BANKS that are not EMV-compliant have until June 30 next year to adopt the more secure chip-based technology, the central bank said.
EMV is the global standard for chip-based credit and debit cards that are supposedly more difficult for fraudsters to hack into, compared with magnetic strip cards. The embedded chip contains unique transactions details that are activated each time the card is used. It is also protected by additional layers of security.
“A hard deadline of 30 June 2018 shall be imposed for BSFIs [Bangko Sentral ng Pilipinas (BSP) supervised financial institutions] to fully comply with the BSP EMV migration requirement,” the central bank said in supplemental guidelines released on Thursday.
The BSP issued Circular 808 in August 2013, giving banks and other financial institutions more than three years to upgrade their systems in the shift toward EMV technology by January 1 this year.
However, latest BSP estimates showed that after January 1, the migration to EMV from magnetic strip cards was only 90 percent complete with around 76 million cards still to be replaced.
The BSP said the final deadline is meant to push the banking industry toward fully adopt EMV technology at a faster pace.
The guidelines prescribe a hard deadline for compliance as well as clearly defined consequences for non-compliant institutions. Failure to do so will subject BSFIs to monetary sanctions provided under relevant provisions of the Manual of Regulations for Banks and Manual of Regulations for Non-Bank Financial Institutions.
The BSP said non or partially-compliant BSFIs are mandated to book provisions for probable fraud losses starting September 30, 2017 until full compliance is achieved.
“BSFIs should use the product of a loss probability rate and the outstanding balance of prepaid and debit cards or the available credit limit for credit cards beginning end of quarter 30 September 2017,” it said.
The central bank said loss probability rate can be arrived at using any or a combination of historical counterfeit card fraud losses; customer behavior; nature of products, services, and customer relationships; and degree or extent of EMV compliance of card-accepting terminals.
“At the end of each quarter, recorded provisions should be reviewed and adjusted to reflect the current best estimate,” the BSP said.
BSFIs are expected to develop strategies to entice or force clients to replace their old cards with EMV cards such as deactivation of existing cards, offering rewards or freebies, and liability shift for skimming incidents.
“To further strengthen consumer protection and complaints handling and resolution as prescribed under BSP Circular No. 936 dated 28 December 2016, the actual restitution of cardholders with valid claims should take place within the 10-day resolution timeline for complaints and requests for chargeback as a result of counterfeit fraud,” the central bank said.