Transaction Security Mastercard CPV Customer Guide June 2017 v1.1
UL Transaction Security UL Transaction Security stands for one or more of the following entities: UL TS B.V. (Leiden, Netherlands), UL VS Ltd (Basingstoke, UK), UL Transaction Security Pty Ltd (Melbourne, Australia), UL Transaction Security Ltd (Edinburgh, UK), UL TS Pte Ltd (Singapore), UL TS Inc (St. Paul, MN, USA), UL TS FZE (Dubai, UAE) For contact details, please see: www.ul-ts.com 2017 UL All rights reserved. May not be copied or distributed without permission.
Table of Contents 1 INTRODUCTION... 4 2 THE CPV PROCESS... 5 3 SAMPLE SUBMISSION CPV SERVICE... 6 3.1 Process steps... 6 3.2 Available CPV Sample Submission Services... 8 3.3 Additional iterations... 8 3.4 Pricing structure for Sample Submission CPV... 9 4 CHANGE NOTIFICATION SUBMISSION... 10 4.1 Process steps... 10 4.2 Pricing structure for Change Notification Submission... 11 5 HIGH PRIORITY CPV FORMAL APPROVAL SERVICES... 12 6 CPV SUPPORT... 13 A.1 LOCAL OFFICES FOR CPV... 14 Final 3/14 June 2017 v1.1
1 Introduction A good preparation is essential for a successful Mastercard Formal Approval step. UL Transaction Security (UL TS) can be your partner throughout the full process: from definition, via vendor selection and technical consultancy to testing and certification. UL TS also can deliver the required test tools for Mastercard card issuing and provide training courses. The Mastercard Formal Approval Services is one of services UL TS offers to Acquirers and Issuers. Mastercard imposes issuers introducing a new EMV contact or contactless cardholder devices (any form factors, including mobile implementation) to go through Card Personalization Validation (CPV) Formal Approval Services of Mastercard. This process is required for issuers to obtain an approval, i.e. CPV or CNS Report, indicating that the card or device is Mastercard approved. The main purpose is to make sure the card products carrying Mastercard brands meet the minimum quality and interoperability requirements specified by Mastercard. UL has been accredited by Mastercard as a Mastercard Formal Approval Service Provider. Together with Mastercard qualified testing/certification tools, UL is offering a modulated service which covers the entire scope to ensure an efficient and effective approval process. This Customer Guide describes the process and the steps to complete a CPV. The pricing structure of the service can be found in the CPV UL Order Form. Please contact ul.ts.cpv@ul.com or your sales contact at UL for the latest version of the order form. Key Benefits of UL The extensive experience and in-depth knowledge of 20 years in the area of chip / payment technology and personalization processes allow. UL TS to support you through the entire Formal Approval Process, not only by performing the CPV Service, but also through on-site services, card profile definition, assistance during I-ETED Self-Service, support via telephone and e-mail. This increases the quality of your product and reduces the time spent for validation, bringing your product faster on the market. Covering the complete process and procedures, we can offer you one-stop shopping to implement your new card product or mobile device, payment terminal or ATM successfully. Status: Final 4/14 Version: June 2017 v1.1
2 The CPV process As described in the Mastercard document Card Personalization Validation (in the following CPV Guide ), the Card Personalization Validation (CPV) process starts with Issuer Preliminary Assessment, when you decide what type of service you want to be delivered by UL: either Sample Submission, where you submit samples for testing, or Change Notification Submission (CNS), where you submit a profile change for assessment. When to do a CNS? The Change Notification Submission process enables issuers to provide UL with a list of changes they intend to apply to an existing product and to request an assessment of these changes in order to allow issuing. The CPV Guide issued by Mastercard explains in which cases a CNS is allowed. The Appendix of that document describes the impact of changes to each data package (a group of elements or tags that are functionally related and have similar CPV validation requirements). For example, adding a BIN to the BIN range, changing the chip product, or changing the values of certain data elements could be consider a minor change and therefore accepted via the CNS process. In case the proposed change is considered major, a Sample Submission is required. See Chapter 4 for more information on the steps to take for the CNS process. When to do a Sample Submission? In those cases when a CNS is not applicable, a Sample Submission process is required. For example, changing personalization bureaus, switching from contact to a dual interface chip products, altering certain data elements in the personalization profile could be considered a major change. Issuance of a completely new card profile also requires Sample Submission. See Chapter 3 for more information on the steps to take for the CPV process. Status: Final 5/14 Version: June 2017 v1.1
3 Sample Submission CPV Service 3.1 Process steps In case your card, mobile product or any other EMV form factor has never been approved before during CPV, or the change to an existing approved product does not meet the requirements for Change Notification Submission (see chapter 4), you have to initiate the Sample Submission process. During this process, you personalize a card sample, wearable or a secure element within the mobile device and submit it to UL who tests it for conformance with the appropriate personalization specifications. UL will guide you through the process and inform you about the status of the CPV submission regularly. You will receive a CPV Report as a formal record of the result of the CPV Test, whether successful or not. The CPV Sample Submission CPV Service consists of five steps, as depicted in Figure 1. Figure 1 Steps of the CPV Sample Submission Service. The steps indicated in red are to be taken by the customer, the blue steps are done by UL. Each single step of Figure 1 will be explained in more details on the following pages. Status: Final 6/14 Version: June 2017 v1.1
Step 1: Submission of SSF or MCA form Step 2: Paper Review (optional) Please complete the SSF/MCA form and send the document to UL via email ul.ts.cpv@ul.com. This form you can download the CPV Sample Submission Form (SSF) or M/Chip Advance Profile Generator (MCA) from Mastercard Connect, or request the latest version via UL. In the SSF form you may indicate whether you want to have the profile as completed in the SSF reviewed by UL (not available in MCA). This service is called Paper Review, see Step 2 for more details. As part of Sample Submission, you can opt for the Paper Review. Paper Review is validation of personalization data provided in the Sample Submission Form, prior to validation of the actual card samples. This will help you to find deviations from the appropriate Mastercard specifications in an early stage of your personalization process, i.e. before the cardholder device is personalized. You can order Paper Review by ticking the checkbox in the SSF form and by indicating this in the UL order form. The SSF form has to be completed for each application supported by the final product. Note for mobile and M/Chip Advance products, Paper Review is not offered due to the nature of the profile definition process with Mastercard. Step 3: Submission of Card Image / Sample Step 4: Validation of Card Sample After the settings of the profile are defined (and, if chosen, validated by an optional Paper Review), you can start the personalization of the physical card sample or secure element within the mobile device. To proceed with the CPV service, please submit the card sample to UL for validation. This is a mandatory step for the CPV service. For efficiency purposes we recommend you to send us your test samples directly to the local address as specified in the CPV order form for your region. If you expect a delay in shipment of the physical sample, you may send an image in XML format first. You can extract the XML card image from the sample by using a Qualified CPV Test Tool, e.g. UL Personalization Validation Tool and submit it to ul.ts.cpv@ul.com. Note in case of a mobile device Mastercard allows for sending only the XML image(s) of the test sample instead of the mobile device itself. Upon receipt of the card sample or XML image, UL CPV Team will send you a confirmation email. UL CPV Team will start the validation of the card sample or XML image for conformance with the appropriate personalization specifications. Status: Final 7/14 Version: June 2017 v1.1
During the validation, UL CPV Team will keep you informed about the progress and current status of your submission. Step 5: Delivery of final CPV Report Upon successful outcome of card sample validation, a CPV Report will be generated and sent for signature to Mastercard. You will receive the final CPV Report signed by Mastercard from UL. In case of any issues found in the validated profile, UL CPV Team will send you a CPV Report, indicating the applicable errors and warnings. This enables you to update the profile settings of your card or mobile device and submit it to UL for the next iteration, as described in section 3.3. 3.2 Available CPV Sample Submission Services Within the CPV Sample Submission Formal Approval Services, several flavours of the services are available: CPV Sample Submission for Standard Profile A CPV based on a Standard Profile (as defined in the most recent Mastercard M/Chip Card Personalization Data Standard Profiles document). SSF technical review of the personalization data in the Sample Submission Form for Standard Profile is not having an added value, since the values of the data elements have been defined by Mastercard and any deviation to the values defined makes the profile Non-Standard. CPV Sample Submission for Non-Standard Profile A regular CPV Sample Submission not based on a Standard Profile as defined by Mastercard. Non-Standard Profile applies for both M/Chip Advance and none M/Chip Advance products. SSF Paper Review for Non-Standard Profile As part of Sample Submission, you can opt for the Personalization Setting Review. This option allows you to validate your personalization profile/parameters on paper before personalizing a Sample. CPV Sample Submission for Non-Standard Profile, including pre-validation support During pre-validation support Technical team will provide you technical support with initiation of the project or chosen profile. Additional support can be ordered separately if required. CPV for Mobile CPV Sample Submission for NFC-enabled mobile phones. Additional technical support Technical support during and after initiation of the project. Our technical team will guide you through the CPV or CNS process and will help you to analyse issues and find best possible solutions.note that for mobile, and M/Chip Advance products, a paper review is not offered due to the nature of the profile definition process with Mastercard. 3.3 Additional iterations Via the CPV Formal Approval Service, UL determines if your product has met the requirements of the CPV service, which includes the specifications of Mastercard. Failure of any tests included Status: Final 8/14 Version: June 2017 v1.1
in the CPV requires a new iteration. In case the first (or any later) iteration of a CPV Formal Approval is not successful, you need to go through an additional iteration of the CPV by updating your personalization settings as indicated in the CPV Report and sending a new card sample or mobile device (or image of the mobile device profiles). UL will inform you of the need for a new iteration prior to starting it. Additional iterations will be invoiced according to the UL CPV order form. 3.4 Pricing structure for Sample Submission CPV The pricing structure for CPV services is as follows. A Sample submission fee is composed of (at least) two things, i.e.: Base fee, which is applicable to all CPV Sample Submission services (not for Change Notification services). Profile fee. This fee is charged per profile/application per iteration per interface. For mobile the fee also applies per mode of operation of the application (payment mode or management mode, when supported). To give some examples: Type of device Sticker or Single interface card Single interface card Application(s) via contact interface Application(s) contactless interface via - 1. Contactless Magstripe 1 1. Maestro 2. PLA/CAP standalone - 2 Dual interface card 1. Mastercard 1. Mastercard Contactless 2 Dual interface card Mobile phone - Mobile phone - 1. Maestro 2. PLA/CAP standalone 1. Maestro Contactless 3 1. Contactless Magstripe via Payment mode (in case management mode is not supported) 1. Mastercard Contactless (M/Chip) via Management mode 2. Mastercard Contactless (M/Chip) via Payment mode Profile(s) per iteration The fees for CPV services are given in the latest Order Form document. Please contact our sales representative or send an email to ul.ts.cpv@ul.com. 1 2 Status: Final 9/14 Version: June 2017 v1.1
4 Change Notification Submission 4.1 Process steps If you as an issuer/perso bureau/msp are deriving your changes from an existing CPV-approved card product, you can select to do a Change Notification Submission. Note that the changes you are making must be Minor. The criteria to be met for changes to be considered as minor can be found in the most recent version of the Mastercard CPV Guide. This Change Notification Submission (CNS) process consists of the following major steps, see Figure 2: Figure 2 Change Notification Submission (CNS) process steps. The step indicated in red is to be taken by the customer, the blue steps are done by UL. Step 1: Submission Change Notification Form To initiate a Change Notification Submission (CNS) service, please complete a CNS Form and send it to UL via email ul.ts.cpv@ul.com together with all supporting evidence as defined in the CNS form and UL order form. A CNS Form can be downloaded from Mastercard Connect website or requested via UL. The criteria to be met for a CNS can be found in the most recent version of the Mastercard CPV Guide. Note: there is no need to send a physical card sample during a CNS. However, in some cases an xml card image will be requested. Status: Final 10/14 Version: June 2017 v1.1
Step 2: Analysis of requested Change Step 3: Delivery of final Decision Step 4: Notification to Mastercard The CPV Technical Team will start analysis of the requested change for conformance with the appropriate specifications and (local) rules of Mastercard. During the analysis, the Technical Team will keep you informed about the status of the service. If more information is required to perform the analysis, you will be requested to provide this missing information. In case the requested change conforms the rules and specifications of Mastercard, the Technical Team will inform you about the successful outcome of the CNS and provide you with the formal CNS report. In case the requested change does not conform the rules and specifications of Mastercard, the Technical Team will inform you that the CNS is not accepted and provide the details in the CNS report. In that case, you can either send a new CNS request or initiate a Sample Submission CPV service as defined in section 3. UL will communicate the requested change to Mastercard together with the final decision. 4.2 Pricing structure for Change Notification Submission The pricing fee for CPV Change Notification Submission services is given in the latest Order Form document. Please contact our sales representative or send an email to ul.ts.cpv@ul.com. Status: Final 11/14 Version: June 2017 v1.1
5 High priority CPV Formal Approval Services In certain cases, you may prefer the CPV Formal Approval Service to be delivered with high priority. High priority means that the service is delivered in a guaranteed shorter time frame compared to the standard maximum delivery time. This duration represents the time UL spends to deliver the service; possible time required for Mastercard support is excluded. Please note that Mastercard has 48 business hours to respond to UL on each support request regarding the CPV service. In case only an additional iteration of the service is ordered as high-priority, only the fee for the additional iteration will be charged as high priority. For CNS and Mobile CPV, high priority service is not offered. Please contact your UL contact person for more information about the high priority CPV. Status: Final 12/14 Version: June 2017 v1.1
6 CPV Support During or prior to the CPV/CNS service, you might want to have access to the latest chip expertise, e.g. to find out about the applicable regional rules and mandates, or about allowed settings in the profile for your chip product. In addition, you might seek for the details on why certain warnings or error appear in the CPV Report issued for your product. We are happy to provide you with our support for all technical questions related to your product certification. For more details on the pricing, please refer to the field Customer Support upon initiation of or during service in the Order Form document and your regional sales representative. Status: Final 13/14 Version: June 2017 v1.1
A.1 Local offices for CPV For Europe, Middle East and Africa: UL, Transaction Security division Attn: Mastercard FAS Department De Heyderweg 2 2314 XZ LEIDEN The Netherlands For North America and Canada: UL VS Inc, Transaction Security division Attn: Mastercard FAS Department 1945 The Exchange, Suite 200 Atlanta, GA 30339-2029 United States of America For Asia and Pacific region: UL, Transaction Security division Attn: Mastercard FAS Department 1 Fusionopolis Walk #10-01 Solaris South Tower Singapore 138628 Singapore For Latin America and Caribbean: UL, Transaction Security division Attn: Mastercard FAS Department Av. Engenheiro Luis Carlos Berrini, 105, 24º Andar Brooklin, 04571-010 São Paulo - SP Brasil Status: Final 14/14 Version: June 2017 v1.1