Transaction Security. Mastercard M-TIP. Customer Guide. Oct 2016 v2.3

Transaction Security Mastercard M-TIP Customer Guide Oct 2016 v2.3

UL Transaction Security UL Transaction Security stands for one or more of the following entities: UL TS B.V. (Leiden, Netherlands), UL VS Ltd (Basingstoke, UK), UL Transaction Security Pty Ltd (Melbourne, Australia), UL Transaction Security Ltd (Edinburgh, UK), UL TS Pte Ltd (Singapore), UL TS Inc (St. Paul, MN, USA), UL TS FZE (Dubai, UAE) For contact details, please see: www.ul-ts.com 2016 UL All rights reserved. May not be copied or distributed without permission.

Table of Contents 1 INTRODUCTION... 4 2 THE M-TIP SERVICE... 5 2.1 Introduction... 5 2.2 Two variants of M-TIPs... 5 2.3 When to do a regular M-TIP?... 6 2.4 When to do a Fast Track M-TIP?... 7 3 REGULAR M-TIP PROCESS... 9 3.1 Process steps... 9 3.2 Additional Iteration for M-TIP... 11 3.3 Pricing structure for regular M-TIP... 11 4 FAST TRACK M-TIP PROCESS... 12 4.1 Process steps... 12 4.2 Additional Iteration for Fast Track M-TIP... 14 4.3 Pricing structure for Fast Track... 15 5 HIGH PRIORITY M-TIP... 16 6 M-TIP SUPPORT... 17 A.1 LOCAL OFFICES FOR M-TIP SUPPORT... 18 Final 3/18 Oct 2016 v2.3

1 Introduction A good preparation is essential for a successful Mastercard Formal Approval step. UL Transaction Security (UL TS) can be your partner throughout the full process: from definition, via vendor selection and technical consultancy to testing and certification. UL also can deliver the required test tools for Mastercard terminal acquiring and can provide dedicated training courses. The Mastercard Formal Approval Services represent one module within a range of services UL offers to Acquirers and Issuers. Mastercard imposes acquirers introducing a new terminal to go through Terminal Integration Process (M-TIP) Formal Approval Services of Mastercard. This process is required for acquirers to obtain an approval, i.e. Letter of Approval (LoA), indicating that the POS terminal, ATM, Bank Branch Terminal, CAT3 terminal or mpos terminal is Mastercard approved. The main purpose is to make sure the terminal products accepting Mastercard branded payment applications, meet the minimum quality and interoperability requirements specified by Mastercard. UL has been accredited by Mastercard as a Mastercard Formal Approval Service Provider. Together with Mastercard qualified testing/certification tools (CPV and M-TIP), UL is offering a modulated service which covers the entire scope to ensure an efficient and effective approval process. This Customer Guide describes the process and the steps to take for M-TIP 1. The pricing structure of the service can be found in the order form. Please contact ul.ts.tip@ul.com or your sales contact at UL for the latest version of the order form. Key Benefits of UL TS With the extensive experience and in-depth knowledge of UL TS of nearly 20 years in the area of chip / payment technology and personalization processes, UL supports you through the entire Formal Approval Process. Not only by performing the M-TIP (and CPV) Formal Approval Service, but also through On Site services, support via telephone and email with all the steps to be taken. This increases the quality of your product, and reduces the number of iterations for the validation and therefore your time to market. Covering the complete process and procedures, we can offer you one-stop shopping to implement your new card product or mobile device, payment terminal or ATM successfully. 1 Some parts of the text in this document have been obtained from the Mastercard M-TIP Process Guide. For a full description and explaination of the M-TIP Process, please refer to the latest verion of this Mastercard document, which can de found on Mastercard Connect. Final 4/18 Oct 2016 v2.3

2 The M-TIP service 2.1 Introduction When you as an acquirer want to implement a new terminal in your payment network, Mastercard requires you to perform several formal approvals. The Terminal Integration Process (M-TIP) is an essential step in your implementation project for contact and contactless Point of Sales/Services Terminals (POS), mpos (Mobile POS), Bank Branch Terminals (BBT), Cardholder Attended Terminals (CAT) and Automated Teller Machines (ATM). M-TIP is a process designed to test a terminal in a replica of its future production environment. Therefore the M-TIP process tests not only the terminal but also the intermediate connections from terminal to acquirer host system and the interface of the acquirer host system with the Mastercard Network, as depicted below in Figure 1. We call this system under test an Acquirer Deployment. Figure 1 System under test, the so called Acquirer Deployment, that is subject to M-TIP is not only consisting of the terminal. 2.2 Two variants of M-TIPs The M-TIP process comes in two flavors: Figure 2 Two flavors of M-TIP The regular M-TIP process makes sure that your acquirer deployment complies with the latest brand requirements of Mastercard and is not affected by known field interoperability issues. For Final 5/18 Oct 2016 v2.3

this purpose a set of test cases consisting of functional tests and field interoperability tests need to be executed. Fast Track M-TIP is the lighter variant of the regular M-TIP that allows you to obtain, with no testing or with a minimal amount of testing, an M-TIP Letter of Approval for acquirer deployments identical to the ones already tested. Only when your acquirer deployment complies with the rules defined by Mastercard for Fast Track M-TIP, you are eligible to enroll for Fast Track M-TIP. We can help you defining whether your acquirer deployment is eligible for Fast Track M-TIP. Note that for a dual interface (i.e. a contact and contactless) terminal, you have to order a Contactless M-TIP for the contactless interface plus an M-TIP for the contact interface. For a dual interface terminal, the hardware and software in the terminal must remain unchanged when an M-TIP is done for each interface. 2.3 When to do a regular M-TIP? When implementing a terminal, you as an acquirer are required by Mastercard to perform a successful M-TIP in the following cases (as defined in the Mastercard M-TIP Process Guide): - First time deployment of a particular brand (Mastercard, Maestro or Cirrus) - A major upgrade to the terminal kernel software, application software, terminal-toacquirer communication software, or a specific terminal configuration. For a list of what is considered being a Major Upgrade, please refer to the latest Mastercard M-TIP Process Guide). - Modification to the Acquirer deployment that affects transaction message mapping between the terminal and the acquirer host that interfaces with Mastercard. - Upon Mastercard s request. - Upgrade to support a contactless interface When a contact terminal, that already passed a contact M-TIP, is upgraded with a contactless interface, the number of regular M-TIPs to pass depends on the contactless configuration. In the Letter of Approval for the terminal is status what the configuration of the contactless interface is. Depending on this configuration, when upgrading to support the contactless interface, the M-TIP for the contact interface might need to be redone, see Table 1. Contactless configuration Contact Interface Contactless Interface Fully Integrated terminal Redo Contact M-TIP Perform Contactless M-TIP Transparent Contactless card reader Redo Contact M-TIP Perform Contactless M-TIP Intelligent Contactless reader Not required (contact LoA is still valid for this configuration) Perform Contactless M-TIP Table 1 Configuration of contactless interface might impact validity of the Contact M-TIP of the terminal deployment Final 6/18 Oct 2016 v2.3

For above scenarios a regular M-TIP is mandatory. In some cases the lighter variant Fast Track may apply. Please refer to When to do a Fast Track M-TIP? in Chapter 2.4. Additional M-TIP not required Additional M-TIPs are not required for terminal deployments that have identical EMVCo Level 1 approval or EMVCo Level 1 approval with differences classified as minor as defined by EMVCo, and have identical: - EMV Kernel - EMVCo Level 2 terminal configuration (for contact M-TIP) or Contactless application (for contactless M-TIP) - Payment application software including the terminal-to-host protocol - Terminal settings including, but not limited to, Terminal Action Codes, Terminal Type, and Cardholder Verification Method (CVM) lists above and below CVM limit (for contactless M-TIP) - List of Mastercard brands - Country of deployment See Chapter 3 for more information on the steps to take. 2.4 When to do a Fast Track M-TIP? To avoid that acquirers have to retest an identical acquirer deployment that has been successfully tested previously. This previous M-TIP can be used as a Reference M-TIP project during the Fast Track M-TIP process. Reasons to apply for a Fast Track M-TIP could be: - You want to deploy in a given country a specific Acquirer Deployment for which you already have M-TIP approval in another country. - You are an affiliate acquirer using the infrastructure from your acquirer principal and want to deploy an M-TIP approved deployment, including the same acquiring system, already used by another affiliate acquirer. - You are using an MSP that has already obtained an M-TIP LoA with another acquirer using an identical deployment and acquiring system. Fast Track M-TIP leverages testing that has been successfully performed for an identical acquirer deployment, meaning that you only need to do those functional tests and those field interoperability tests that were created or modified after the Reference M-TIP was obtained and that apply to your deployment, if any. Conditions for Fast track M-TIP To perform Fast Track M-TIP and for the terminal deployment to be eligible for Fast Track M- TIP, some criteria need to be met: - The terminal is operated by the same MSP as the terminal that was approved in the Reference M-TIP. - The MSP operates all acquiring functions for the acquirer and the same acquiring functions as for the acquirer in the Reference M-TIP. Both terminals (Reference and new) have the same Brand, Model and Type Approval Level 2 references (EMVCo Level 2 terminal configuration (for contact M-TIP) or Contactless application (for Contactless M-TIP) Final 7/18 Oct 2016 v2.3

- The interfaces between the terminal and the MSP are the same in the Fast Track M- TIP and in the Reference M-TIP. Fast Track based on Fast Track A Fast Track M-TIP can also be based on Fast Track M-TIP if it satisfies the criteria of Fast Track process as stated above. The following documents need to be provided in this case: 1. If Fast Track is a M-TIP Questionnaire based Reference M-TIPs - M-TIP Questionnaire of the original full M-TIP, i.e. Reference M-TIP of all the previous Fast Track M-TIP(s) - Complete TSE package (.tsez format) of new Fast Track M-TIP - Letter of Approval of the Reference Fast Track M-TIP 2. If Fast Track is with a TSE-based reference M-TIP - Complete TSE package (.tsez) of new Fast Track M-TIP - Final.tsez package of the referenced MTIP and the M-TIP LoA s of all the Reference M-TIP s of the original M-TIP, i.e. of the Reference M-TIP of all the previous Fast Track M-TIP(s) to assess the Fast Track M-TIP eligibility. - Letter of Approval of the Reference Fast Track M-TIP See Chapter 4 for more information on the steps to take. Final 8/18 Oct 2016 v2.3

3 Regular M-TIP process 3.1 Process steps When implementing a terminal, you as an acquirer are required by Mastercard to perform a successful M-TIP, resulting in a formal Letter of Approval (LoA) granted by Mastercard. The regular M-TIP process consists of the following steps: Figure 3 The steps of the M-TIP process. Steps indicated in red are to be taken by the customer, the 'blue' steps are done by UL. Each single step of Figure 3 will be explained in more details on the following pages. Step 1: Preparation of forms When initiating a formal M-TIP service with UL, you need to complete and sign the M-TIP Order Form, and send it to UL via email ul.ts.tip@ul.com. The other entity which is relevant is the TIP TSE file. TSE is a Mastercard developed application software, packaged as an executable file. TSE need to be install on system including the latest version of the Test Set. The Test Set contains all information related to test plan generation, hence it is of the utmost importance that the most recent one is used. TSE tool and latest version of the Test Set is provided by Mastercard via Mastercard Connect. Please note that in TSE, the same M-TIP session can be used to test both Contact and Contactless interfaces. You can also request the latest version of the TSE Tool and Test Set from UL. Final 9/18 Oct 2016 v2.3

Step 2: Generate test cases Step 3: Execute tests Step 4: Send Test Results to UL By completing the information requested by the TSE tool (i.e. Acquirer details and the Terminal and Acquirer deployment details), a list of required M-TIP test cases is automatically generated and can be viewed in thetest List View. An M-TIP Tracking Number is also generated at this moment and is displayed in the header of the TSE Tool. Upon your convenience, you can send the TIP TSE file to UL for a terminal reference check, prior to starting with testing. During this reference check UL will check the validity of the applicable Letter of Approvals. Reference check will also be performed during the validation of the Test Results. In this step, you prepare your infrastructure for testing, specifically the connection of the terminal under test to the acquirer infrastructure and the acquirer infrastructure to the Mastercard network simulator. You will execute the test cases as generated by the TIP TSE Tool, and manually update the status of Pass Criteria intse. For customers using the Collis Brand Test Tool during test execution, the testresults can automatically be analyzed and the status of Pass Criteria will automatically be updated in the TSE. Once all the tests have been executed successfully you can submit the results to UL. For this, attach all necessary logs to the TSE file and then create a complete package using TSE to export all the test results in a zip file named with the TIP Tracking Number (with the extension.tsez) containing: TIP Tracking Number Acquiring environment Terminal identification & approvals reference Terminal configuration Test plan & test results Test log files (Card Terminal and MAS logs) Waiver / variance files (if applicable) The entire tests set Step 5: Validate Test Results Based on the documents that you sent us in step 4, UL will analyze and validate whether the results comply with the Mastercard specifications, brand rules and local rules and whether an M-TIP Letter of Approval can be granted. In the TIP TSE, UL will give the result of the analysis per test case. Per test case it is indicated whether the test case was considered as passed or failed i.e. retesting a particular test case, or pending so that appropriate Final 10/18 Oct 2016 v2.3

Step 6: Providing Results counter measures should be taken, such as sending missing log files, or requesting a variance or waiver (for which the customer needs to contact chip_waivers@mastercard.com). UL will send the TIP Validation report (.tser format) containing the findings of this test result validation session, with any remark, warning, restriction, failed test that have been found with the results to you and inform you about the next steps to be taken. In case the outcome of step 5 is positive on all test cases, the M-TIP is successful. UL will create the Letter of Approval (LoA) and ask Mastercard for signing the LoA. In all other cases, UL provides you with all findings and suggestions for improvement and a new iteration of testing must be performed (i.e. go back to step 3) where you need to retest failed test cases or all of the test cases (as indicated in the TIP TSE validation report). For more information, see section 3.2. Step 7: Issuance of Letter of Approval When your deployment successfully finished and passed M-TIP, UL will send you the signed Letter of Approval. The project will be closed, meaning UL will update the reporting to Mastercard with the results of the project and an invoice is created for the services delivered. 3.2 Additional Iteration for M-TIP In the unfortunate case that the verdict of the step 5 (Validate Test Results) is unsuccessful; you are required to perform an additional iteration for Formal M-TIP Approval. This means, you must solve any issues reported, and again perform the required M-TIP test cases or possibly request waivers or variances from Mastercard. You then re-send the updated TSE package to UL for an additional Test Results Analysis as described in step 4. 3.3 Pricing structure for regular M-TIP The pricing fee for regular M-TIP services is given in the latest Order Form document. Please contact our sales representative or send an email to ul.ts.tip@ul.com. Final 11/18 Oct 2016 v2.3

4 Fast Track M-TIP process 4.1 Process steps The Fast Track M-TIP process consists of the following steps: Figure 4 The steps of the Fast Track M-TIP process. Steps indicated in red are to be taken by the customer, the 'blue' steps are done by UL. Each single step of Figure 4 will be explained in more details on the following pages. Step 1: Preparation of forms When initiating a M-TIP service with UL, you need to complete and sign the M-TIP Order Form, and send it to UL via email ul.ts.tip@ul.com. The other forms which are relevant when ordering a Fast Track M-TIP are: UL s Fast Track Conditions Form. This form can be obtained via ul.ts.tip@ul.com. This document addresses required confirmation about your terminal deployment, and is required for the Fast Track M-TIP service. The TIP TSE Tool including the latest version of the Test Set is provided by Mastercard via Mastercard Connect. You can also request the latest version of this Toolat UL. Final 12/18 Oct 2016 v2.3

Step 2: Execute tests In this step, you prepare your infrastructure for testing, specifically the connection of the terminal under test to the acquirer infrastructure and the acquirer infrastructure to the Mastercard network simulator. By completing the information requested (e.g. Acquirer details and the Terminal and Acquirer deployment details) in the TIP TSE, a list of required M-TIP test cases is automatically generated in the Test List View of TSE. The M-TIP Tracking Number is also generated, and is displayed on the top banner in TSE Tool. The tests that required to be performed depends on the following scenarios;. If Fast Track is based on TSE based Reference M-TIP, the test cases for which Test results are cleared in TSE Test List View, must be run. The new test cases are marked by the modification date in the Updated column and by a star in the Changed column of the Test List view. See TSE online help for more details. If new M-TIP is TSE based while Reference M-TIP is based on M- TIP Questionnaire, Mastercard published the list of tests per M-TIP Questionnaire version in the Fast Track M-TIP Rules. This List is available in the TSE online help of the latest version of the Test Set. To see the list, in TSE click on Help. So when a test from that list is present in the Test List, it must be executed. You will execute those test cases, and manually update the outcome of Test results in TSE. For customers using the Collis Brand Test Tool during test execution, the tool has a compile function which will automatically analyze the test results and update the status of Pass Criteria in the TIP TSE Tool. Step 3: Send forms and test results to UL Now, the next thing to do is to send the following documents to UL: The final M-TIP Questionnaire or TSE package (.tsez) of the successfully finished Reference M-TIP Documentation about any waiver used or granted in the scope of the Reference M-TIP Letter of Approval for the Reference M-TIP Completed UL form related to Fast Track The test results of the test cases indicated in the TSE online help of the latest version of the Test Set to your Fast Track M-TIP, including: o The TIP TSE package (.tsez) with the results of the test cases applicable for this Fast Track o Mastercard simulator log files o EMV card terminal log files Any Waiver or Variance granted by Mastercard, if applicable Final 13/18 Oct 2016 v2.3

Step 4: Validate Test Results Step 5: Providing Results In this step, UL will analyze whether your deployment meets the requirements for Fast Track M-TIP. If additional testing was required for the Fast Track deployment, based on the documents that you sent in step 3, UL will analyze and validate whether the test results comply with the Mastercard specifications, brand rules and local rules and whether an M-TIP Letter of Approval can be granted. In the TIP TSE validation report, UL will give the result of the analysis per test case. Per test case it is indicated whether the test case was considered as pass, failed, or that appropriate countermeasures should be taken, such as retesting of that particular test case, sending missing log files, or requesting a variance or waiver (for which the customer needs to contact chip_waivers@mastercard.com). UL will send the TIP TSE Validation report (.tser) with the results to you and inform you about the next steps to be taken. In case the outcome of step 4 is positive on all test cases, the M-TIP is successful. UL will create the Letter of Approval (LoA) and ask Mastercard for signing the LoA. In all other cases, UL provides you with all findings and suggestions for improvement and a new iteration of testing must be performed (i.e. go back to step 2) where you need to retest some or all of the test cases (as indicated in the TSE Validation Report. For more information, see section 4.2 Step 6: Issuance of Letter of Approval When your deployment successfully finished and passed Fast Track M-TIP, UL will send you the signed Letter of Approval. The project will be closed, meaning UL will update the reporting to Mastercard with the results of the project and an invoice is created for the services delivered. 4.2 Additional Iteration for Fast Track M-TIP In case the verdict of the step 3 is unsuccessful; you are required to perform an additional iteration for Fast Track M-TIP. This means, you must solve any issues reported, and again perform the required M-TIP test cases or possibly request waivers or variances from Mastercard. You then re-send the updated TIP TSE package file to UL for an additional Test Results Analysis as described in step 3. Please note that for a dual interface terminal, the additional iteration is only required within the Fast Track M-TIP service for the interface that is subject to that Fast Track M-TIP service. For example in case of a dual interface terminal, the contactless Fast Track M-TIP fails the first time Final 14/18 Oct 2016 v2.3

then only an iteration for the contactless Fast Track M-TIP is needed but not an additional iteration for the contact interface. 4.3 Pricing structure for Fast Track The pricing fee for Fast Track M-TIP services is given in the latest Order Form document. Please contact our sales representative or send an email to ul.ts.tip@ul.com. Final 15/18 Oct 2016 v2.3

5 High priority M-TIP In certain cases an Acquirer may prefer the M-TIP service to be delivered with high priority. High priority means that the service is delivered in a guaranteed shorter time frame compared to the maximum delivery time of a normal M-TIP service. This duration represents the time UL spends; possible time required for Mastercard support is excluded. Please note that Mastercard has 48 hours to respond to such support requests. In case only an additional iteration of the service is ordered as high-priority, only the fee for the additional iteration will be charged as high priority. Please contact your UL contact person for more information about the high priority M-TIP formal approval service and the timelines for your project. Final 16/18 Oct 2016 v2.3

6 M-TIP Support During or prior to the M-TIP or Fast Track M-TIP service, you might want to have access to the latest chip or specifications expertise, e.g. to find out about the applicable regional rules and mandates, or about allowed settings in the terminal deployment for your product. Or if you want to know why certain issues appear in the TIP TSE validation result for your product and want to know how to solve those, you can ask the UL team for support. UL offers you M-TIP support for all your questions related to settings and specifications upon initiation of your M-TIP project or during the delivery of the M-TIP service. For more details on the pricing, please refer to the Order Form document, or ask your local representative. Final 17/18 Oct 2016 v2.3

A.1 Local offices for M-TIP support For Europe: UL Transaction Security B.V. Dept. Mastercard FAS Test Center De Heyderweg 2 2314 XZ Leiden THE NETHERLANDS For Middle East and Africa: UL TS FZE Nucleotide building, Unit 222 Dubiotech P.O. Box 341060 Dubai, U.A.E Tel: +971 4 558 5900 For North America and Canada: UL Transaction Security Dept. Mastercard FAS Test Center 47173 Benicia St Fremont, CA 94538 U.S.A. For Asia and Pacific region: UL Transaction Security Dept. Mastercard FAS Test Center 1 Fusionopolis Walk #10-01 Solaris South Tower Singapore 138628 SINGAPORE For Latin America and Caribbean: UL Transaction Security Dept. Mastercard FAS Test Center Rua Fidêncio Ramos, 195-2 andar Vila Olímpia, 04551-010 São Paulo - SP BRAZIL Final 18/18 Oct 2016 v2.3