Card Personalization Validation Guide - PayPass

Card PersonalizationValidation

10 July 2014

NoticesFollowing are policies pertaining to proprietary rights, trademarks, translations, and details aboutthe availability of additional information online.

Proprietary Rights

The information contained in this document is proprietary and confidential to MasterCard InternationalIncorporated, one or more of its affiliated entities (collectively “MasterCard”), or both.

This material may not be duplicated, published, or disclosed, in whole or in part, without the priorwritten permission of MasterCard.

Trademarks

Trademark notices and symbols used in this document reflect the registration status of MasterCardtrademarks in the United States. Please consult with the Customer Operations Services team or theMasterCard Law Department for the registration status of particular product, program, or service namesoutside the United States.

All third-party product and service names are trademarks or registered trademarks of their respectiveowners.

Disclaimer

MasterCard makes no representations or warranties of any kind, express or implied, with respect tothe contents of this document. Without limitation, MasterCard specifically disclaims all representationsand warranties with respect to this document and any intellectual property rights subsisting therein orany part thereof, including but not limited to any and all implied warranties of title, non-infringement,or suitability for any purpose (whether or not MasterCard has been advised, has reason to know, or isotherwise in fact aware of any information) or achievement of any particular result. Without limitation,MasterCard specifically disclaims all representations and warranties that any practice or implementation ofthis document will not infringe any third party patents, copyrights, trade secrets or other rights.

Translation

A translation of any MasterCard manual, bulletin, release, or other MasterCard document into a languageother than English is intended solely as a convenience to MasterCard customers. MasterCard provides anytranslated document to its customers “AS IS” and makes no representations or warranties of any kindwith respect to the translated document, including, but not limited to, its accuracy or reliability. In noevent shall MasterCard be liable for any damages resulting from reliance on any translated document.The English version of any MasterCard document will take precedence over any translated version inany legal proceeding.

Information Available Online

MasterCard provides details about the standards used for this document—including times expressed,language use, and contact information—on the Publications Support page available on MasterCardConnect™. Go to Publications Support for centralized information.

©2006–2014 MasterCard. Proprietary. All rights reserved.

CPV 10 July 2014 • Card Personalization Validation

Summary of Changes, 10 July 2014This document reflects changes associated with the 15 July 2014 publication. To locate thesechanges online, click the hyperlinks in the following table.

Description of Change Where to Look

Rewrite of Chapter 1 Chapter 1, Introduction

Updated the Overview and Preliminary Assessment sections in Chapter 2.

Removed the following sections from Chapter 2:

• Implementation

• Sample Submission

• Change Notification Submission

Chapter 2, The CardPersonalization ValidationProcess

Updated the Overview section in Chapter 3, Sample Submission. Chapter 3, Overview

Clarified the wording in the Process section in Chapter 3, Sample Submission. Chapter 3, Process

Removed Preliminary Assessment chapter.

Removed How to Complete the CPV Sample Submission Form appendix.

Removed Glossary


Card Personalization Validation • 10 July 2014 1

Table of Contents

Chapter 1 Introduction ......................................................................... 1-iPurpose.................................................................................................................................... 1-1

Audience.................................................................................................................................. 1-1

Card Personalization Validation Objectives.............................................................................. 1-1

When to do Card Personalization Validation ........................................................................... 1-2

Prerequisites for Doing Card Personalization Validation.......................................................... 1-2

Card Personalization Validation Support.................................................................................. 1-3

Card Personalization Validation Contact Information............................................................... 1-3

Related Information ................................................................................................................. 1-4

Business Process Diagram Conventions................................................................................... 1-6

Chapter 2 The Card Personalization Validation Process .................... 2-iOverview ................................................................................................................................. 2-1

Preliminary Assessment ........................................................................................................... 2-1

Chapter 3 Sample Submission ............................................................. 3-iOverview ................................................................................................................................. 3-1

Process..................................................................................................................................... 3-3

Chapter 4 Change Notification Submission ........................................ 4-iOverview ................................................................................................................................. 4-1

Process..................................................................................................................................... 4-1

Appendix A Data Packages..................................................................... A-iIntroduction .............................................................................................................................A-1

Data Presence—Notation.........................................................................................................A-1

Data Packages—Contents ........................................................................................................A-2

Data Package 1—Card Risk Management ................................................................................A-2

Data Package 2—EMV Data.....................................................................................................A-4

Data Package 3—Cardholder Data ..........................................................................................A-5

Data Package 4—Certificate and Key Data ..............................................................................A-6

Data Package 5—Internal Variables .........................................................................................A-7

Data Package 6—Other Data, Minor Impact............................................................................A-8


Card Personalization Validation • 10 July 2014 i

Table of Contents

Data Package 7—Other Data, Major Impact ............................................................................A-9

Data Package 8—Thresholds .................................................................................................A-10


ii 10 July 2014 • Card Personalization Validation

Chapter 1 IntroductionThe Card Personalization Validation (CPV) manual describes CPV, the products subject toCPV, and when CPV should be done.

Purpose.......................................................................................................................................... 1-1

Audience........................................................................................................................................ 1-1

Card Personalization Validation Objectives.................................................................................... 1-1

When to do Card Personalization Validation ................................................................................. 1-2

Prerequisites for Doing Card Personalization Validation................................................................ 1-2

Card Personalization Validation Support........................................................................................ 1-3

Card Personalization Validation Contact Information..................................................................... 1-3

Related Information ....................................................................................................................... 1-4

Business Process Diagram Conventions......................................................................................... 1-6


Card Personalization Validation • 10 July 2014 1-i

IntroductionPurpose

PurposeThis guide details the Card Personalization Validation (CPV) process that issuersor their authorized agents must follow before issuing a chip product supportingan EMV contact interface, an EMV contactless interface, or both, and bearing aMasterCard brand mark. The term “chip product” in this manual refers to EMVand digital devices including contact and contactless EMV chip cards, watches,tags, and NFC-enabled mobile phones.

NOTE

For Mobile MasterCard PayPass M/Chip Technical Products, the CardPersonalization Process is detailed in the Mobile PersonalizationValidation guide published in the MasterCard Mobile Documentation onMasterCard Connect> Publications> Chip Information Center or onwww.mastercard-mobilepartner.com/

For PayPass – Mag Stripe only Technical Products, the Card PersonalizationValidation process is detailed in a separate guide, the Card PersonalizationValidation Guide for PayPass – Mag Stripe, available in the MasterCard PayPassDocumentation on MasterCard Connect> Publications> Chip InformationCenter.

AudienceMasterCard provides this guide for issuers and their authorized agents. Theterm ‘issuers’ in this guide covers both issuers and authorized agents.

Specifically, the following personnel should find this guide useful:

• Program managers and project managers for issuers implementing newor amending existing chip products

• Personnel running an instance of the Card Personalization Validation process

Card Personalization Validation ObjectivesCard Personalization Validation (CPV) is a process ensuring that every TechnicalProduct offers a sufficient level of service, acceptance, interoperability,performance, and security to cardholders and acceptance locations. In thecontext of this document, a ‘Technical Product’ is a chip product bearing aMasterCard brand mark, personalized with a given Personalization Profile by anassigned personalization bureau using a specific personalization process.

CPV verifies the chip product approval statuses from a functional, security, andquality perspective and ensures that the Technical Product is compliant withthe relevant MasterCard payment product requirements and best practices.MasterCard payment product requirements and best practices related documentsare listed in the Related Information section.


Card Personalization Validation • 10 July 2014 1-1

http://mastercard-mobilepartner.com/

Introduction

When to do Card Personalization Validation

If present, data held on the magnetic stripe itself is not subject to any form oftesting or validation, except for consistency checks against the magnetic stripeequivalent data when held on the chip.

When to do Card Personalization ValidationIssuers must perform Card Personalization Validation each time they issuea Technical Product.

This would occur when:

• Issuers migrate existing BINs to chip or add new BINs to an existing chipprogram

• Issuers issue a Technical Product that is based on a new chip product

• Issuers change their personalization bureau

• The personalization bureau changes their personalization process

• Issuers amend any of the personalization characteristics, excludingcardholder related data and expiration dates, of one of their CPV-approvedTechnical Products

• Issuers add a co-residing application, such as CAP, or any other proprietaryapplication to one of their CPV-approved Technical Products

Prerequisites for Doing Card Personalization ValidationThere are three prerequisites for CPV:

1. Issuers must select and use a personalization bureau that has completed theMasterCard Global Vendor Certification Program. Certified vendors are listedin the Certified Vendors (for Card Production Services of Any MasterCard®,Maestro®, or Cirrus® Branded Card) document that is regularly publishedas an attachment to the Global Security Bulletin, available on MasterCardConnect.

2. Issuers must select an approved chip product. Issuers must provide theLetter of Approval (LoA) of the chip product they intend to use.

• Chip products supporting M/Chip or M/Chip Advance—Issuers mustget the LoA from the chip product vendor.

• Chip products supporting PayPass M/Chip or PayPass M/ChipFlex—PayPass Vendor Product LoAs are published in the MasterCardPayPass Documentation on MasterCard Connect > Publications > ChipInformation Center.


1-2 10 July 2014 • Card Personalization Validation

IntroductionCard Personalization Validation Support

• Chip products supporting EMV Common Payment Application(CPA)—CPA Vendor Product LoAs are published on www.emvco.com.

• Chip products supporting other Applications—Issuers willing todeploy chip products supporting other Applications (such as UKIS,VSDC, and SECCOS) need to contact [email protected] andapply for a waiver.

M/Chip, M/Chip Advance, PayPass – M/Chip, PayPass – M/Chip Flex,and CPA products offer many opportunities for customization during thepersonalization phase. As a consequence, it may happen that a givenchip product LoA does not cover a particular customization. MasterCardrecommends that issuers check with their chip product vendor that the exactconfiguration that they intend to issue is covered by the chip product LoA.

Customers with questions about M/Chip Advance valuepropositions, functionality and use cases, should contact theChip Product Management team by sending an email message to:[email protected]

3. Issuers must select a MasterCard-accredited CPV Service Provider withwhom they will interact with during the CPV process. CPV Service Providersaccredited by MasterCard are listed in the M/Chip Accredited Third Partiesand Service Providers manual.

Card Personalization Validation SupportMasterCard M/Chip Accredited Third Parties offer issuers a variety of CardPersonalization Validation (CPV) related support services.

These services include the following:

• Assess the impact of chip migration on the customer infrastructure

• Provide assistance with technical choices

• Identify best practices

• Design technical architectures and review technical options

• Assess compliance against MasterCard requirements

• Update and configure host systems and chip components

MasterCard maintains the list of M/Chip Accredited Third Parties that maysupport issuers. This information is published in the M/Chip Accredited ThirdParties and Service Providers manual that is available on MasterCard Connect>Publications> Chip Information Center.

Card Personalization Validation Contact InformationIssuers should contact their Card Personalization Validation (CPV) ServiceProvider for any questions they may have about CPV.



http://www.emvco.com/

mailto:[email protected]


Introduction

Related Information

CPV Service Providers accredited by MasterCard are listed in M/Chip AccreditedThird Parties and Service Providers.

MasterCard offers support and advice through the chip support services([email protected]) and the EMV and Digital Devices ProductDeployment Services team ([email protected]).

The EMV and Digital Devices—Advanced Deployments team supportsissuers with M/Chip Advance card personalization profile definitionmatters. Issuers can contact this team by sending an email message to:[email protected].

Related InformationDescriptions of these documents are available in the List of Manuals in thePublications product on MasterCard Connect™. The documents listed belowprovide information related to the subjects discussed in this document.

Definitions of MasterCard specific terms used in this document are available inthe MasterCard Dictionary.

To order MasterCard documents, use the Ordering Publications tool, availablein the Quick Links section on the Publications home page, or contact theCustomer Operations Services team.

General Information

• M/Chip Accredited Third Parties and Service Providers

• M/Chip Qualified Test Tools

• Card Personalization Validation Sample Submission Form—Getting Started

EMV Contact

• Migrating Card Issuance to Chip

• M/Chip Requirements

• M/Chip Personalization Data Specifications and Profiles

• M/Chip Card Personalization Standard Profiles

• M/Chip 4 Version 1.0 Issuer Guide to Debit and Credit ParameterManagement

• M/Chip 4 version 1.1 Issuer Guide to Debit and Credit ParameterManagement

• MasterCard CPA Issuer Guide to Parameter Management

• Chip Authentication Program—Implementation Guide






Introduction

Related Information

Contactless

• Adding PayPass to M/Chip Issuance

• PayPass M/Chip Requirements

• PayPass Personalization Data Specifications

• M/Chip Card Personalization Standard Profiles

• PayPass Mag Stripe Issuer Implementation Requirements

• PayPass—M/Chip Issuer Guide

• Card Personalization Validation Guide for PayPass—MagStripe

• Mobile Personalization Validation

M/Chip Advance

• M/Chip Advance—Best Practice Guide

• M/Chip Advance Card Application Specification—Payment

• M/Chip Advance Card Application Specification—Payment and Data Storage

• M/Chip Advance Personalization Data Specifications and Profiles

U.S. Region Manuals

• U.S. Region Debit EMV Issuer Requirements

• U.S. Maestro AID Personalization Data Specification

• M/Chip Card Personalization U.S. Market Standard Profiles



IntroductionBusiness Process Diagram Conventions

Business Process Diagram ConventionsThe business process diagrams in this guide use the following symbols.

Descriptions of the symbols are as follows:

• A pool is used to contain activities within an organization.

• An activity can be atomic (task) or compound (can contain multipleactivities).

• An activity is started or triggered by a Start Event, a Time-based Trigger, or asequence or message flow from another activity.

• Sequence flow lines with solid lines and arrowheads connect one activity toanother, to a gateway, or to an end event.

• Gateways signal a split in a process flow or a merger of multiple processflows.

• Message flow lines with dashed lines and open arrowheads connectactivities across pools, usually via an artifact.

• A process contains activities interconnected by means of flow lines.



Chapter 2 The Card Personalization Validation ProcessThe Card Personalization Validation process and a summary of its subprocesses are found inthe following sections.

Overview ....................................................................................................................................... 2-1

Preliminary Assessment ................................................................................................................. 2-1



The Card Personalization Validation Process

Overview

OverviewThe Card Personalization Validation (CPV) process generally consists ofsubmitting a sample card for validation to a CPV Service Provider that tests it forconformance against the relevant personalization specifications.

A sample card is a chip product representative of the Technical Productconsidered for issuance. As such it must be personalized with the samepersonalization profile and by the same personalization bureau that will beused for the personalization of the Technical Product in production mode. Thisprocess for submitting a sample card is detailed in Sample Submission.

In some specific cases, the issuer may alternatively provide a list of minorchanges that will be applied on a CPV-approved Technical Product, and requestan assessment from a CPV Service Provider to be allowed deploying themodified Technical Product without having to submit a sample card. Acceptedchanges typically concern the addition of a new BIN, change of chip product toan equivalent chip product and minor changes on personalization parametersettings. If the result of the assessment is negative, the issuer is requested toperform a Sample Submission. This process is detailed in Change Notification.

To define which of the Sample Submission process or the Change Notificationprocess applies to a specific case, please refer to the Preliminary Assessmentbelow.

NOTE

A prerequisite for being able to use the Change Notification process instead ofthe Sample Submission process is that the issuer is able to properly managethe different versions of its Technical Products, using appropriate industry bestpractices.

Preliminary AssessmentA preliminary assessment helps the issuer determine which of the SampleSubmission process or the Change Notification process to undertake. It consistsof answering the following series of questions.

Most questions refer to Data Packages, which are groups of data elements.Each Data Package is associated with a Major or Minor Attribute indicating theimpact of a change to one or several of its data elements. Data Packages aredescribed in Appendix A, Data Packages.



The Card Personalization Validation ProcessPreliminary Assessment

The issuer should consider the Change Notification as the default route. SampleSubmission is only mandated when answering Yes to any of the followingquestions:

1. Is it the first time that this Technical Product is issued? Technical Productrefers to a unique combination of a chip product1, personalization profile,and personalization bureau.

2. Are parameters from Data Package 1 - Card Risk Management, or DataPackage 2 - EMV Data changing to values that are not compliant with theMasterCard Personalization Data Specifications and Profiles?

3. Is information from Data Package 4 - Certificates and Key Data beingmodified in such a way that the data organization within the file structureis changed?

4. Are parameters from Data Package 7 - Other Data, Major Impacts changing?

5. Are parameters from Data Package 8 - Thresholds changing in such a waythat it will result in a different Technical Product behavior? Some examplesare:

• Altering parameter values from a zero value to a non-zero value mayresult in an original online-only product to behave as an offline capableproduct, hence requiring other settings such as a different CVM list.

• Altering parameter values may result in the deactivation of a velocitycheck; for example, a consecutive online limit is set in such a way thatit will never be reached during the life cycle of this card and may resultin the card behaving as an offline-only product.

6. Are any of the following being changed:

• The card personalization file structure or data organization?

• The chip card personalization scripts?

• The record padding?

1. Several chip products may be considered equivalent if they are fully compatible both from a functionalperspective and from a personalization perspective. Please contact your chip product vendor in case ofdoubt.



Chapter 3 Sample SubmissionThe Sample Submission subprocess is described in the following sections.

Overview ....................................................................................................................................... 3-1

Process........................................................................................................................................... 3-3



Sample Submission

Overview

OverviewDuring Sample Submission, issuers personalize a sample card of a TechnicalProduct and submit it to the CPV Service Provider that tests it for conformancewith the appropriate personalization specifications. A ‘sample card’ is a chipproduct representative of the Technical Product considered for issuance, itmust be personalized with the same personalization profile and by the samepersonalization bureau that will be used for the personalization of the TechnicalProduct in production mode.

NOTE

When the personalization of a chip product involves multiple stages, meaningwhen the last stage consists of changing some parameters during the first onlinetransaction performed by the cardholder, the sample card submitted to CPV mustbe the final personalized chip product, including the last stage performed online.

This way, CPV will make sure the complete personalization process, including theonline update process, works correctly.

Before sending the sample card, the issuer may optionally create a Card Imagefrom the sample card using a Qualified CPV Test Tool or the MasterCard CardImage Extraction Tool. This card image can be sent to the CPV service providerby e-mail, so the validation can be initiated while the sample card is beingshipped to the CPV service provider.

Any sample card or card image submitted to CPV service provider must beaccompanied by a form capturing administrative information about the issueras well as details about the chip product under test. Two different forms areavailable depending on the application supported by the chip product:

• Sample Submission Form (SSF)—to be used for M/Chip, PayPass M/Chip,PayPass M/Chip Flex, CPA, M/Chip Advance Contact Only or Payment Only(may only be used for M/Chip Advance products implementing MasterCardstandard profiles), or other applications

• M/Chip Advance Profile Generator—to be used for any customized M/ChipAdvance profiles or chip products supporting M/Chip Advance and DataStorage

Both forms/tools are based on Microsoft Excel and are available on MasterCardConnect> Publications> Chip Information Center.

The SSF can optionally be used by the issuer to request a preliminary paperreview of the personalization parameters to validate their personalizationprofile/parameters on paper before even personalizing a sample. Thepersonalization parameters must be described in the SSF for each of theapplications that the card will support. This paper review option does not applyto M/Chip Advance Profile Generator.

At the end of the validation, issuers will receive a CPV Report as a formal recordof the result of the CPV test, whether successful or not.



Sample Submission

Overview

Sample Submission Subprocess



Sample Submission

Process

ProcessIssuers must follow the below steps to complete the Sample Submissionsubprocess.

Procedure

1. Obtain the CPV Sample Submission Form (SSF) or the M/Chip AdvanceProfile Generator depending on the chip product application (as previouslyexplained in the Overview) from MasterCard Connect > Publications >Chip Information Center.

2. Complete the form that applies:

• Sample Submission Form (SSF)—For more information on how tocomplete the SSF, refer to the Card Personalization Validation SampleSubmission Form—Getting Started manual.

• M/Chip Advance Profile Generator—For support completing the form,please contact [email protected].

NOTE

Before completing any form, issuers must verify that the Type Approval LoAfor the Chip Product that they are using is still valid.

3. Send the completed CPV Sample Submission Form or M/Chip AdvanceProfile Generator by e-mail to the CPV Service Provider. Refer to the M/ChipAccredited Third Parties and Service Providers manual for the CPV ServiceProviders contact details.

NOTE

M/Chip Advance Profile Generator must be pre-validated by MasterCard([email protected]) before it is being sent to CPV serviceprovider when any of the following conditions apply:

• Their card features multiple MasterCard-branded payment applications(for example, in the case of EMV Combo cards), or

• Their card features at least one M/Chip Advance application of the typeM/Chip Advance - Payment + Data Storage, or

• At least one of the applications on the card has its personalizationprofile defined using the “Expert Mode” of the M/Chip Advance ProfileGenerator. The “Expert Mode“ allows issuers creating custom profilesmanually.

4. Issuers will receive an e-mail response that will contain either:





Sample Submission

Process

• An advice indicating that the information in the administrative section ofthe Form is incorrect or incomplete.

• The CPV Reference Number. Issuers must quote the CPV ReferenceNumber on all further correspondence related to this instance of CardPersonalization Validation. Depending on the CPV Service Providerthat issuers choose, CPV Service ordering information may need to beexchanged with the CPV Service Provider before receiving the CPVReference Number.

5. Issuers that request a preliminary paper-review of the CPV SampleSubmission Form will receive the corresponding CPV Report.

6. Issuers should have a personalization bureau create or personalize a Samplerepresentative of the Technical Product considered for issuance.

7. Generate a complete Card Image from the Technical Product produced inStep six. The Card Image is created using either a Qualified CPV Test Tool1or the MasterCard Card Image Extraction Tool. For more information onhow to make a Card Image, refer to the documentation that accompaniesthe tool. The Card Image must include:

• The image of all Applications present on the Sample

• The data on the physical magnetic stripe2 if present.

8. Send an e-mail message including the Card Image, along with an electroniccopy of the CPV Sample Submission Form (or M/Chip Advance ProfileGenerator) and the related CPV Reference Number to the CPV ServiceProvider.

9. Send the Sample to the physical address of the CPV Service Provider.

NOTE

To minimize the CPV elapsed time, issuers should send the card image andthe Sample at the same time. This allows the CPV Service Provider to previewthe Card Image while the Sample is en route to their premises. Issuers willreceive a CPV Report if the test of the Card Image was not successful.

10. When the CPV Service Provider has received either the Card Image, Sample,or both, issuers will receive an e-mail confirming the receipt.

11. The CPV Service Provider will test the Card Image and the Sample. As aresult of that testing, issuers will receive by e-mail a CPV Report in PDFformat, which documents the outcome of that testing. For a successful CPV,the CPV Report will be digitally signed by MasterCard.

12. If the CPV testing is not successful, a new CPV iteration will start. Issuersshould complete corrections indicated in the CPV Report and continue withsteps six and seven, creating a new Card Image and Sample, etc.

1. Qualified CPV Test Tools are listed in the M/Chip Qualified Test Tools manual.2. In contrast with magnetic stripe, equivalent data present in the chip and read via a contact or contactless

interface (as applicable)



Chapter 4 Change Notification SubmissionThe Change Notification Submission subprocess is described in the following sections.

Overview ....................................................................................................................................... 4-1

Process........................................................................................................................................... 4-1



Change Notification Submission

Overview

OverviewThe Change Notification Submission (CNS) subprocess enables issuers toprovide a CPV Service Provider with a list of changes they intend to apply toan existing Technical Product and when they request an assessment of thesechanges in order to allow issuing.

A prerequisite for being able to do Change Notification Submission is thatissuers properly manage the Technical Products they personalize and anyvariant resulting from changes, using appropriate industry best practices.

The following figure shows the Change Notification Submission:

Change Notification Submission Subprocess

ProcessFollow the steps below to complete the Change Notification Submissionsubprocess:

Procedure

1. Obtain the CPV Change Notification (CNS) Form from MasterCardConnect> Publications> Chip Information Center.

2. Complete the information requested in the form.

3. Send the completed form by e-mail to the CPV Service Provider.



Change Notification Submission

Process

Issuers sending the completed CNS form to another CPV Service Provider,other than the one involved in the CPV testing of the existing TechnicalProduct on which this request is based,

AND

If the change is a Chip Card change or a Personalization Parameter Settingchange, the issuer will need to provide the Card Image, CPV Report, andall variance letters related to the existing Technical Product to the CPVService Provider that is selected.

NOTE

The originating e-mail address of this request is used for all futurecorrespondence regarding this change notification submission.

4. The CPV Service Provider will assess the submission and send an e-mailincluding a report that will be one of the following:

• A positive assessment to notify issuers that the submitted change can beperformed without further CPV testing

• A neutral assessment indicating that the nature of the submitted changesrequires issuers to perform Sample Submission to obtain CPV approvalfor the Technical Product



Appendix A Data PackagesData packages group together data elements that are functionally related and have similarCPV validation requirements.

Introduction ...................................................................................................................................A-1

Data Presence—Notation...............................................................................................................A-1

Data Packages—Contents ..............................................................................................................A-2

Data Package 1—Card Risk Management ......................................................................................A-2

Data Package 2—EMV Data...........................................................................................................A-4

Data Package 3—Cardholder Data ................................................................................................A-5

Data Package 4—Certificate and Key Data ....................................................................................A-6

Data Package 5—Internal Variables ...............................................................................................A-7

Data Package 6—Other Data, Minor Impact..................................................................................A-8

Data Package 7—Other Data, Major Impact ..................................................................................A-9

Data Package 8—Thresholds .......................................................................................................A-10


Card Personalization Validation • 10 July 2014 A-i

Data Packages

Introduction

IntroductionThere are eight Data Packages that each have an attribute telling whetherchanges to its data elements are considered Major or Minor. Major changesalways require Sample Submission.

Data Packages

DataPackage Name Major Minor

1 Card Risk Management X 1

2 EMV Data X 1

3 Cardholder Data X

4 Certificate Key Data X

5 Variables X

6 Other Data, Minor Impact X

7 Other Data, Major Cross Impacton Data Package 1/DataPackage 2

X

8 Thresholds X 2

Data Presence—NotationThe notations shown below are used to describe the requirements for thepersonalization parameters in each Data Package.

Format Notations

Usage Code Description

M1 Mandatory: This data element is mandatory.

M2 Mandatory: This data element is mandatory for TechnicalProducts that implement SDA.

M3 Mandatory: This data element is mandatory for TechnicalProducts that implement DDA.

C Conditional: This data element is not present, unlessspecific conditions are met, in which case this data elementbecomes mandatory.

1. Changes to parameters in this Data Package that do not conform to reference documentation settings areconsidered as major.

2. Only when a limit is altered from zero to non-zero or when the change results in the deactivation ofa velocity check.


Card Personalization Validation • 10 July 2014 A-1

Data Packages

Data Packages—Contents

Usage Code Description

O Optional: This data element is optional.

NA Not applicable

Data Packages—ContentsIn the following data package tables, the Card Application column indicatesthe relationship between a specific data element and the card applications towhich it is applicable.

For the purpose of this guide, dual interface Technical Products are consideredto support two card applications, that is, M/Chip on the EMV contact interfaceand PayPass M/Chip on the contactless interface.

Data Package 1—Card Risk ManagementThe data elements shown here govern card risk management.

They are linked to the specification on which the Technical Product is based.

Changes to data elements from this Data Package that do not conform toreference documentation settings are considered Major and initiate SampleSubmission. Changes that conform to reference document settings areconsidered Minor and initiate Change Notification Submission.

NOTE

Unless information specific to Maestro PayPass or PayPass – M/Chip Flex isindicated, Technical Products based on Maestro PayPass and PayPass – M/ChipFlex should follow the same process as PayPass – M/Chip.

Data Package 1—Card Risk Management

Name Application Template TagDataPresence

Accumulator ProfileControls template

CPA BF31 DF0x C

Accumulator x Controls CPA BF32 DF0x C

M/Chip D3 M1Additional check table

CPA BF33 DF0x C

M/Chip D5 M1

PayPass – M/Chip D7 M1

Application Control

CPA C1 M1


A-2 10 July 2014 • Card Personalization Validation

Data Packages

Data Package 1—Card Risk Management


Card Issuer Action CodeTemplate (CIAC entries)

CPA BF34 DF0x M1

Card Issuer ActionCode-decline

M/Chip C3 M1

PayPass – M/Chip CF M1

Card Issuer ActionCode-default

M/Chip C4 M1

PayPass – M/Chip CD M1

Card Issuer ActionCode-online

M/Chip C5 M1

PayPass – M/Chip CE M1

CDOL1 related data length M/Chip C7 M1

CRM Country Code M/Chip C8 M1

CRM Currency Code M/Chip C9 M1

Cryptogram VersionNumber

ALL M1

Currency Conversion Tabletemplate

CPA BF38 DF0x C

Currency Conversion Table M/Chip D1 M1

Counter Profile Controlstemplate

CPA BF36 DF0x C

Counter x Controls template CPA BF37 DF0x C

Cyclic Accumulator ProfileControl x

CPA BF39 DF0x C

Cyclic Accumulator xControls template

CPA BF3A DF0x C

M/Chip M1Derivation key index(included in Issuer OptionControl) CPA M1

Default ARPC ResponseCode

M/Chip D6 M1

GPO Parameters CPA BF3E DF0x M1

Issuer Options ProfileControls template

CPA BF3B DF0x M1



Data Packages

Data Package 2—EMV Data


MTA Profile Controlstemplate

CPA BF3D DF0x C

Profile Controls template CPA BF3F DF0x M1

Data Package 2—EMV DataThe data elements shown here are key EMV parameters.

The chip provides them to the terminal to support various types of processing,such as Terminal Risk Management (TRM) processing.

They specify application usage and how the transaction is to be processedunder certain conditions.

Changes to parameters in this Data Package that do not conform to referencedocumentation settings are considered Major and initiate Sample Submission.Changes that conform to reference document settings are considered Minor andinitiate Change Notification Submission.

Data Package 2—EMV Data

Name Application TagDataPresence

Application Currency Code ALL 9F42 O

Application Currency Exponent ALL 9F44 O

Application Discretionary Data ALL 9F05 O

Application Identifier (AID) ALL 4F M1

Application Interchange Profile ALL 82 M1

PayPass –M/Chip

D8 M1

Application Label ALL 50 C

Application Preferred Name ALL 9F12 O

Application Usage Control (AUC) ALL 9F07 M1

Application Version Number ALL 9F08 M1

Cardholder Verification Method (CVM) List ALL 8E M1

Certification Authority Public Key Index ALL 8F M2/M3

Directory Definition File (DDF) Name ALL 9D M1



Data Packages

Data Package 3—Cardholder Data


Dedicated File (DF) Name ALL 84 M1

Issuer Action Code – Default ALL 9F0D M1

Issuer Action Code – Denial ALL 9F0E M1

Issuer Action Code – Online ALL 9F0F M1

Static Data Authentication Tag List ALL 9F4A M3

Data Package 3—Cardholder DataThe data elements shown here contain cardholder related data.

They are provided to the terminal to allow correct identification of thecardholder and of the application being used to perform the transaction.

Changes to parameters in this Data Package require no further assessmentwith regard to card personalization validation. These values are provided forinformation only.

Data Package 3—Cardholder Data


Application Effective Date ALL 5F25 O

Application Expiration Date ALL 5F24 M1

Application Primary Account Number(PAN)

ALL 5A M1

Application Primary Account Number(PAN) Sequence Number

ALL 5F34 M1

Cardholder Name ALL 5F20 C

Cardholder Name Extended ALL 9F0B O

Offline PIN ALL O

Track 1 Discretionary Data ALL 9F1F O

Track 2 Discretionary Data ALL 9F20 O

Track 2 Equivalent Data ALL 57 M1



Data Packages

Data Package 4—Certificate and Key Data

Data Package 4—Certificate and Key DataThe data elements shown here are related to certificates and keys.

They are provided to the terminal to allow the Card Authentication Method,such as SDA or DDA, to be performed.

Changes to data elements from Data Package 4 that result in addition or deletionof remainders or relocation of data within the file structure, are consideredMajor and must initiate Sample Submission. All other changes are consideredMinor and should initiate Change Notification Submission.

Data Package 4—Certificate and Key Data


Certification Authority Public Key Index ALL 8F M2

Data Authentication Code ALL 9F45 M2

ICC PIN Encipherment Public KeyCertificate

ALL 9F2D O

ICC PIN Encipherment Public KeyExponent

ALL 9F2E O

ICC PIN Encipherment Public KeyRemainder

ALL 9F2F O

Integrated Circuit Card (ICC) Public KeyCertificate

ALL 9F46 M3

Integrated Circuit Card (ICC) Public KeyExponent

ALL 9F47 M3

Integrated Circuit Card (ICC) Public KeyRemainder

ALL 9F48 M3

Issuer Public Key Certificate ALL 90 M2

Issuer Public Key Exponent ALL 9F32 M2

Issuer Public Key Remainder ALL 92 M2

Signed Dynamic Application Data ALL 9F4B M3

Signed Static Application Data ALL 93 M2/M3



Data Packages

Data Package 5—Internal Variables

Data Package 5—Internal VariablesThe data elements shown here contain various internal data.

Changes to data elements from Data Package 5 are considered Minor andshould initiate Change Notification Submission.

Data Package 5—Variables


Application Transaction Counter (ATC) ALL 9F36 M1

Bad cryptogram counter M/Chip M1

Consecutive offline transaction number M/Chip M1

Cumulative offline transaction amount M/Chip M1

Diversified key for ICC Dynamic number M/Chip M1

Global MAC in Script counter M/Chip M1

Key for ICC Dynamic number M/Chip M1

Last Online Application TransactionCounter (ATC) Register

ALL 9F13 O

M/Chip M1Master Key for the AC generation

CPA M1

M/Chip M1Master Key for the SMC generation(confidentiality)

CPA M1

M/Chip M1Master Key for the SMI generation(integrity)

CPA M1

Personal Identification Number (PIN) TryCounter

ALL 9F17 C

M/Chip M1Previous transaction history

CPA C7 M1

Script Counter M/Chip 9F5F M1



Data Packages

Data Package 6—Other Data, Minor Impact

Data Package 6—Other Data, Minor ImpactThe fields shown here contain various other elements of information.

Changes to parameters in this Data Package are considered Minor and initiateChange Notification Submission.

Data Package 6—Other Data, Minor Impact


Application Priority Indicator ALL 87 C

Application Reference Currency ALL 9F3B O

Application Reference Currency Exponent ALL 9F43 O

Application Template ALL 61 C

Directory Discretionary Template ALL 73 O

Dynamic Data Authentication Data ObjectList (DDOL)

ALL 9F49 M3

File Control Information (FCI) IssuerDiscretionary Data

ALL BF0C O

File Control Information (FCI) ProprietaryTemplate

ALL A5 M1

File Control Information (FCI) Template ALL 6F M1

Issuer Code Table Index ALL 9F11 O

Issuer Country Code ALL 5F28 M1

Language Preference ALL 5F2D O

PSE ALL O

Service Code ALL 5F30 O

Security Limits3 M/Chip NA M1

Short File Identifier (SFI) ALL 88 M1

Transaction Certificate Data Object List(TDOL)

ALL 97 O

Log Data Table CPA BF40 O

Log Format ALL 9F4E C

Log Entry ALL 9F4D C

Issuer Application Data CPA 9F10 M

3. M/Chip 4 Version 1.1 only.



Data Packages

Data Package 7—Other Data, Major Impact

Data Package 7—Other Data, Major ImpactThe fields shown here contain various other elements of information.

Any amendment to data elements from Data Package 7 may cause significantchanges in card behavior because of interactions with some elements fromData Package 1, Card Risk Management, or Data Package 2, EMV Data. Suchamendments are therefore considered to have a Major impact and must initiateSample Submission.

Data Package 7—Other Data, Major Impact


Application File Locator (AFL) ALL 94 M1

PayPass –M/Chip

D9 M1

AIP/AFL Entries CPA BF41 M1

M/Chip 9F7E M1Application Life Cycle Data

CPA 9F7E M1

Card Risk Management Data Object List1 (CDOL1)

ALL 8C M1

Card Risk Management Data Object List2 (CDOL2)

ALL 8D M1

Processing Options Data Object List(PDOL)

ALL 9F38 O

Profile Selection File CPA NA O

Profile Selection File Entry CPA C2 C



Data Packages

Data Package 8—Thresholds

Data Package 8—ThresholdsThe data elements shown here contain thresholds and limits.

Changes to parameters in Data Package 8 which would result in a differentTechnical Product behavior are considered Major and require SampleSubmission. The changes are:

• Altering parameter values from zero to non-zero in such a way that it wouldresult in an original online only product to behave as an offline capableproduct. This may require other settings such as a different CVM list, whichmust be verified through Sample Submission.

• Altering parameters in such a way that it results in the deactivation of avelocity check. For example, a consecutive limit or a cumulative amountonline limit is set in such a way that it will never be reached during thelife cycle of this card and resulting in the card behaving as an offline-onlyproduct.


Name ApplicationTemplate orTag Presence

ATC limit M/Chip M1

Bad cryptogram counter limit M/Chip C

Counter Data template CPA BF35 C

Accumulator Data template CPA BF30 C

Cyclic Accumulator x Data template CPA BF42 C

Number of Days Offline Limit CPA C3 C

Limits Entries template CPA BF3C C

CFDC limit for AC session key M/Chip C

CFDC limit for confidentiality sessionkey

M/Chip C

CFDC limit for integrity session key M/Chip C

Global MAC in Script counter limit M/Chip C

ALL 9F14 OLower Consecutive Offline Limit

M/Chip 9F14 M1

Lower Cumulative Off line TransactionAmount

M/Chip CA M1

MAC in script counter limit M/Chip C



Data Packages


Name ApplicationTemplate orTag Presence

Personal Identification Number (PIN)Try Limit

ALL - C

ALL 9F23 OUpper Consecutive Offline Limit

M/Chip 9F23 M1

Upper Cumulative Off line TransactionAmount

M/Chip CB M1



Date post:	11-Sep-2021
Category:	Documents
Upload:	others
View:	36 times
Download:	3 times

Card Personalization Validation Guide - PayPass

Documents