The Age of Migration Payment Switches behind the Transactions

Transcription

1 WHITEPAPER The Age of Migration Payment Switches behind the Transactions sqs.com Authors: Poorna Tata (Test Manager) Senthil Nathan (Test Lead) Libin G (Business Analyst) Sarojini Vetrivel (Business Analyst) SQS India BFSI Limited Published: August 2015 SQS the world s leading specialist in software quality

2 The Age of Migration Payment Switches behind the Transactions 2 POORNA TATA Test Manager poorna.t@thinksoftglobal.com Poorna Tata is a graduate in Electronics & Communication Engineering and has been with SQS since As a Test Manager in the Cards practice, her core competencies include project management and strategy development for testing, consulting and pre-sales support. Having worked with global clients across multiple regions, she is involved in various large banking, cards and payments programmes. Her current activities include Account and Test Management predominantly in the Middle East and Asia regions. SENTHIL NATHAN Test Lead senthil.nathan@sqs.com Senthil Nathan holds a master s degree in Business Administration and has been associated with SQS since Currently a Test Lead with experience in handling projects for major clients such as Lloyds (UK), NPCI (India), First Data (Australia), American Express (Middle East), Tsys (US) and many more, his core competencies include expertise in the Cards and Payments domain, team management and practicelevel pre-sales activities.

3 The Age of Migration Payment Switches behind the Transactions 3 LIBIN G Business Analyst libin.g@sqs.com Libin G holds a master s degree in Bio-Technology and has been with SQS since Currently a Business Analyst in the Cards practice, her core competencies include understanding and documentation of business requirements, and strategy development & testing of simulatorbased magnetic strip, EMV and CHIP contactless authorisations for credit and debit cards across schemes. SAROJINI VETRIVEL Business Analyst sarojini.v@thinksoftglobal.com Sarojini Vetrivel a Six Sigma Green Belt certified professional and holder of a post-graduate degree in Management of Finance, has been with SQS since Currently a Business Analyst in the Payments practice managing a certification testing project for NPCI, a leading client in payments, her core competencies include test management and business analysis.

4 The Age of Migration Payment Switches behind the Transactions 4 Contents Management summary...5 Introduction....5 What does a Payment Switch do?...5 Market current status and outlook...7 Key triggers for switch migration...9 Evaluating switch upgrade/migration Conclusion & outlook...15 References...16

5 The Age of Migration Payment Switches behind the Transactions 5 Management summary The global payments landscape has undergone a huge transformation in recent years with the growing demands of today s payment market for instant payments and technology improvements. In 2012, payment cards accounted for 60.9 % of total non-cash transactions conducted globally, up from 58.4 % in 2011 [1]. Purchase transactions are expected to grow to a total of 469 billion in 2023 across the globe, from 187 billion transactions in 2013, with the US accounting for 43.7 % of the market. The increase in payment card transactions highlights the significance of payment switches which form the backbone of transaction processing behind the scenes. Payment card transactions are completed in under a second within a switch system. MasterCard, for example, processes transactions in milliseconds [2] which brings into sharp focus the importance of and the need for highly efficient and robust payment switches behind the scenes. Introduction Many of us in today s world use a card to make a transaction, and are aware that the transaction is completed in seconds. Ever paused to wonder what happens behind the scenes? A payment transaction goes through a carefully orchestrated process. When an account holder uses a card to buy a pair of shoes for example, the acquirer, the merchant s bank, reimburses the merchant for the shoes. The issuer, the account holder s bank, then reimburses the acquirer and the last step, the issuer collects the funds from the account holder. Cardholder uses POS terminal at Merchant store Acquirer Interchange scheme Issuer Interchange scheme Acquirer Merchant What does a Payment Switch do? The payment switch is a highly critical component at the heart of transaction processing, and processes almost 75 % of the volume of customer transactions. The payment switch routes and processes all payments in real time between the point of customer interaction, which includes ATM and POS, and the bank s processing system. Payment switches, being the backbone of transaction processing, assume substantial significance as the payment industry is undergoing a massive transformation. For the banking and payment technologies leader FIS, switches enable $ 1 B in its annual revenue, which is almost 20 % of its total annual revenue [3]. A typical switch architecture with high level functions/ modules is shown in Figure 1.

6 The Age of Migration Payment Switches behind the Transactions 6 Acquirer bank 1 Terminal driving HSMs ATMs ATM controller CH TH PoS PoS server CH TH Security module Key management Schemes Mobile banking ecomm Server Server CH CH TH TH Transaction manager Parser/ formatter CH CH CH MasterCard VISA Other schemes Online banking Server CH TH System routing System logging Acquirer bank 2 ATM PoS Device monitoring and alerts Card processing Application interface Remote host module Bilateral or pass-through arrangements Mobile banking Fraud monitoring and alerts Clearing and Settlement Host Acquirer bank n ATM PoS Data warehouse System administration Switch logs Financial Checks CAF/PBF Application Interface Core bank system Credit card host Debit card mgmt. Mobile banking Branch Transaction Switching Typical Architecture Figure 1: The payment switch: heart of the payment transaction processing In a nutshell, a typical transaction passes through at least one or more switching platforms from acquirer switch to card scheme network switch & issuer switch before approval and back. As the transaction is completed within second(s), the switching platforms in turn are expected to process each of these transactions in milliseconds. To put things into perspective, VisaNet for example processes around 30,000 transactions per second. The capability, reliability & efficiency of the payment switch is the key to shaping and delivering customer expectations. Cardholder uses POS terminal at Merchant store Acquirer Switch Interchange scheme switch Issuer switch Interchange scheme Switch Acquirer Switch Merchant While certain card management applications have inbuilt switching modules (e.g., ONLINE module in TSYS PRIME, WAY 4 Switch in OpenWay Tieto and HPS PowerCard) capable of processing and routing authorisation transactions to multiple destinations and driving the terminals, there are also numerous standalone switch applications. Most financial institutions deploy such standalone switches given the requirements related to handling volumes, scalability and availability.

7 The Age of Migration Payment Switches behind the Transactions 7 Market current status and outlook The average consumer s banking relationship is dominated by making payments. Digital payments in developed markets are growing rapidly and a strong payments offering is therefore imperative for banks. Banks must evolve and transform to deliver these innovative payment options where the distinction between channels and devices is blurring, with interactions over the Internet, mobile and physical systems converging into a common set of digital services. Some of the key trends impacting the business strategy of financial institutions are listed in Figure 2. Digital Banking Security Risks Industry Trends Challenges Enhancing Customer Experience Regulatory Compliance Figure 2: The forces shaping today s payment Transforming to a digital business Digital services like mobile wallets have changed the face of traditional banking and allow customers to manage their funds online with a click of a button. The number of active mobile wallet users is projected to increase from 0.5 million in 2012 to 42 million in 2017 [4]. Another trend catching up very quickly is mobile payments which has become increasingly competitive, with both banks and non-banks striving for market dominance. Spending in the U.S. mobile payment market is expected to reach $ 90 billion in 2017, from $ 12.8 billion in 2012 [5]. Enhancing the customer experience With transaction volumes increasing, enhancing the customer experience by becoming more responsive and transparent in transaction processing is a pressing need for the financial institutions. The latest technology initiatives, such as biometrics payments on Apple devices, are just the start for the addition of biometric data as part of an identity verification process to ensure that security is optimised for today s consumer. Authorisation response time reduction has been a priority for various card networks. Regulatory requirements Key regulatory initiatives combined with industry growth-aligned actions have helped secure the transformation across the payment industry. The emergence of fraud prevention techniques to combat security risks With the growth in digital payments worldwide, fraud prevention techniques across new technologies are also evolving to keep up with the digital age. Security features such as voice recognition for users, as well as finger vein biometric scanners for payments via social media, are fast catching up as security measures for consumers.

8 The Age of Migration Payment Switches behind the Transactions 8 The touch point for all payments initiated by the customer directly or indirectly is the involvement of the payment switch for the bank or service providers and networks. Payment offerings are defined by the capability of the payment switch in terms of handling volumes, performance, and integration with new channels. With regard to the payment switches currently in place for the financial institutions, most of these were implemented decades ago and some are over 30 years old! The unprecedented growth in the payment industry is now demanding increased efficiency, flexibility and scalability from the switch. The effort and capital required to maintain old legacy switches is high, and in most cases, old switches are not able to adapt and deliver in terms of the new payment technologies. This has triggered the need for a newer, efficient switch and forced many players in the market to look at their business needs and evaluate switch migration/upgrade as the next step. The omnichannel banking environment has led banks and payment providers to focus increasingly on payments transformation, which calls for a significant investment in the payments infrastructure, including payment switch platforms. With the increased interest in payment transformation and the need for flexible, configurable and scalable switching applications, the market place is witnessing stiff competition amongst vendors. FIS s acquisition of Clear2Pay, ACI s acquisition of S1 & Distra and ATM vendor NCR s acquisition of Alaric point to increasing competition & consolidation in the switching market place. A list of switching application vendors and their respective applications is given in Table 1. Switch application vendor Switching application ACI Worldwide BASE24, BASE24-eps S1 Payments platform Postilion (acquired in 2012) Distra Switch (acquired in 2012) FIS Connex IST Cortex Clear2Pay OCS (acquired in 2014) BPC SmartVista Compass Plus TranzWare ElectraCard Services electraswitch (acquired by MasterCard ) Euronet ITM NCR Alaric (acquired in 2013) Wincor Nixdorf ProClassic/Enterprise Table 1: Switching application vendors and their applications

9 The Age of Migration Payment Switches behind the Transactions 9 Key triggers for switch migration Industry triggers coupled with the limitations of the legacy switch have acted as a catalyst for switch upgrade. Some of the key triggers for switch migration faced by the financial institutions have been summarised below. Phase-out of old switches Legacy switches are becoming very costly in terms of maintenance and scheme compliance upgrades, forcing them to be withdrawn. The older switching applications also had limitations with regard to the functionality that could be supported, be it devices such as POS, ATM or technologies like EMV. One such example is the decline of the BASE-24 platform and the launch of the next version BASE-24 eps, which has led many players to re-evaluate their switching requirements and look at the current generation of payment switches. Cost effectiveness: latest switches vs legacy switches The new payment switches built based on new technology and trends are more cost effective and give better performance outputs than the existing legacy switches which are bulky and based on old technology. Increased transaction volumes & emerging payment trends: new payment types introduced New payment types like faster payments, direct debits & credits, cross-border transfers, micropayments, home payments, prepaid cards and services such as Google Checkout, Amazon Payments, and M-PESA have been growing at a rapid pace in recent years. With the advent and convergence of these transactions with new channels such as the Internet, Mobile and NFC Contactless at Point of Sale, the need for smarter and more efficient payment systems has become a necessity for the volumes being handled (cf. Figure 3) Cards 40 % Direct Debit 12 % Cheques 30 % Credit Transfer 18 % Cards 52 % Direct Debit 14 % Cheques 16 % Credit Transfer 18 % Cards 62 % Direct Debit 13 % Credit Transfer 17 % Cheques 8 % Non-cash transactions: bn Non-cash transactions: bn Non-cash transactions: bn Figure 3: Transaction volume predictions

10 The Age of Migration Payment Switches behind the Transactions 10 Technology: migration from magnetic stripe to chip (EMV) technology The industry has been geared towards EMV (chip) technology over the last decade and cards issued with chip data capable of processing EMV transactions have been implemented across countries. This requires all the players in the payment space to be EMV-compliant, having payment switches capable of handling EMV. Cardholders travelling from a non-emv-enabled country to an EMVenabled country are finding it increasingly difficult to use their cards securely, which has forced many a player to re-evaluate their offerings with regard to EMV in the US. Compliance regulations The milestones imposed by payment brands American Express, Discover, MasterCard and Visa are also a trigger to expedite and implement compliance-related enhancements. For example, though the US has delayed EMV migration so far, currently one of the biggest triggers for all issuers and acquirers to become EMV-compliant is emanating from the card schemes in the guise of a regulatory enforcement which is acting as a catalyst for EMV-compliant switches. Emerging new domestic switches The growing payments market has opened up the need for domestic payment systems that provide innovative solutions along with a reduction in cost. The emergence of new domestic players like NPCI with RuPay in India, and Union Pay in China, has generated the need for new payment switches with new requirements whilst ensuring all players are compliant with the new requirements. Increased focus on fraud detection Acquirers, issuers and merchants lost $ billion due to fraud in 2012 according to the Nilson Report of August 2013 [6]. The newer payment switches being built are better integrated with fraud prevention applications, offering enhanced security features to cardholders. Business needs Simplification, mergers, acquisitions and reshaping/re-alignment of businesses and business models for expansion is also a trigger for switch upgrades. Switching for ATM and PoS Case of India Banks have adopted different models for switch operations. Most banks, especially larger ones, have implemented their own switch for processing transactions. Own switch implementations are capital-intensive with an average implementation cost ~INR 5 15Cr for small and mid-sized banks. Implementation requires a longer timeframe (18-24 months) than outsourcing (6-12 months). Banks which do not have their own switch, or are planning to acquire a new switch because of the decline of BASE24, or are moving from an outsourced switch to an owned switch, could consider a cloud-based common switch for banks... The cost for a central switch will be ~INR Cr and this will eliminate the need for multiple switches to be maintained by individual banks. Source: Report of the Key Advisory Group on the Payment Systems in India [7]

11 The Age of Migration Payment Switches behind the Transactions 11 Evaluating switch upgrade/migration The decision to go for a switch migration/upgrade is a business centric one, and many factors are evaluated to arrive at this decision. Evaluation of switch migration/upgrade Figure 4 defines a framework for understanding the different choices customers have for application modernisation. Fundamentally, customers have four choices when considering switch modernisation, depending on the ability of the switch to meet current and future business needs, its ability to offer a business differential, and the total cost of ownership of the switch. Once the decision is taken to go ahead with switch migration, as with any critical project, conducting a robust planning phase is key to the success of the project. A typical migration project can span around months depending on the setup of the current switch - number of interfaces, hosts, schemes, application and device certification requirements, card technologies, etc. The challenge As most of the customer s banking interactions are conducted through the switch, business continuity is the watch word for these migration projects. Typically, a switch is connected to multiple point of sale devices, multiple ATMs, multiple servers handling e-commerce, Internet banking traffic, etc., along with the communication to the network(s). It is imperative that there are no disruptions to the switch functions which affect transaction management. In order to effectively plan a switch migration Commodity High Switch Features Switch Upgrade Switch Migration Switch Migration Do nothing Cost Pressures Business differential No Switch meets business needs? Yes Low Figure 4: Switch migration strategy

12 The Age of Migration Payment Switches behind the Transactions 12 Phased new switch hardware installation HSM equipment and other hardware devices installation Phased new switch software installation move components to new environment by functional area Network links, hosts/authorisations, ATMS, device monitoring software Establish a bridge between new switch and existing legacy switch Decomission the old switch Figure 5: Phased approach for switch migration involving multiple interfaces, a phased approach is suggested. Figure 5 defines the phased approach that can be followed for a typical switch migration with minimal impact on existing business. Transaction coverage-based testing Accepting payment transactions from incoming channels and authorising, validating and ensuring delivery of the transactions is the key to ensuring that the switch is working as expected. It is often challenging to ensure testing coverage during switch migration associated with a complexity of multiples, but the key is to arrive at an optimum scope covering all transaction combinations along with a risk analysis: Device Models ATMs, PoS, etc Transaction sources channels, schemes Transaction destinations & associated routing schemes, another switch instance, core banking systems Application, message and transmission protocols Validation of cryptographic data in message for EMV Bilateral and multi-lateral routing arrangements Considerations for switch configuration: active active, active passive, etc. Apart from the issues listed above, other typical challenges faced, along with an action plan that can be adopted to mitigate such challenges, are listed in Table 2. Card technologies chip, magnetic stripe, contactless, etc.

13 The Age of Migration Payment Switches behind the Transactions 13 Challenges Change in switch architecture leading to risk in integrating source and destination legacy applications Project risk due to inexperience in switch migration Impact on the existing switching functionality Business continuity as the existing function should work in parallel with the additional functionalities offered by the new switch Adherence to timelines for project completion Cost Resource planning and training Testing to eliminate risks Action Plan Test the functionalities on a module by module basis and follow phased manner testing approach Outsource the testing activities to specialists to ensure smooth migration Baseline of the existing functionalities will help in benchmarking the results to compare/validate and ensure no impact on the migrated switch Production-like test environment to be used for testing Robust test planning/strategy, monitoring & control Outsource the testing activities to specialists Assess feasibility for automation and employ appropriate techniques to check the cost Estimate the number of resources required for migration Evaluate the resources with the required skill sets Plan the level of training based on the above evaluation Advanced training to business users to handle day to day operations post-migration Apply a risk-based strategy for testing to ensure that all critical functionalities and customer touch points are working as expected. Plan for an end-to-end simulation in a pre-production test environment to evaluate and validate performance without affecting and disrupting live switch operation. Table 2: Mitigation of typical challenges In switch migration projects, the role of testing, if correctly deployed, can be effectively used as a risk mitigation tool. Higher quality testing employing risk analysis during migration reduces the cost of maintenance in a live environment, ensuring fewer transaction failures and directly translating to a better customer experience.

14 The Age of Migration Payment Switches behind the Transactions 14 Ensuring correct testing by testing correctly To reap maximum benefits, starting the test process in the initial stages of SDLC plays a very important role in ensuring that business needs are met within the timelines. Along with functional and performance testing, certification is also very important for switch migration (cf. Figure 6). Functional acceptance testing Switching & routing Transaction flows online & STIP Clearing & settlement Reconciliation Interfacing Certification testing Issuers & acquirers platforms Switch Performance testing Benchmark Load, stress, volume Endurance Batch performance Figure 6: Test planning types to be considered typically for Switch upgrade Live Example Over the years, SQS has gained rich experience in testing various payment switch products in the market, such as ACI s Postilion and Base 24- eps, and FIS Global products such as Connex and IST, thereby helping our clients to test out the functionalities of proposed switching solutions and perform certification testing with international and domestic card schemes. The SQS team has helped financial institutions with performance testing of switching applications including ONLINE and IST for various clients. One of the leading banks in the Middle East migrated its switching solution to Base-24 eps, as ACI discontinued product support for the bank s legacy solution Base 24. The bank was also under the pressure to implement EMV whilst migrating its switching solution. This also imposed the need for certification testing from the schemes for both physical ATM devices and the implemented Base 24 solution. In addition, the timelines were very stringent. Despite the challenging timelines, SQS tested the functionalities of the proposed implementation, covering 2 international schemes and 1 domestic scheme alongside EMV scheme certification testing, with zero defect leakage. SQS provided the bank with a differentiated experience by ensuring quality testing services leading to a smooth transition.

15 The Age of Migration Payment Switches behind the Transactions 15 Conclusion & outlook The global payments landscape has undergone a huge transformation to digital payments in recent years. In order to stay competitive, businesses need to keep up with market trends and ensure that the customer experience is not compromised The Payment switch holds the key to the customer experience as all customer transactions with the bank are routed and processed through the switch in seconds. The efficiency, performance, stability and scalability of the switch defines the customer experience Most legacy switches were implemented decades ago (some are more than 30 years old!) and with the growth in the payment industry, these switches are now unable to cater to current business needs and volumes With the decline of legacy switches and the growth of fast-changing market dynamics and new alternative payment methods, most organisations are looking at switch migration/upgrade in order to sustain business Switch migration is a very critical task, and ensuring business continuity with no glitch in the consumer experience is the driving factor. Robust planning aligned to the phase-wise migration plan is key to the success of the migration project. A correctly implemented test phase that ensures test coverage based on risk analysis can be an effective risk mitigation tool. In the face of ever-evolving market trends, payment switches are also evolving and learning from the limitations of legacy switches. Businesses will need to continuously evaluate their service offerings and develop new strategies, understand limitations and explore what their switches can offer. This is a continuous cycle and in this payment age, switch migrations and upgrades are inevitable and essential to keep up with the industry.

16 The Age of Migration Payment Switches behind the Transactions 16 References [1] Capgemini, RBS (2014). World Payments Report [2] MasterCard. Bringing More Value to Every Transaction. [3] [4] Berg Insight (2013). Mobile Wallet Services. [5] Forrester Research (2013). US Mobile Payments Forecast, 2013 To [6] [7] Government of India, Ministry of Finance, Department of Financial Services (2012). Report of the Key Advisory Group on the Payment Systems in India. SQS Software Quality Systems AG, Cologne All rights, in particular the rights to distribution, duplication, translation, reprint and reproduction by photomechanical or similar means, by photocopy, microfilm or other electronic processes, as well as the storage in data processing systems, even in the form of extracts, are reserved to SQS Software Quality Systems AG. Irrespective of the care taken in preparing the text, graphics and programming sequences, no responsibility is taken for the correctness of the information in this publication. All liability of the contributors, the editors, the editorial office or the publisher for any possible inaccuracies and their consequences is expressly excluded. The common names, trade names, goods descriptions etc. mentioned in this publication may be registered brands or trademarks, even if this is not specifically stated, and as such may be subject to statutory provisions. SQS Software Quality Systems AG Phone: Fax: