#9 Risk Management between Payment Terminals and IC Cards: Terminal Risk Management and Action Analysis in EMV

Introduction

In this installment, we will explain the following procedures from the EMV specification flow in #6 in order.

• Terminal Risk Management

• Terminal Action Analysis

• Card Action Analysis

This is the process where the "payment terminal (the acquirer's intent)" and the "IC card (the issuer's intent)" communicate to decide "what to do with the transaction."

Terminal Risk Management

In Terminal Risk Management, the TVR (Terminal Verification Result) for the current transaction is created based on previous processing results and the floor limit set on the terminal. The TVR can be thought of as a report card for each transaction.

Regarding the processing so far, Offline Data Authentication was explained in #7.

Also, the Cardholder Verification procedure was explained in the previous installment, #8.

Additionally, the Floor Limit is a limit set on the "terminal" indicating "you don't need to get an online authorization if the amount is up to this value". While the acquirer sets the acceptable amount, it is often set to zero nowadays as international brands are moving toward requiring online authorization for all transactions.

Terminal Action Analysis

Terminal Action Analysis determines how to handle the current transaction by comparing the TVR created in the aforementioned Terminal Risk Management with the following settings:

The "TAC (Terminal Risk Code) = Acquirer's intent"

set by the acquirer on the payment terminal, and the

"IAC (Issuer Action Code) = Issuer's intent"

set by the issuer on the IC card.

"TAC" and "IAC" have settings for each of the following categories, which correspond to the same items checked in the "TVR" created during the aforementioned Terminal Risk Management.

• Denial: Reject the transaction at that point if it applies

• Online: Request online processing for the transaction if applicable

• Default: Request online processing, but decline the transaction if online is unavailable

Using the figure above as an example, if "Floor Limit Exceeded" is applicable on the TVR, the terminal compares this item against the TVR set by the ACQ in the terminal and the corresponding IAC set by the ISS in the IC card, and finally decides how to handle the transaction based on the following three patterns.

• TC (Transaction Certificate): Approve the transaction offline

• ARQC (Authorization Request Cryptogram): Request online processing

• AAC (Application Authentication Cryptogram): Decline the transaction offline

This decision result is sent to the IC card, and card action analysis is performed.

Card Action Analysis

A velocity check is performed, and ultimately the IC card (ISS) decides how to handle the transaction (TC, ARQC, or AAC).

Inside the IC chip, there are counters for the cumulative amount and consecutive number of transactions approved offline. If the offline limit set by the ISS is exceeded, the card can force an ARQC (online request) even if the terminal has selected TC (offline approval). This check is called a velocity check.

Note that the IC chip's offline counters are cleared to zero when an online authorization is approved.

Summary

In this article, we explained the process of deciding how to handle a transaction between a payment terminal and an IC card.

1. Create a TVR (report card) via "Terminal Risk Management"
↓
2. Decide how to handle the transaction at the payment terminal (ACQ) by comparing the TVR against the IAC and TAC via "Terminal Action Analysis"
↓
3. Finally, the IC card (ISS) decides how to handle the transaction based on these decisions via "Card Action Analysis"

How to handle the transaction = TC (Approve) or ARQC (Online Request) or AAC (Decline)

Next time, we will finally enter the processing steps for when ARQC is selected (requesting approval online from the issuer).