An Expert’s Checklist to Help Ensure a Smooth Payment Terminal Card Brand Certification
Have you ever felt lost in all the rules and requirements that need to be taken into account for a terminal deployment? Emailing back and forth with card brands, trying to figure out how you should proceed with your certification project, starts to feel like a waste of time. Running test cases more than once, repeating form validation iterations, and even restarting a certification testing project because of regulatory complexity is even worse. A more effective way to manage certification projects is out there.
Payment terminals and acquiring infrastructure must go through several certifications prior to being able to accept live payments with various payment card brands. Often, the last of the seemingly endless list of certifications is the EMVCo Level 3 payment terminal card brand certification. It covers the certifications that need to be done for each payment card brand individually. Each global payment card brand named their own brand certification:
- Mastercard Terminal Integration Process (M-TIP)
- Visa Acquirer Device Validation Toolkit (ADVT) certification
- Visa Contactless Device Evaluation Toolkit (CDET) certification
- Visa PayWave Test Tool (VpTT) certification
- American Express Integrated Chip Card Specification (AEIPS) certification
- American Express Expresspay certification
- Discover, Diners Club International, and Pulse D-PAS Acquirer Terminal End-to-End certification
- Union Pay International Functional UPI Acquiring Certification (UAC)
- UPI Quickpass certification
- JCB Terminal Check for Implementation (TCI).
We can help you navigate through these certifications as effectively as possible. Take a look at UL’s Top 10 Must-Do Checklist to help ensure a smooth payment terminal card brand certification.
1. Do you even need to do a brand certification?
Even though the payment card brands can request brand certifications, generally there’s no need for a new brand certification before the deployment of additional payment terminal devices belonging to the same terminal family or if there were only minor changes in the terminal or the acquirer deployment. Check out EMV Type Approval Bulletin No. 11! Among other things, it defines what is a minor change and what is major. Check with UL’s experts or with the payment card brands directly to find out whether you actually need a new brand certification. Not needing one is the most significant time and money saver.
2. Do you have all necessary prior certifications approved?
If you’re not simply certifying a terminal, then you’re certifying an acquiring deployment: the combination of the terminal deployment and the authorization route. This means, in most cases, it’s not enough to simply have your terminal’s EMVCo Level 1 and Level 2 certifications approved. This means, in most cases, it’s not enough to simply have your terminal’s EMVCo Level 1 and Level 2 certifications approved. You would also need to consider which aspects of the Payment Card Industry (PCI) requirements may apply to your solution, which can take various aspects depending on how and what payments you are accepting.
3. Are you certifying what you intend to certify?
At this stage, dive into details. Define which payment card brands you plan to accept in deployment and when. Your acquiring infrastructure needs to be certified for every payment card brand that you want to accept live payments. You don’t have to do all brand certifications at the same time. It’s enough to do the certification before the live deployment of the brand. For example, if you intend to roll-out UPI acceptance next year, you don’t have to do Union Pay International (UPI) certification now.
It might help to visualize exactly what your acquiring infrastructure looks like.
Do you work with partner payment processors or acquirers? Do you separate credit and debit acquiring? Keep in mind that as the authorization route is also part of an acquirer deployment, it is mandatory to certify each and every authorization route that is planned to be used for live payments.
4. Are you prepared to start the certification?
A certification process is the same as running the tests; you need preparation and documentation as well. Ensure that:
- You’ve engaged with all the payment card brands that need prior engagement
- You have all approval letters ready and to ensure they’re still valid
- You have the right testing tools, and the latest versions of them
- You have your internal resources and priorities in order
5. Is your setup ready?
Now that you’re aware of what your acquiring infrastructure looks like, you need to run tests on the test setup of an acquiring infrastructure. You need to route transactions from a test terminal to an issuer host test simulator and check on the following items:
- Is everything connected?
- Is every port on every firewall configured?
- If you try an online transaction, does it arrive to the issuer host test simulator?
If the answer to these questions is no, it’s time to check if everything is connected and online. You might also consider rebooting, cycling the power, and checking if everything is plugged in.
6. Are you sure you are running the test cases properly?
UL’s Brand Test Tool (BTT) is powerful, qualified software. But it is up to you to determine if tests are run properly and that the right steps have been taken at the right time. Some testing procedures and instructions might seem confusing at first, but you can explore the test plans directory. They are accessible from BTT’s help menu. The test plan documents are issued by the payment card brands and provide you with background information on how to run the tests and why they are run. And as always, our experts are ready to advise you on an on-demand basis, with our flexible Knowledge Support arrangements.
7. Are your issues really issues, and are your nonissues really nonissues?
Some tests fail, some pass. How would you start fixing the failures? Are you sure that the failures even need to be fixed? The bugs BTT finds might just be features of your setup. Knowledge and experience are required to analyze the test case failures. Every payment card brand issues their respective rules and regulations documents, which detail the requirements and the reasonings behind them. But even knowing the rules, every terminal software and acquirer deployment is different, and every issue requires a tailor-made solution.
On the other hand, just because a test case passes does not mean that the terminal behavior is OK. A classic example of this occurs during the user validation part of terminal testing. If the test case asks to “Confirm that the transaction is declined.” but the terminal indicates “Card read error, please try again” over and over again, would you confirm a decline? If you or your test engineers ever feel stuck, do not hesitate to reach out to us, (mailto: [email protected]) because we run tests every day and might have fixed something similar already.
8. Are you collecting and submitting the right test evidence?
While running the test cases, you collect test evidence. Some is collected automatically by UL’s BTT, some you have to gather manually. This test evidence needs to be submitted for an approval service to confirm your submission. The brands and the formal approval service providers are clear about what evidence they need. Are you paying enough attention to correct the right evidence, in the right format? Formal Approval Service providers, such as UL’s MasterCard Terminal Integration Process (M-TIP) or D Payment Application Specification (D-PAS), are happy to provide you with the support you need. If you don’t submit the right type of evidence or enough of it, you risk delays or denial of your test submission.
9. How do you know when you’re really done?
You want to roll out your payment terminal solution into the market as soon as possible. But how do you know when a certification project is done? Is it when you’ve ran the last test case? Is it when you submitted your test evidence? To avoid possible penalties, you should wait until you receive the letter of approval from a brand or from a formal approval service provider and receive the acquirer’s sign-off. Only then are you ready to deploy your solution to accept live payments.
10. Is it easier to do your certification in-house or would you need expert help?
We can provide an end-to-end certification process. We can even set up a customized test center on your behalf, just for your terminal solutions. We can help shorten your certification cycles and time to market, decrease your costs, and reduce product error and compliance risks.
To learn more about UL’s payment terminal card brand certifications solution, contact us!