New EMVCo protocol aims to simplify contactless payments

It sounds like subtraction by addition, but EMVCo's Brian Byrne says his organization's new contactless payment protocol should streamline the varied protection standards that now exist around the world. 

"The consumers won't notice the difference, but the merchants, the processors, the acquiers and developers' lives will get a lot simpler of we reduce the number of kernels," said Byrne, the director of engagement and operations at EMVCo, which recently released a proposal for a new contactless kernel to payment industry stakeholders for review.

A kernel is a set of functions that allow payment terminals to accept EMV-compliant contactless transactions. Since contactless payments have not developed uniformly, there are lots of kernels, and EMVCo is trying to streamline that as contactless payments mature globally. 

"Contactless payments evolved differently in different parts of the world, independent and on their own tracks," Byrne said. "These contactless kernels are all over the world now."

In the U.S., for example, contactless payments were introduced before the migration to EMV-chip cards. The U.S. experience contrasts with the U.K., which migrated to EMV cards a decade earlier. 

"Early EMV countries like the U.K. and France got their EMV contactless standards much earlier," Byrne said. "It was many years before other countries got in."

The result is that merchants and merchant acquirers are pressured to manage multiple kernels depending on where they support payments, increasing deployment time and expense. There are currently about two dozen different kernels. 

"Not everyone is using all of them," Bryne said. "But it's not unusual for firms to use seven or eight at once." 

The firms that originally established EMVCo, including Mastercard and Visa, are driving the initiative to produce a new kernel. Other card companies including American Express, Discover Financial and Japan's JCB are also supporting the effort. Payment processors including FIS, Adyen and Fiserv are reviewing the proposed specification, as are Stripe, Block, Microsoft, Google, Target and Amazon. 

“This new EMV Contactless Kernel Specification creates new opportunities for merchants, POS terminal vendors, and domestic payment systems to simplify acceptance, reduce costs, increase speed to market, and innovate," Matthew Robinson, executive vice president and general manager for network and acquiring solutions at American Express, said in an email. 

In 2019, EMVCo decided to address the number of kernels, commissioning a study and getting to work on a new proposal. The three years since have been a time of upheaval and unprecedented change in the payments industry as merchants, issuers, processors and consumers quickly moved to mobile and contactless payments to address health and economic concerns during the pandemic. 

"Instead of providing an entry point for multiple kernels, we decided that we should provide our own kernel," Byrne said. 

Brick-and-mortar merchants, which moved online even more quickly during the pandemic, also stepped up the pace of contactless payments in an effort to promote a literal contactless experience as more than half of consumers reported using contactless cards more often. And large issuers such as JPMorgan Chase, Wells Fargo, Citigroup and Bank of America quickly issued millions of contactless cards. This sudden jolt exacerbated the differences between contactless protocols, according to Byrne. 

With the new kernel, EMVCo has added privacy protections for the data in transmission and elliptic curve cryptography, which is designed to be harder to crack than more traditional RSA cryptography. "Hopefully it will make it easier for merchants and payment companies. Even if we don't get the number of kernels down to zero, it will still be a big improvement," Byrne said. 

EMVCo has made other adjustments to its protocols. In 2021, EMVCo added what's called IQ demodulation requirements to terminals. Modulation is how transaction data is transmitted between a payment device such as a card and a terminal. IQ demodulation improves the terminal's ability to decipher payment data and allow the payment devices more flexibility in terms of where they are positioned near the point-of-sale terminal. 

Standards are essential to deliver consistent payment experiences on a global scale, and organizations like EMVCo were created to develop those standards and drive adoption, said Zilvinas Bareisis, the head of Celent's retail banking practice. 

"Not having a consistent way to deploy payments means multiple applications which result in inefficiencies and extra cost, especially when testing and certifying those applications with the networks," Bareisis said. 

EMVCo's antitrust policy prevents it from making business decisions, Byrne said, adding each stakeholder will decide when and if to deploy the new kernel. 

"The kernel is certainly going to work globally. It will be an EMV kernel," Byrne said. "What we can say is our board of global brands participated in the release of the kernel. How they move it up to them."