EMV is the global technology standard for chip card payments. It helps protect cardholders from fraud and reduces merchants’ liability for counterfeit card fraud.
To become EMV compliant, a business needs point-of-sale hardware and software that meet EMV standards, so credit and debit cards are processed using the more secure chip method.
Are you breaking the law if you don’t have an EMV chip terminal? Does EMV compliance cost money? These are questions I hear regularly. This guide covers what EMV is, how it works, why it matters, what it costs and how to get compliant.
EMV compliance explained
EMV stands for Europay, Mastercard and Visa, the three companies that pioneered the technology. The standard is now managed by EMVCo.
To be EMV compliant, a merchant updates its card terminals and POS software to accept chip cards and meet EMV standards.
The US liability shift took effect in October 2015, yet many merchants were slow to make the switch, and plenty of misconceptions about the technology remain.
EMV compliance “laws”
You may have heard of the EMV compliance law. It isn’t actually a law. No state or federal agency can fine or jail you for not complying.
It’s an industry rule set by the card networks and enforced through processors. That still makes it serious, because merchants that aren’t EMV compliant can carry liability for counterfeit fraud on chip cards.
The liability shift began in October 2015. Pay-at-the-pump fuel dispensers got a later deadline, which was ultimately pushed to April 2021.
So no one will haul you away in cuffs. But you could face the cost of fraud, chargebacks and related fees.
How EMV technology & chip cards work
Chip cards are dipped or tapped at a terminal instead of swiped. By now nearly every card in your wallet has a chip.
Magstripe data is static. The same sensitive information is used for every transaction, so a thief who copies it can keep making fraudulent charges.
A chip creates a unique one-time code, called a cryptogram, for each transaction. Even if that data is stolen, it can’t be reused. That makes chip cards much harder to clone and makes skimmers far less useful.
Why does EMV compliance matter?
If non-compliance isn’t illegal, why does it matter? One word: liability.
If you accept a counterfeit chip card by swiping it on a terminal that can’t read chips, you can be responsible for the sale, the cost of goods and any chargeback fees. I know merchants who have lost thousands this way.
Here’s a hypothetical. A customer brings a chip card into your store, but your terminal only swipes. If that card turns out to be counterfeit, the liability for that fraud generally shifts to you.
If the same counterfeit chip card was dipped in an EMV-compliant terminal, the card issuer generally carries the counterfeit fraud liability instead.
Issuers often side with cardholders in disputes. Without EMV, you give up an important defense against counterfeit fraud at the point of sale.
3 steps to EMV compliance
If you’re not EMV compliant yet, you’re late to the party. Fortunately, getting there has never been easier:
- Contact your processor and POS provider. If they’re different companies, talk to both.
- Check every terminal. Make sure each one accepts chip cards, PIN and contactless payments.
- Upgrade your POS software. Make sure it meets EMV standards. Mobile card readers need chip support too.
How much does EMV compliance cost?
The cost is modest. You pay for new terminals and initial software updates, and POS software updates are often free.
Skipping EMV hardware to save a few hundred dollars could cost you thousands later.
In general, card-present processing rates don’t change based on whether a card is dipped or swiped. Check your processor’s pricing for any non-EMV fees.
EMV compliance vs. PCI compliance
EMV and PCI are two of the most important terms in card acceptance. PCI compliance is short for PCI DSS, the Payment Card Industry Data Security Standard.
PCI DSS is a set of security standards for handling card data. It applies to every way you accept cards: in person, online, PIN, signature and chip.
Many processors help with PCI compliance, but as the business owner it’s still your responsibility. EMV and PCI work together to protect your business and your customers, so you need both.
Final thoughts on EMV compliance
EMV compliance is now a must in card processing. Upgrading to chip readers is one of the best ways to fight counterfeit card fraud.
Beyond cost and liability, outdated technology reflects poorly on your business. Customers expect to dip or tap their cards.
Questions about your terminals or processing statement? Talk to VeriFee.
