An association of payment providers is calling for deeper inter-industry standardisation of contactless mobile payments
Usage of mobile technologies in payments has been gathering pace over the past few years, resulting in many successful trials and launches of contactless mobile payment services in various regions of the world. While individual organisations in both sectors continue to make advances in this area, the relevant industry bodies have recognised the value of collaborating to define a standardised technical infrastructure enabling interoperable contactless mobile payment services. The future growth of contactless mobile payments technology, and its viability as a sustainable, global, mass market payment method, relies on the existence of such an infrastructure.
EMVCo, jointly owned by American Express, JCB, MasterCard and Visa, is responsible for the development of the EMV payment specifications which are the international standards for chip based transactions across the world. With over 730 million chip based payment cards deployed, EMVCo is widely recognised as an effective standards voice of the payments industry. As such, EMVCo has been working on behalf of the payments industry since 2007 to contribute toward contactless mobile payment standards in two key ways.
First, EMVCo is leading payment industry efforts to collaborate with other global industry organisations in order to synchronise technical standardisation activities for contactless mobile payments. Inter-industry cooperation is essential to avoid a fragmented approach to standardisation and the resulting limitations that this would bring. Secondly, EMVCo is tackling the technical challenges associated with enabling secure contactless payment transactions via mobile devices, by developing interoperable standards which define how mobile devices can be used in multi-brand/multi-service contactless payment scenarios. This ‘technical development' responsibility aligns with EMVCo's traditional charter to deliver payment specifications that ensure security and interoperability between ‘payment instruments' (whether plastic cards or mobile devices) and merchant terminals, including testing and type approval processes.
Naturally, strong inter-industry collaboration needs to occur in order to deliver the appropriate suite of complementary standards. Relationships have been established with various industry bodies – including GlobalPlatform, the GSM Association (GSMA) and the NFC Forum – in order to discuss, analyse and develop compatible standards. Below is a summary of how EMVCo, on behalf of the payments industry, is contributing toward the progress of standardisation efforts toward a consistent contactless mobile payments infrastructure through cross-industry collaboration with key bodies.
Inter-Industry Progress
In recent years, many organisations, including ETSI, GSMA, the Mobile Payment Forum, NFC Forum and the Open Mobile Alliance, have initiated work items related to a contactless mobile payments infrastructure. EMVCo's starting point was to map this complex technical landscape for itself and determine the synergies and gaps between technical standardisation efforts across the payment and mobile industries. The result of this initiative is a draft reference document, which provides an architectural overview and framework for the work that EMVCo is undertaking in the area of contactless mobile payments. The document – to be finalised – identifies the scope of EMVCo's technical work relative to the work of other industry bodies and is targeted for publication later this year.
Further EMVCo deliverables are best explored in the context of collaborations with other standards organisations that are themselves working to develop various aspects of an interoperable contactless mobile payment infrastructure:
EMVCo / GlobalPlatform Collaboration
One of the high priority technical standardisation issues that EMVCo is currently working to resolve is how an end user of multiple contactless mobile services, including payment services potentially from multiple payment systems and issuers, identifies the single payment application to be used for an individual contactless payment transaction via the mobile device. Selecting a plastic card from one's wallet to pay for goods or a service is straightforward enough, so how does this simplicity translate in terms of a contactless mobile payment scenario?
The payment industry solution is to enable a user interface application on the handset, known as the Application Activation User Interface (AAUI), which allows the user to activate a particular contactless mobile payment application on the device. A contactless terminal may then communicate with the active payment application to perform a payment transaction. To present the user with a choice of contactless payment applications hosted on the mobile device, the AAUI interfaces with the secure element (SE), where all contactless payment applications, and possibly other applications, are securely stored.
GlobalPlatform, the international smart card specifications body, has been working extensively on specifying the inter-industry architecture required to securely manage a multi-service/multi-application environment for secure elements (one example being the GlobalPlatform UICC configuration). Subsequently, EMVCo has been working very closely with GlobalPlatform to ensure that the GlobalPlatform defined Card Registry Service (CRS) provides the functionality required by the AAUI and the GlobalPlatform SE specifications. The result is a new GlobalPlatform specification, currently in its final draft stages, which outlines the provisioning of application selection services within a GlobalPlatform SE. Additionally, EMVCo is developing a Mobile Payment Type Approval framework that will supplement GlobalPlatform's SE compliance program with EMVCo's own testing and security requirements.
GSMA Collaboration
The scope and objectives of the GSMA organisation are not directly related to technical standards, however high level dialogue and engagement between both organisations ensures that the objectives and requirements of the mobile telecommunications community are presented to EMVCo in the contactless mobile payments specifications it undertakes. Discussions between the GSMA and EMVCo have contributed to the GSMA's publication of a first version of the GSM industry's mobile payment handset requirements and EMVCo is in the final stages of completing a similar handset requirements document centered on the payment industry's needs. EMVCo intends to solicit GSMA input and comments to avoid redundancy and ensure consistency.
EMVCo / NFC Forum Collaboration
While EMVCo and the NFC Forum are in the process of formalising collaboration efforts, the two bodies have been collaborating on an informal basis for a number of years on common technology usage. EMVCo's key aims for this relationship centre on the development of consistent specifications and testing and approval processes for payment instruments – whether plastic cards or mobile devices – and compliance with EMVCo's Common Contactless Communications Protocol Specification. As such, the EMVCo Contactless Mobile Payment Type Approval framework under development will apply to mobile devices incorporating NFC technology. The objective of such collaboration is to ensure that contactless payment services, delivered through mobile devices, will interact seamlessly with the existing payment terminals and card acceptance infrastructure.
Inviting Further Mobile Industry Participation
Further to these industry-level collaborations with the mobile community, EMVCo is now seeking to engage the mobile industry in its technical specification efforts. The launch of an EMVCo subscriber programme and annual EMV User Meeting in 2009 aims to encourage regular dialogue between EMVCo and the users of its specifications from the mobile, payments and retail industries, in order that the ongoing standardisation work of the organisation reflects evolving market requirements.
The EMVCo subscription programme, delivered through the EMVCo website, allows interested parties to access advance information regarding revisions to EMV Specifications, draft documents and upcoming meetings.
Subscribers will also be able to make direct contact with EMVCo to solicit feedback or guidance in respect of technical issues. EMVCo has introduced this subscription programme at a nominal fee of $750 USD per user, in recognition that many parties such as mobile operators, chip and handset manufacturers and application providers can benefit from providing input into the development of the EMV Specifications for mobile contactless payments.
As an adjunct to the subscription programme, EMVCo has also launched an annual EMV User Meeting which is open to all subscribers. The first EMV User Meeting will take place on 30 June – 1 July 2009 at the Sheraton Arabellapark in Munich.