do the Sample Submission subprocess (and its precursor Contact CPV Service Provider) before the result of the Card Personalization Validation can be given. 2-2 July 2008 Card Personalization Validation Guide

23 Chapter 3 Issuer Self-Assessment This chapter details the subprocess where you evaluate the Technical Product that you want to issue or amend and choose to either submit samples for testing or to submit a change notification for assessment. Overview Process Changes That Can Be Considered Minor Changes in Product Implementation Changes to Card Risk Management Personalization Parameter Settings Changes to EMV Data Personalization Parameter Settings Changes to Certificate and Key Data Personalization Parameter Settings Changes to Variables Personalization Parameter Settings Changes to Other Data Personalization Parameter Settings Changes to Thresholds Card Personalization Validation Guide July i

24 Issuer Self-Assessment Overview Overview This figure shows the Issuer self-assessment subprocess flow: Figure 3.1 Issuer Self-Assessment Subprocess Flow Process You must make an assessment of whether to do Sample Submission or Change Notification Submission: Case #1: If you have not previously done Card Personalization Validation, you must elect to do Sample Submission, see Chapter 5, Sample Submission. Case #2: If you are not deriving your changes from an existing approved Technical Product, you must elect to do Sample Submission, see Chapter 5, Sample Submission. Case #3: If neither of the above two conditions apply, you are making changes permissible in Changes That Can Be Considered Minor, and you have a Change Management System, then you can elect to do a Change Notification Submission, see Chapter 6, Change Notification Submission. In all other circumstances, you must elect to do Sample Submission, see Chapter 5, Sample Submission. Changes That Can Be Considered Minor A change can be considered minor, and therefore acceptable for you to do Change Notification Submission (see Chapter 6, Change Notification Submission), if it meets certain criteria for the type of change that you are making. Card Personalization Validation Guide July

25 Issuer Self-Assessment Changes That Can Be Considered Minor Changes in Product Implementation For MULTOS Products, a minor change is when you migrate from one MULTOS product to another, and: The new MULTOS product is approved by MasterCard The Application Loading Unit is unchanged The product settings are unchanged For non-multos Cards, a minor change is when you migrate from one product to another, and: Migration occurs within the same manufacturers range of products No changes to the personalization are required, that is, with the new product the personalization will be exactly the same, in terms of: file structure data organization personalization scripts card settings padding (if applicable) Changes to Card Risk Management Personalization Parameter Settings When changing the Card Risk Management personalization parameters, a minor change is when you change the parameters, as specified in Data Package 1 Card Risk Management, to a value specified in the reference documentation settings. Changes to EMV Data Personalization Parameter Settings When changing the EMV Data Personalization parameters, a minor change is when you change the parameters, as specified in Data Package 2 EMV Data, to a value specified in the reference documentation settings. Changes to Certificate and Key Data Personalization Parameter Settings When changing the Certificate and Key Data parameters, a minor change is when you change the parameters, as specified in Data Package 4 Certificate and Key Data, in such a way that there are no additions or deletions or remainders, or there is no relocation of data within the file structure. Changes to Variables Personalization Parameter Settings When changing the Variables personalization parameters, a minor change is when you change any of the parameters, as specified in Data Package 5 Variables. 3-2 July 2008 Card Personalization Validation Guide

26 Issuer Self-Assessment Changes That Can Be Considered Minor Changes to Other Data Personalization Parameter Settings When changing the Other Data personalization parameters, a minor change is when you change any of the parameters, as specified in Data Package 6 Other Data, Minor Impact. Changes to Thresholds When changing the Thresholds personalization parameters, a minor change is when you change the parameters, as specified in Data Package 8 Thresholds, in such a way that a limit is not altered from zero to a non-zero value or such that the a velocity check is deactivated. Card Personalization Validation Guide July

27 Chapter 4 Contact CPV Service Provider This chapter details the subprocess where you contact a CPV Service Provider and do the necessary administrative tasks. Overview Process Card Personalization Validation Guide July i

28 Contact CPV Service Provider Overview Overview This figure shows the Contact CPV Service Provider subprocess flow: Figure 4.1 Contact CPV Service Provider Subprocess Flow Process The starting task for this subprocess depends on whether you are doing Card Personalization Validation for an Application via a contact interface: If you are doing Card Personalization Validation for an Application via a contact interface, start at step 1 (as you need to establish a purchase order with a CPV Service Provider because you, the issuer, are charged a fee for CPV via a contact interface). Card Personalization Validation Guide July

29 Contact CPV Service Provider Process If you are doing Card Personalization Validation for an Application via a contactless interface (such as Technical Product using a PayPass M/Chip Application in a non-id-1 form factor), start at step 4 (as you do not need to establish a purchase order with a CPV Service Provider because you, the issuer, are not charged a fee for CPV via a contactless interface). 1. Card Personalization Validation is performed by a CPV Service Provider. You must request a Purchase Order Form from a CPV Service Provider that you will use to cover the provision of their testing services (for an application via the contact interface of your Technical Product) in this regard. Details of CPV Service Providers can be requested from chip_services@mastercard.com. 2. Complete and send the Purchase Order to the CPV Service Provider. NOTE The CPV testing cannot take place until the CPV Service Provider has received and confirmed the necessary Purchase Order. Therefore, to avoid future delays, you must send the Purchase Order without delay. 3. The CPV Service Provider will send you a confirmation of your purchase order and an accompanying invoice to cover one iteration of CPV Testing. NOTE If there is a problem with your purchase order, the CPV Service Provider will send/return the form to you. Go back to step Send an to chip_personalization@mastercard.com to request Card Personalization Validation for your Technical Product. In the request you must provide: NOTE a. A completed CPV Sample Submission Form, which is available in the Chip category of the Business Forms area within MasterCard OnLine. b. The date when you can provide a Card Image to the CPV Service Provider for testing. The CPV Service Provider uses the originating address of this request for all future correspondence regarding this sample submission. 5. The CPV Service Provider will check the information that you submitted and you will receive an response that contains the CPV Tracking Number, which is a number that you must quote on all further correspondence with the CPV Service Provider related to this instance of Card Personalization Validation for your Technical Product(s). Either of the following will also apply: If the information in the CPV Sample Submission Form is correct, you will also receive the CPV Test Date, which is the date when the CPV Service Provider will do the CPV Sample Test. If CPV Sample Submission Form is missing information you will be requested to correct and resubmit it. Go back to step July 2008 Card Personalization Validation Guide

30 Chapter 5 Sample Submission This chapter details the subprocess where you personalize a Technical Product and generate a Card Image from it which you send to the CPV Service Provider who tests it for conformance with the appropriate personalization specifications. If successful you will also be requested send the original Technical Product to the CPV Service Provider. You will receive a Personalization Compliance Report as a formal record of the result of the CPV Test, whether successful or not. Overview Process Card Personalization Validation Guide July i

31 Sample Submission Overview Overview This figure shows the Sample Submission subprocess flow: Figure 5.1 Sample Submission Subprocess Flow Card Personalization Validation Guide July

32 Sample Submission Process Process 1. Have your personalization bureau personalize a sample of your selected Technical Product to the parameters that you specified in the CPV Sample Submission Form. 2. Self-validate that the personalized Technical Product has been personalized as specified on the CPV Sample Submission Form. You can self-validate by either of the following: Manually reading the data from the Technical Product using a suitable card/device reader and checking the data against the personalization profile parameters. Using a Qualified CPV Test Tool to automatically check for compliance. For details of Qualified CPV Test Tools, refer to M/Chip Qualified Test Tools. 3. If your self-validation indicates that you need to make changes: Send an to chip_personalization@mastercard.com to advise that the CPV Test Date needs to be rescheduled; you will receive a new date as appropriate. Make changes as appropriate. Go back to step Generate a Card Image from the Technical Product and send it, along with an electronic copy of the CPV Sample Submission Form to chip_personalization@mastercard.com. The Card Image is created using either a Qualified CPV Test Tool or the MasterCard Card Image Extraction Tool. For more information on how to make a Card Image, refer to the documentation that accompanies the tool you are using. NOTE The CPV Service Provider uses the originating address of this request for all future correspondence regarding this sample submission. 5. When the Card Image is received by the CPV Service Provider you will receive an acknowledgement by and a confirmed CPV Test Date. 6. On the confirmed CPV Test Date, the CPV Service Provider will perform the CPV Sample Test based on your Card Image and the information that you provided in the CPV Sample Submission Form. Every CPV Test made for an Application via a contact interface is a chargeable event; you will be invoiced on completion of a successful CPV Test for every such CPV Test iteration. If the test is successful you will be requested to provide the physical sample of the Technical Product from which the Card Image was derived. This should be sent to the CPV Management address detailed in Contact Us. If the personalization of the physical sample is found to be identical to the Card Image, a successful Personalization Compliance Report will be prepared. However, if the personalization of the physical sample and the Card Image differ, another iteration of the CPV Sample Test will be performed (and you will incur a fee for this iteration if it is for an Application via the contact interface). 7. You will receive by a Personalization Compliance Report. This report will be in the form of a PDF document. For a successful CPV Test, the PDF document will be digitally signed by MasterCard. 5-2 July 2008 Card Personalization Validation Guide

33 Sample Submission Process 8. If the Personalization Compliance Report states that the CPV Sample Test was successfully passed, and there was more than one iteration of testing performed, the CPV Service Provider will send you an invoice for the additional iterations. You need to settle this invoice. 9. If the Personalization Compliance Report states that the CPV Sample Test was not successfully passed, then: a. Make the changes suggested in the report. b. Send an to to request a new CPV Test Date. c. Go back to step 1. Card Personalization Validation Guide July

34 Chapter 6 Change Notification Submission This chapter details the subprocess where you provide a CPV Service Provider with a change list from an existing product and request an assessment to use the changed product. Overview Process Card Personalization Validation Guide July i

35 Change Notification Submission Overview Overview NOTE You can only do this subprocess if you have a Change Management System. This figure shows the Change Notification Submission flow: Figure 6.1 Change Notification Submission Subprocess Flow Process 1. Get the CPV Change Notification Form which you can find in the Chip category of the Business Forms area within MasterCard OnLine. NOTE The CPV Service Provider uses the originating address of this request for all future correspondence regarding this change notification submission. 2. Complete the information requested in the form and send it by to chip_personalization@mastercard.com. 3. The CPV Service Provider will assess your submission and send you a report by which will be either. A positive assessment and you will be given report saying so, and it will be digitally countersigned by MasterCard. The report contains a CPV Reference Number to uniquely refer to this Change Notification Submission for the Technical Product in any future correspondence A neutral assessment and you will be given a report saying so and are requested to do a Sample Submission (and its precursor Contact CPV Service Provider) to evaluate the changes that you propose before a positive or negative report can be issued. Card Personalization Validation Guide July

36 Appendix A Data Packages This appendix contains the data packages that group together data elements (or tags) which are functionally related and have similar CPV validation requirements. Introduction...A-1 Format Requirements...A-1 Data Package 1 Card Risk Management...A-2 Data Package 2 EMV Data...A-4 Data Package 3 Cardholder Data...A-5 Data Package 4 Certificate and Key Data...A-6 Data Package 5 Variables...A-7 Data Package 6 Other Data, Minor Impact...A-8 Data Package 7 Other Data, Major Impact...A-9 Data Package 8 Thresholds...A-10 Card Personalization Validation Guide July 2008 A-i

37 Data Packages Introduction Introduction A data package groups together data elements (or tags) which are functionally related and have similar CPV validation requirements. There are eight Data Packages, as shown here: Table A.1 Data Packages Data Package Name 1 Card Risk Management 2 EMV Data 3 Cardholder Data 4 Certificate Key Data 5 Variables 6 Other Data, Minor Impact 7 Other Data, Major Cross Impact on Data Package 1/Data Package 2 8 Thresholds Format Requirements The notations shown here are used to describe the requirements for the personalization parameters in each Data Package. Table A.2 Format Notations Usage Code M1 M2 M3 C Description Mandatory: If the source of this data element is the ICC, this data element is mandatory. If the source of this data element is the terminal, the terminal must supply a correct value in the format fixed by EMV if the product requests the data element in a DOL. Mandatory: This data element is mandatory for ICCs that implement SDA. Mandatory: This data element is mandatory for ICCs that implement DDA. Conditional: This data element is not present, unless specific conditions are met, in which case this data element becomes mandatory. Card Personalization Validation Guide July 2008 A-1

38 Data Packages Data Package 1 Card Risk Management Usage Code O NA Description Optional: This data element is optional. If the source of this data element is the terminal, the terminal is allowed to send a value containing binary zeros, which means that the data is not supported by the terminal if the product requests the data element in a DOL. Not applicable Data Package 1 Card Risk Management NOTE The data elements shown in Table A.3 define the card risk management parameters. They are linked to the specification that the Technical Product is based upon. Certain parameters have a different Tag value if the Technical Product is M/Chip only or PayPass M/Chip. Unless information specific to Maestro PayPass or PayPass M/Chip Flex is indicated, Technical Products based on Maestro PayPass and PayPass M/Chip Flex should follow the same process as PayPass - M/Chip. Changes to parameters in this Data Package that do not conform to reference documentation settings are considered as major and initiate Sample Submission. Changes that conform to reference document settings are considered as minor and initiate Change Notification Submission. Table A.3 Data Package 1 Card Risk Management Name EMV, M/Chip, PayPass - M/Chip, or CPA Template Tag EMV MasterCard Accumulator Profile Controls template CPA BF31 DF0x NA C Accumulator x Controls CPA BF32 DF0x NA C Additional check table M/Chip D3 NA M1 CPA BF33 DF0x NA C Application Control M/Chip D5 NA M1 PayPass M/Chip D7 NA M1 CPA C1 NA M1 A-2 July 2008 Card Personalization Validation Guide

39 Data Packages Data Package 1 Card Risk Management Name EMV, M/Chip, PayPass - M/Chip, or CPA Template Tag EMV MasterCard Card Issuer Action Code Template (CIAC entries) CPA BF34 DF0x NA M1 Card Issuer Action Codedecline M/Chip C3 NA M1 PayPass M/Chip CF NA M1 Card Issuer Action Code-default M/Chip C4 NA M1 PayPass - M/Chip CD NA M1 Card Issuer Action Code-online M/Chip C5 NA M1 PayPass - M/Chip CE NA M1 CDOL1 related data length M/Chip C7 NA M1 CRM Country Code M/Chip C8 NA M1 CRM Currency Code M/Chip C9 NA M1 Cryptogram Version Number EMV NA M1 Currency Conversion Table template CPA BF38 DF0x NA C Currency Conversion Table M/Chip D1 NA M1 Counter Profile Controls template CPA BF36 DF0x NA C Counter x Controls template CPA BF37 DF0x NA C Cyclic Accumulator Profile Control x Cyclic Accumulator x Controls template Derivation key index (included in Issuer Option Control) CPA BF39 DF0x NA C CPA BF3A DF0x NA C M/Chip NA M1 CPA NA M1 Default ARPC Response Code M/Chip D6 NA M1 GPO Parameters CPA BF3E DF0x NA M1 Issuer Options Profile Controls template CPA BF3B DF0x NA M1 Card Personalization Validation Guide July 2008 A-3

40 Data Packages Data Package 2 EMV Data Name EMV, M/Chip, PayPass - M/Chip, or CPA Template Tag EMV MasterCard MTA Profile Controls template CPA BF3D DF0x NA C Profile Controls template CPA BF3F DF0x NA M1 Data Package 2 EMV Data The data elements shown in Table A.4 are key EMV parameters. The chip provides them to the terminal to support various types of processing, for example, Terminal Risk Management (TRM) processing. They specify application usage, and how you want the transaction to be processed under certain conditions. Certain parameters have a different Tag value if the Technical Product is EMV or PayPass M/Chip. Changes to parameters in this Data Package that do not conform to reference documentation settings are considered as major and initiate Sample Submission (Chapter 5, Sample Submission). Changes that conform to reference document settings are considered as minor and initiate Change Notification Submission (Chapter 6, Change Notification Submission). Table A.4 Data Package 2 EMV Data Name EMV orpaypass - M/Chip Tag EMV MasterCard Application Currency Code EMV 9F42 O O Application Currency Exponent EMV 9F44 O O Application Discretionary Data EMV 9F05 O O Application Identifier (AID) EMV 4F M1 M1 Application Interchange Profile EMV 82 M1 M1 PayPass - M/Chip D8 M1 M1 Application Label EMV 50 O C Application Preferred Name EMV 9F12 O O Application Usage Control (AUC) EMV 9F07 O M1 Application Version Number EMV 9F08 O M1 A-4 July 2008 Card Personalization Validation Guide

41 Data Packages Data Package 3 Cardholder Data Name EMV orpaypass - M/Chip Tag EMV MasterCard Cardholder Verification Method (CVM) List EMV 8E O M1 Certification Authority Public Key Index EMV 8F M2/M3 M2/M3 Directory Definition File (DDF) Name EMV 9D M1 M1 Dedicated File (DF) Name EMV 84 M1 M1 Issuer Action Code Default EMV 9F0D O M1 Issuer Action Code Denial EMV 9F0E O M1 Issuer Action Code Online EMV 9F0F O M1 Static Data Authentication Tag List EMV 9F4A O M3 Data Package 3 Cardholder Data The data elements shown in Table A.5 contain cardholder related data. They are provided to the terminal to allow correct identification of the cardholder, and of the application being used to perform the transaction. Changes to parameters in this Data Package do not require any further assessment with regard to card personalization validation. These values are provided for your information. Table A.5 Data Package 3 Cardholder Data Name EMV or M/Chip Tag EMV MasterCard Application Effective Date EMV 5F25 O O Application Expiration Date EMV 5F24 M1 M1 Application Primary Account Number (PAN) EMV 5A M1 M1 Application Primary Account Number (PAN) Sequence Number EMV 5F34 O M1 Cardholder Name EMV 5F20 O C Cardholder Name Extended EMV 9F0B O O Offline PIN EMV O O Track 1 Discretionary Data EMV 9F1F O O Card Personalization Validation Guide July 2008 A-5

42 Data Packages Data Package 4 Certificate and Key Data Name EMV or M/Chip Tag EMV MasterCard Track 2 Discretionary Data EMV 9F20 O O Track 2 Equivalent Data EMV 57 O M1 Data Package 4 Certificate and Key Data The data elements shown in Table A.6 are related to certificates and keys. They are provided to the terminal to allow the CAM (for example, SDA or DDA) to be performed. Changes to parameters in this Data Package which result in addition or deletion of remainders, or relocation of data within the file structure are considered as major and initiate Sample Submission. All other changes are considered as minor and initiate Change Notification Submission. Table A.6 Data Package 4 Certificate and Key Data Name EMV or M/Chip Tag EMV MasterCard Certification Authority Public Key Index EMV 8F M2 M2 Data Authentication Code EMV 9F45 M2 M2 ICC PIN Encipherment Public Key Certificate EMV 9F2D O O ICC PIN Encipherment Public Key Exponent EMV 9F2E O O ICC PIN Encipherment Public Key Remainder EMV 9F2F O O Integrated Circuit Card (ICC) Public Key Certificate Integrated Circuit Card (ICC) Public Key Exponent Integrated Circuit Card (ICC) Public Key Remainder EMV 9F46 M3 M3 EMV 9F47 M3 M3 EMV 9F48 M3 M3 Issuer Public Key Certificate EMV 90 M2 M2 Issuer Public Key Exponent EMV 9F32 M2 M2 Issuer Public Key Remainder EMV 92 M2 M2 A-6 July 2008 Card Personalization Validation Guide