cpv manual jan 2009

Card PersonalizationValidation Guide

January 2009

Proprietary Rights The information contained in this document is proprietary andconfidential to MasterCard International Incorporated, one or more ofits affiliated entities (collectively “MasterCard”), or both.

This material may not be duplicated, published, or disclosed, inwhole or in part, without the prior written permission of MasterCard.

Trademarks Trademark notices and symbols used in this document reflect theregistration status of MasterCard trademarks in the United States.Please consult with the Customer Operations Services team or theMasterCard Law Department for the registration status of particularproduct, program, or service names outside the United States.

All third-party product and service names are trademarks or registeredtrademarks of their respective owners.

Billing For printed documents, MasterCard will bill principal members.Please refer to the appropriate MasterCard Consolidated BillingSystem (MCBS) document for billing-related information.

Information AvailableOnline

MasterCard provides details about the standards used for thisdocument—including times expressed, language use, and contactinformation—on the Member Publications Support page availableon MasterCard OnLine®. Go to Member Publications Support forcentralized information.

©2009 MasterCardCPV January 2009 • Card Personalization Validation Guide

../Support/Menu_Support.html

Summary of ChangesCard Personalization Validation Guide, January 2009

To locate changes online, search on the date associated with this revision. On the Adobe toolbar,click Find. In the Find box, type Jan 2009, and then press ENTER. To move to the next revisionbar, press ENTER again.

Description of Change Where to Look

To ensure that members have access to current contact information and standardsused for MasterCard documentation, MasterCard has created the MemberPublications Support page. As a result, MasterCard has removed some contentfrom this document, including times expressed, language use, and contactinformation, which members now can find online.

Member PublicationsSupport page onMasterCard OnLine®

The business process diagrams have been updated to concentrate on thechoreography between you (the issuer) and the other entities. The activitiesperformed by other entities are now shown as a black box instead of as abstracttasks/activities.

Entire document

The CPV process for PayPass—Mag Stripe is now detailed in a separatedocument (Card Personalization Validation Guide for PayPass—Mag Stripe,which is available on www.paypass.com).

Chapter 1

The physical cards need to be shipped to a different address from January 1,2009.

Chapter 1 > CPVContact Information

The card image and the physical cards are to be submitted in parallel. Chapter 4

©2009 MasterCardCard Personalization Validation Guide • January 2009 1

http://www.paypass.com

Table of Contents

Chapter 1 Introduction.................................................................................... 1-iPurpose.................................................................................................................................... 1-1

Audience.................................................................................................................................. 1-1

What is Card Personalization Validation? ................................................................................. 1-1

Products Subject to Card Personalization Validation................................................................ 1-2

When To Do Card Personalization Validation.......................................................................... 1-3

Prerequisites for Doing Card Personalization Validation.......................................................... 1-3

CPV Contact Information ......................................................................................................... 1-4

Related Information ................................................................................................................. 1-5PayPass.............................................................................................................................. 1-5

Business Process Diagram Conventions................................................................................... 1-6

Chapter 2 The CPV Process ............................................................................. 2-iImplementation........................................................................................................................ 2-1

Overview ................................................................................................................................. 2-1

Issuer Self-Assessment ............................................................................................................. 2-1

Sample Submission .................................................................................................................. 2-2

Change Notification Submission .............................................................................................. 2-2

Chapter 3 Issuer Self-Assessment .................................................................. 3-iOverview ................................................................................................................................. 3-1

Process..................................................................................................................................... 3-1

Changes That Can Be Considered ‘Minor’ ............................................................................... 3-1Changes in Product Implementation.................................................................................. 3-2Changes to Card Risk Management Personalization Parameter Settings ............................ 3-2Changes to EMV Data Personalization Parameter Settings................................................. 3-2Changes to Certificate and Key Data Personalization Parameter Settings .......................... 3-2Changes to Variables Personalization Parameter Settings .................................................. 3-2Changes to Other Data Personalization Parameter Settings ............................................... 3-3Changes to Thresholds ...................................................................................................... 3-3Additional BIN(s) ............................................................................................................... 3-3Changes to a Co-Residing Application............................................................................... 3-3

Chapter 4 Sample Submission........................................................................ 4-iOverview ................................................................................................................................. 4-1

Process..................................................................................................................................... 4-2

Chapter 5 Change Notification Submission................................................... 5-i

©2009 MasterCardCard Personalization Validation Guide • January 2009 i

Table of Contents

Overview ................................................................................................................................. 5-1

Process..................................................................................................................................... 5-1

Appendix A Data Packages.............................................................................A-iIntroduction .............................................................................................................................A-1

Format Requirements...............................................................................................................A-1

Data Package 1—Card Risk Management ................................................................................A-2

Data Package 2—EMV Data.....................................................................................................A-4

Data Package 3—Cardholder Data ..........................................................................................A-5

Data Package 4—Certificate and Key Data ..............................................................................A-5

Data Package 5—Variables ......................................................................................................A-6

Data Package 6—Other Data, Minor Impact............................................................................A-7

Data Package 7—Other Data, Major Impact ............................................................................A-8

Data Package 8—Thresholds ...................................................................................................A-9

Appendix B How To Complete the CPV Sample Submission Form.............. B-iPrerequisites ............................................................................................................................B-1

Completing the CPV Sample Submission Form .......................................................................B-1

Glossary ................................................................................................................ 1

©2009 MasterCardii January 2009 • Card Personalization Validation Guide

Chapter 1 IntroductionThis chapter provides an introduction to Card Personalization Validation, detailing what it is, whatproducts are subject to it, and when it should be done.

Purpose.......................................................................................................................................... 1-1

Audience........................................................................................................................................ 1-1

What is Card Personalization Validation? ....................................................................................... 1-1

Products Subject to Card Personalization Validation...................................................................... 1-2

When To Do Card Personalization Validation................................................................................ 1-3

Prerequisites for Doing Card Personalization Validation................................................................ 1-3

CPV Contact Information ............................................................................................................... 1-4

Related Information ....................................................................................................................... 1-5

PayPass.................................................................................................................................... 1-5

Business Process Diagram Conventions......................................................................................... 1-6

©2009 MasterCardCard Personalization Validation Guide • January 2009 1-i

IntroductionPurpose

PurposeCard Personalization Validation is a process to ensure that a TechnicalProduct has been personalized in such a manner that it is compliant with therecommendations and the mandates expressed in the appropriate documents.This process validates that every Technical Product bearing a MasterCardbrand mark offers the correct level of service, acceptance, interoperability,performance, and security to cardholders and acceptance locations. Jan 2009

NOTE

For PayPass – Mag Stripe the Card Personalization Validation process is detailed in a separateguide, the Card Personalization Validation Guide for PayPass – Mag Stripe, which is availableon www.paypass.com.

AudienceMasterCard provides this guide for issuers, and their authorized agents.Specifically, the following personnel should find this guide useful:

• Program Managers and Project Managers for issuers implementing new oramending existing Technical Products bearing a MasterCard brand mark

• Personnel executing an instance of the Card Personalization Validationprocess

What is Card Personalization Validation?Card Personalization Validation is a process to ensure that a TechnicalProduct has been personalized in such a manner that it is compliant with therecommendations and the mandates expressed in the applicable documents:

• M/Chip Requirements

(available on Member Publications, Smart Card category)

• M/Chip Personalization Data Specifications and Profiles


• MasterCard PayPass – M/Chip Issuer Implementation Requirements Guide

(available on www.paypass.com)

• PayPass – M/Chip Flex Issuer Implementation Guide


• Maestro PayPass Issuer Implementation Guide


• MasterCard CPV Issuer Guide to Parameter Management


By performing Card Personalization Validation you ensure that your TechnicalProduct that bears a MasterCard brand mark offers the correct level of service,acceptance, interoperability, performance, and security to your cardholders andacceptance locations.

©2009 MasterCardCard Personalization Validation Guide • January 2009 1-1


http://www.PayPass.com



IntroductionProducts Subject to Card Personalization Validation

NOTE

Where applicable, data held on the magnetic stripe itself is not subject to any form of testing orvalidation, except for consistency checks against the magnetic stripe equivalent data that is heldon the chip.

Products Subject to Card Personalization ValidationCard Personalization Validation is applied to Technical Products that have:

• A contact interface

• A contactless interface (PayPass)

The following products are therefore applicable for Card PersonalizationValidation:

• M/Chip: These products have a contact interface and a traditional magneticstripe; CPV validates the personalization of the Application(s) via thecontact interface.

• PayPass – M/Chip: These products, when in ID-1 form factor, have acontact interface, contactless interface, and a traditional magnetic stripe:CPV validates the personalization of the Application(s) via the contact andcontactless interfaces; when in a non ID-1 form factor, CPV validates thepersonalization of the Application(s) via the contactless interface only.

• PayPass – M/Chip Flex: These products, when in ID-1 form factor, havea contact interface, contactless interface, and a traditional magnetic stripe;CPV validates the personalization of the Application(s) via the contact andcontactless interfaces; when in a non ID-1 form factor, CPV validates thepersonalization of the Application(s) via the contactless interface only.

• PayPass – Mag Stripe: These products only have a contactless interface;CPV validates the personalization of the Application(s) via the contactlessinterface.

NOTE

For PayPass – Mag Stripe the Card Personalization Validation process is Jan 2009detailed in a separate guide, the Card Personalization Validation Guide forPayPass – Mag Stripe, which is available on www.paypass.com.

For products that contain PayPass – Mag Stripe and another product, you Jan 2009will need both the Card Personalization Validation Guide for PayPass – MagStripe and this guide to perform Card Personalization Validation for eachproduct as applicable.

• Common Payment Application: CPV validates the personalization of theApplication(s) via a contact interface.

• Other Chip Platforms: these products are those Technical Productsbased on non-M/Chip platforms (such as UKIS, VSDC, SECCOS) that bear aMasterCard brand name; CPV validates the personalization of basic EMVdata as described in M/Chip Requirements and no dynamic validationtesting is performed.

©2009 MasterCard1-2 January 2009 • Card Personalization Validation Guide


IntroductionWhen To Do Card Personalization Validation

NOTE

Non ID-1 form factors are known generically as ‘devices’. For clarity, thisdocument refers to all form factors as ‘products’. For historical reasons, somenames retain references to ‘card’, such as ‘Card Issuer Action Code’, ‘CardPersonalization Validation’ and so forth.

When To Do Card Personalization ValidationCard Personalization Validation is a mandatory process and must be invokedwhen you do any of the following:

• You are issuing a new Technical Product. If this is being done in thecontext of a Chip Migration Project refer to Migrating Card Issuance toChip for details of where Card Personalization Validation is done in themigration process; similarly, when adding PayPass to an existing M/Chipimplementation, refer to Adding PayPass to M/Chip Issuance.

• You have an existing Technical Product and want to amend any of thepersonalization characteristics (excluding cardholder related data andexpiration dates as specified in Table A.5).

• You have an existing Technical Product and must amend the personalizationcharacteristics due to changes in M/Chip Personalization Data Specificationsor PayPass Personalization Data Specification or as the result of anOperations Bulletin.

• You have an existing Technical Product and want to add anotherapplication, such as CAP, to it.

• You have an existing Technical Product and want to change the VendorProduct.

• You have an existing Technical Product and want to change thePersonalization Bureau.

Prerequisites for Doing Card Personalization ValidationFor M/Chip (including PayPass – M/Chip and PayPass – M/Chip Flex) and CPATechnical Products there are two prerequisites for CPV:

• You have selected a Product Manufacturer and Personalization Bureau thathave completed the MasterCard Global Vendor Certification Program.

• You have selected an approved M/Chip, PayPass, or CPA product.

Certified vendors are listed in the Certified Vendors (for Card ProductionServices of any MasterCard, Maestro, or Cirrus Branded Card) document that isregularly published as an attachment to the Global Security Bulletin, availableon MasterCard OnLine®.


IntroductionCPV Contact Information

Depending on your requirements, the approved product list is located asfollows:• M/Chip: M/Chip approved products are listed in the relevant table ofM/Chip Approved Products that is published on MasterCard OnLine®. Thelist of approved products only includes product information from vendorswho have requested to be listed and have provided product information toMasterCard.

NOTE

If you want to use a product that is not listed (because not all approvedproducts may be listed) you must obtain proof of approval from yourvendor. If the vendor cannot provide all related documents, please [email protected].

• PayPass – M/Chip and PayPass – M/Chip Flex: A copy of the PayPassVendor Product Letter of Approval for each approved product is publishedon www.paypass.com.

• Common Payment Application (CPA): A copy of the CPA VendorProduct Letter of Approval for each approved product is published onwww.emvco.com.

M/Chip, PayPass – M/Chip, PayPass – M/Chip Flex, and CPA productsoffer many opportunities for customization during the initialization or thepersonalization phase. Some customization changes are considered as critical,and in these circumstances any existing approval granted to the selectedproduct may not apply.

Examples of critical customization changes are:• Changes to the interface bytes of the Answer to Reset (where the productallows this)

• Creation of data sharing between Applications

MasterCard recommends that you check with your chosen product manufacturerthat the exact configuration that you intend to issue is covered by theproduct approval. If this is not the case, you should anticipate additionaltesting during your project planning. For more information, please [email protected] or [email protected].

NOTE

If you are intending to use non-M/Chip or PayPass products (such as UKIS, VSDC, SECCOS), you willalso need to contact [email protected] and apply for a waiver.

CPV Contact InformationMasterCard WorldwideCPV Management – Chip Center of ExcellenceChaussée de Tervuren 198AB-1410 [email protected] Jan 2009


mailto:[email protected]


http://www.emvco.com





IntroductionRelated Information

From January 1, 2009, the Physical Cards should be shipped by secure courierto:

FIME Asia Test CentreSuite 807-808, 8th Floor, No. 2, Lane 150, Sec. 5, Sinyi RoadSinyi District, TaipeiTAIWAN [email protected]

Related InformationThe following documents and resources provide information related to thesubjects discussed in this document:

• M/Chip Requirements

• M/Chip Personalization Data Specifications and Profiles

• M/Chip 4 Version 1.0 Common Personalization Specifications

• M/Chip 4 Version 1.1 Common Personalization Specifications

• M/Chip Qualified Test Tools

• Migrating Card Issuance to Chip

Descriptions of these documents are available in the List of Manuals in theMember Publications product on MasterCard OnLine.

Definitions of specific terms used in this document are available in the Glossary.Other terms are explained in the MasterCard Dictionary.

To order MasterCard documents, please use the Ordering Publications tool,available in the Quick Links section on the Member Publications home page,or contact the Customer Operations Services team.

PayPass

The following documents are available via www.paypass.com:

• Card Personalization Validation Guide for PayPass – MagStripe Jan 2009

• MasterCard PayPass – Mag Stripe Issuer Implementation Requirements Guide

• PayPass Personalization Data Specifications

• Adding PayPass to M/Chip Issuance




IntroductionBusiness Process Diagram Conventions

Business Process Diagram ConventionsThe business process diagrams in this guide use the following symbols:

• A pool is used to contain activities within an organization.

• An activity can be atomic (a task) or compound (contain multiple activities).

• An activity is started (or triggered) by a Start Event, a Time-based Trigger, ora sequence or message flow from another activity.

• Sequence flow lines (with solid lines and arrowheads) connect one activityto another, to a gateway or to an end event.

• Gateways signal a split in a process flow or a merger of multiple processflows.

• Message flow lines (with dashed lines and open arrowheads) connectactivities across pools (usually via an artifact).

• A process contains activities interconnected by means of flow lines.


Chapter 2 The CPV ProcessThis chapter provides an overview of the Card Personalization Validation process and a summary ofits subprocesses.

Implementation.............................................................................................................................. 2-1

Overview ....................................................................................................................................... 2-1

Issuer Self-Assessment ................................................................................................................... 2-1

Sample Submission ........................................................................................................................ 2-2

Change Notification Submission .................................................................................................... 2-2


The CPV ProcessImplementation

ImplementationThe CPV Process is a collaboration process involving the following entities:• The Issuer (which is you)• A CPV Service Provider• MasterCard

OverviewThe Card Personalization Validation (CPV) process comprises the followingsubprocesses:• Issuer Self-Assessment• Sample Submission• Change Notification Submission

This following figure shows the process and the sequence flow between its constituentsubprocesses:

Figure 2.1—Card Personalization Validation Process

Issuer Self-AssessmentIn this subprocess you evaluate the Technical Product that you want to issueand choose to either submit samples for testing (Sample Submission) or tosubmit a change notice for assessment (Change Notification Submission).

A prerequisite for being able to do Change Notification Submission instead ofSample Submission is that you have a Change Management System.

This subprocess is detailed in Chapter 3, Issuer Self-Assessment.


The CPV ProcessSample Submission

Sample SubmissionIn this subprocess you contact a CPV Service Provider and complete thenecessary administrative tasks, personalize a sample Physical Card, and create aCard Image from it (using either a Qualified CPV Test Tool or the MasterCardCard Image Extraction Tool). You then send the Card Image by e-mail, andthe Physical Card by secure courier, to a CPV Service Provider who test it forconformance with the appropriate personalization specifications.

You receive a Personalization Compliance Report specifying whether thepersonalization validation was conformant or not.

A fee is charged to you (the issuer) per iteration of testing that is done by theCPV Service Provider for MasterCard branded Applications.

This subprocess is detailed in Chapter 4, Sample Submission.

Change Notification SubmissionIn this subprocess you provide a change list from an existing Technical Productand request an assessment from a CPV Service Provider to use the changedTechnical Product.

This subprocess is detailed in Chapter 5, Change Notification Submission.

NOTE

As a result of the assessment in the Change Notification Submission, you may be requested to do theSample Submission subprocess before the result of the Card Personalization Validation can be given.


Chapter 3 Issuer Self-AssessmentThis chapter details the subprocess where you evaluate the Technical Product that you want toissue or amend and choose to either submit samples for testing or to submit a change notificationstatement for assessment.

Overview ....................................................................................................................................... 3-1

Process........................................................................................................................................... 3-1

Changes That Can Be Considered ‘Minor’ ..................................................................................... 3-1

Changes in Product Implementation........................................................................................ 3-2

Changes to Card Risk Management Personalization Parameter Settings .................................. 3-2

Changes to EMV Data Personalization Parameter Settings....................................................... 3-2

Changes to Certificate and Key Data Personalization Parameter Settings ................................ 3-2

Changes to Variables Personalization Parameter Settings ........................................................ 3-2

Changes to Other Data Personalization Parameter Settings ..................................................... 3-3

Changes to Thresholds ............................................................................................................ 3-3

Additional BIN(s) ..................................................................................................................... 3-3

Changes to a Co-Residing Application..................................................................................... 3-3


Issuer Self-AssessmentOverview

OverviewThe following figure shows the Issuer Self-Assessment subprocess:

Figure 3.1—Issuer Self-Assessment Subprocess

ProcessYou must make an assessment of whether to do Sample Submission or ChangeNotification Submission:

• Case #1: If you have not previously done Card Personalization Validation,you must elect to do Sample Submission, see Chapter 4, Sample Submission.

• Case #2: If you are not deriving your changes from an existing approvedTechnical Product, you must elect to do Sample Submission, see Chapter 4,Sample Submission.

• Case #3: If neither of the above two conditions apply, you are makingchanges permissible in Changes That Can Be Considered ‘Minor’, and youhave a Change Management System, then you can elect to do a ChangeNotification Submission, see Chapter 5, Change Notification Submission.

In all other circumstances, you must elect to do Sample Submission, see Chapter4, Sample Submission.

Changes That Can Be Considered ‘Minor’A change can be considered ‘minor’, and therefore acceptable for you todo Change Notification Submission (see Chapter 5, Change NotificationSubmission), if it meets certain criteria for the type of change that you aremaking.


Issuer Self-AssessmentChanges That Can Be Considered ‘Minor’

Changes in Product Implementation

For MULTOS Products, a minor change is when you migrate from one MULTOSproduct to another, and:• The new MULTOS product is approved by MasterCard• The Application Loading Unit is unchanged• The product settings are unchanged

For non-MULTOS Cards, a minor change is when you migrate from one productto another, and:• Migration occurs within the same manufacturers range of products• No changes to the personalization are required, that is, with the newproduct the personalization will be exactly the same, in terms of:– file structure– data organization– personalization scripts– card settings– padding (if applicable)

Changes to Card Risk Management Personalization ParameterSettings

When changing the Card Risk Management personalization parameters, a minorchange is when you change the parameters, as specified in Data Package1—Card Risk Management, to a value specified in the reference documentationsettings.

Changes to EMV Data Personalization Parameter Settings

When changing the EMV Data Personalization parameters, a minor change iswhen you change the parameters, as specified in Data Package 2—EMV Data,to a value specified in the reference documentation settings.

Changes to Certificate and Key Data Personalization ParameterSettings

When changing the Certificate and Key Data parameters, a minor change iswhen you change the parameters, as specified in Data Package 4—Certificateand Key Data, in such a way that there are no additions or deletions orremainders, or there is no relocation of data within the file structure.

Changes to Variables Personalization Parameter Settings

When changing the Variables personalization parameters, a minor changeis when you change any of the parameters, as specified in Data Package5—Variables.


Issuer Self-AssessmentChanges That Can Be Considered ‘Minor’

Changes to Other Data Personalization Parameter Settings

When changing the Other Data personalization parameters, a minor change iswhen you change any of the parameters, as specified in Data Package 6—OtherData, Minor Impact.

Changes to Thresholds

When changing the Thresholds personalization parameters, a minor change iswhen you change the parameters, as specified in Data Package 8—Thresholds,in such a way that a limit is not altered from zero to a non-zero value or suchthat the velocity check is deactivated. Jan 2009

Additional BIN(s)

When changing the BIN or BINs that you want to use, this is considered a minorchange provided that all other personalization parameters remain the same.

Changes to a Co-Residing Application

When changing an existing, enabled, co-residing application that has links tothe payment application, this is considered a minor change.


Chapter 4 Sample SubmissionThis chapter details the subprocess where you personalize a Technical Product and submit it tothe CPV Service Provider who tests it for conformance with the appropriate personalizationspecifications. You will receive a Personalization Compliance Report as a formal record of the resultof the CPV Test, whether successful or not.

Overview ....................................................................................................................................... 4-1

Process........................................................................................................................................... 4-2


Sample Submission

Overview

Overview Jan 2009

The following figure shows the Sample Submission subprocess:

Figure 4.1—Sample Submission Subprocess


Sample Submission

Process

Process1. Get the CPV Sample Submission Form, available from the same web pageas this process guide.

2. Complete the CPV Sample Submission Form. For more information, refer toAppendix B, How To Complete the CPV Sample Submission Form.

Now start step #3 and step #8 in parallel with each other.


Sample Submission

Process

3. Send the completed CPV Sample Submission Form by e-mail [email protected].

NOTE

The originating e-mail address of this request for all future correspondenceregarding this sample submission.

4. You will receive an e-mail response that contains:

– An Order Form

– The CPV Tracking Number, which is a number that you mustquote on all further correspondence related to this instance of CardPersonalization Validation for your Technical Product(s)

5. Complete and sign the Order Form.

6. Send the completed and signed Order Form to the CPV Service Provideras detailed on the form. A CPV Service Provider is used and you need toestablish the order to cover the provision of their testing services.

NOTE

CPV testing cannot take place until the CPV Service Provider has received andconfirmed the necessary Purchase Order. Therefore, to avoid future delays,you must send the order without delay.

7. The CPV Service Provider will send you a confirmation of your order andan accompanying invoice to cover one iteration of CPV Testing.

Proceed to step #14.

8. If you requested a technical review on the Order Form, you will receivethe technical review.

9. Have your personalization bureau personalize a sample of your selectedTechnical Product to the parameters that you specified in the CPV SampleSubmission Form.

10. Generate a complete Card Image from the Technical Product.

The Card Image is created using either a Qualified CPV Test Tool (fromone in the Validation Tools List in M/Chip Qualified Test Tools) or theMasterCard Card Image Extraction Tool (which is available on MasterCardOnLine®). For more information on how to make a Card Image, refer to thedocumentation that accompanies the tool you are using.

The card image must also include data read from the magnetic stripe itself,if present, in addition to the magnetic stripe equivalent data read via acontact or contactless interface (as applicable).

11. Send the Card Image, along with an electronic copy of the CPV SampleSubmission Form to [email protected].

12. Send the physical sample to the address detailed in CPV Contact Information.

13. When the CPV Service Provider has received the Card Image and thephysical sample, you will receive an acknowledgement by e-mail of theirreceipt.




Sample Submission

Process

14. The CPV Service Provider will test the Card Image and Physical Sample andyou will receive by e-mail a Personalization Compliance Report. This reportwill be in the form of a PDF document. For a successful CPV Test, the PDFdocument will be digitally signed by MasterCard.

NOTE

The report will not be issued until the CPV Service Provider has received yourcompleted and signed Order Form from step #6.

There are two possible outcomes of the CPV Testing:

If the Personalization ComplianceReport indicates ...

Then …

Successful Proceed to step #15.

Failed Continue to step #17 to make anynecessary changes and being anotheriteration of CPV Testing.

15. You will receive, from the CPV Service Provider, an invoice for anyadditional iterations.

16. Settle the invoice.

This subprocess is now finished.

17. Make the changes suggested in the report then go back to step #9.


Chapter 5 Change Notification SubmissionThis chapter details the subprocess where you provide a CPV Service Provider with a change list froman existing product and request an assessment to use the changed product.

Overview ....................................................................................................................................... 5-1

Process........................................................................................................................................... 5-1


Change Notification Submission

Overview

OverviewNOTE

You can only do this subprocess if you have a Change Management System.

The following figure shows the Change Notification Submission:

Figure 5.1—Change Notification Submission Subprocess

Process1. Get the CPV Change Notification Form, which is available from MemberPublications on MasterCard OnLine, on the same page as this process guide.

2. Complete the information requested in the form.

3. Send the completed form by e-mail to [email protected].

NOTE

The originating e-mail address of this request is used for all futurecorrespondence regarding this change notification submission.



Change Notification Submission

Process

4. The CPV Service Provider will assess your submission and send you a reportby e-mail which will be either.

– A positive assessment and you will be given report saying so, and itwill be digitally countersigned by MasterCard. The report contains aCPV Reference Number to uniquely refer to this Change NotificationSubmission for the Technical Product in any future correspondence

– A neutral assessment and you will be given a report saying so and arerequested to do a Sample Submission to evaluate the changes that youpropose before a positive or negative report can be issued.


Appendix A Data PackagesThis appendix contains the data packages that group together data elements (or tags) which arefunctionally related and have similar CPV validation requirements.

Introduction ...................................................................................................................................A-1

Format Requirements.....................................................................................................................A-1

Data Package 1—Card Risk Management ......................................................................................A-2

Data Package 2—EMV Data...........................................................................................................A-4

Data Package 3—Cardholder Data ................................................................................................A-5

Data Package 4—Certificate and Key Data ....................................................................................A-5

Data Package 5—Variables ............................................................................................................A-6

Data Package 6—Other Data, Minor Impact..................................................................................A-7

Data Package 7—Other Data, Major Impact ..................................................................................A-8

Data Package 8—Thresholds .........................................................................................................A-9

©2009 MasterCardCard Personalization Validation Guide • January 2009 A-i

Data Packages

Introduction

IntroductionA data package groups together data elements (or tags) that are functionallyrelated and have similar CPV validation requirements.

There are eight Data Packages, as shown here:

Table A.1—Data Packages

Data Package Name

1 Card Risk Management

2 EMV Data

3 Cardholder Data

4 Certificate Key Data

5 Variables

6 Other Data, Minor Impact

7 Other Data, Major Cross Impact on Data Package 1/DataPackage 2

8 Thresholds

Format RequirementsThe notations shown here are used to describe the requirements for thepersonalization parameters in each Data Package.

Table A.2—Format Notations

Usage Code Description

M1 Mandatory: If the source of this data element is the ICC,this data element is mandatory. If the source of this dataelement is the terminal, the terminal must supply a correctvalue in the format fixed by EMV if the product requeststhe data element in a DOL.

M2 Mandatory: This data element is mandatory for ICCs thatimplement SDA.

M3 Mandatory: This data element is mandatory for ICCs thatimplement DDA.

C Conditional: This data element is not present, unlessspecific conditions are met, in which case this data elementbecomes mandatory.

©2009 MasterCardCard Personalization Validation Guide • January 2009 A-1

Data Packages

Data Package 1—Card Risk Management

Usage Code Description

O Optional: This data element is optional. If the source ofthis data element is the terminal, the terminal is allowedto send a value containing binary zeros, which means thatthe data is not supported by the terminal if the productrequests the data element in a DOL.

NA Not applicable

Data Package 1—Card Risk ManagementThe data elements shown in Table A.3 define the card risk managementparameters.

They are linked to the specification that the Technical Product is based upon.

Certain parameters have a different Tag value if the Technical Product is M/Chiponly or PayPass – M/Chip.

NOTE

Unless information specific to Maestro PayPass or PayPass – M/Chip Flex is indicated, TechnicalProducts based on Maestro PayPass and PayPass – M/Chip Flex should follow the same processas PayPass – M/Chip.

Changes to parameters in this Data Package that do not conform to referencedocumentation settings are considered as major and initiate Sample Submission.Changes that conform to reference document settings are considered as minorand initiate Change Notification Submission.

Table A.3—Data Package 1—Card Risk Management

Name EMV, M/Chip,PayPass – M/Chip,or CPA

Template Tag EMV MasterCard

Accumulator Profile Controlstemplate

CPA BF31 DF0x NA C

Accumulator x Controls CPA BF32 DF0x NA C

M/Chip D3 NA M1Additional check table

CPA BF33 DF0x NA C

M/Chip D5 NA M1

PayPass – M/Chip D7 NA M1

Application Control

CPA C1 NA M1

©2009 MasterCardA-2 January 2009 • Card Personalization Validation Guide

Data Packages

Data Package 1—Card Risk Management


Template Tag EMV MasterCard

Card Issuer Action CodeTemplate (CIAC entries)

CPA BF34 DF0x NA M1

Card Issuer Action Codedecline M/Chip C3 NA M1

PayPass – M/Chip CF NA M1

Card Issuer Action Code-default M/Chip C4 NA M1

PayPass – M/Chip CD NA M1

Card Issuer Action Code-online M/Chip C5 NA M1

PayPass – M/Chip CE NA M1

CDOL1 related data length M/Chip C7 NA M1

CRM Country Code M/Chip C8 NA M1

CRM Currency Code M/Chip C9 NA M1

Cryptogram Version Number EMV NA M1

Currency Conversion Tabletemplate

CPA BF38 DF0x NA C

Currency Conversion Table M/Chip D1 NA M1

Counter Profile Controlstemplate

CPA BF36 DF0x NA C

Counter x Controls template CPA BF37 DF0x NA C

Cyclic Accumulator ProfileControl x

CPA BF39 DF0x NA C

Cyclic Accumulator x Controlstemplate

CPA BF3A DF0x NA C

M/Chip NA M1Derivation key index (includedin Issuer Option Control)

CPA NA M1

Default ARPC Response Code M/Chip D6 NA M1

GPO Parameters CPA BF3E DF0x NA M1

Issuer Options Profile Controlstemplate

CPA BF3B DF0x NA M1

MTA Profile Controls template CPA BF3D DF0x NA C

Profile Controls template CPA BF3F DF0x NA M1


Data Packages

Data Package 2—EMV Data

Data Package 2—EMV DataThe data elements shown in Table A.4 are key EMV parameters.

The chip provides them to the terminal to support various types of processing,for example, Terminal Risk Management (TRM) processing.

They specify application usage, and how you want the transaction to beprocessed under certain conditions.

Certain parameters have a different Tag value if the Technical Product is EMVor PayPass – M/Chip.

Changes to parameters in this Data Package that do not conform to referencedocumentation settings are considered as major and initiate Sample Submission(Chapter 4, Sample Submission). Changes that conform to reference documentsettings are considered as minor and initiate Change Notification Submission(Chapter 5, Change Notification Submission).

Table A.4—Data Package 2—EMV Data

Name EMV or PayPass –M/Chip

Tag EMV MasterCard

Application Currency Code EMV 9F42 O O

Application Currency Exponent EMV 9F44 O O

Application Discretionary Data EMV 9F05 O O

Application Identifier (AID) EMV 4F M1 M1

Application Interchange Profile EMV 82 M1 M1

PayPass – M/Chip D8 M1 M1

Application Label EMV 50 O C

Application Preferred Name EMV 9F12 O O

Application Usage Control (AUC) EMV 9F07 O M1

Application Version Number EMV 9F08 O M1

Cardholder Verification Method (CVM) List EMV 8E O M1

Certification Authority Public Key Index EMV 8F M2/M3 M2/M3

Directory Definition File (DDF) Name EMV 9D M1 M1

Dedicated File (DF) Name EMV 84 M1 M1

Issuer Action Code – Default EMV 9F0D O M1

Issuer Action Code – Denial EMV 9F0E O M1


Data Packages

Data Package 3—Cardholder Data

Name EMV or PayPass –M/Chip

Tag EMV MasterCard

Issuer Action Code – Online EMV 9F0F O M1

Static Data Authentication Tag List EMV 9F4A O M3

Data Package 3—Cardholder DataThe data elements shown in Table A.5 contain cardholder related data.

They are provided to the terminal to allow correct identification of thecardholder, and of the application being used to perform the transaction.

Changes to parameters in this Data Package do not require any furtherassessment with regard to card personalization validation. These values areprovided for your information.

Table A.5—Data Package 3—Cardholder Data

Name EMV or M/Chip Tag EMV MasterCard

Application Effective Date EMV 5F25 O O

Application Expiration Date EMV 5F24 M1 M1

Application Primary Account Number (PAN) EMV 5A M1 M1

Application Primary Account Number (PAN)Sequence Number

EMV 5F34 O M1

Cardholder Name EMV 5F20 O C

Cardholder Name Extended EMV 9F0B O O

Offline PIN EMV O O

Track 1 Discretionary Data EMV 9F1F O O

Track 2 Discretionary Data EMV 9F20 O O

Track 2 Equivalent Data EMV 57 O M1

Data Package 4—Certificate and Key DataThe data elements shown in Table A.6 are related to certificates and keys.

They are provided to the terminal to allow the CAM (for example, SDA orDDA) to be performed.


Data Packages

Data Package 5—Variables

Changes to parameters in this Data Package which result in addition or deletionof remainders, or relocation of data within the file structure are considered asmajor and initiate Sample Submission. All other changes are considered asminor and initiate Change Notification Submission.

Table A.6—Data Package 4—Certificate and Key Data


Certification Authority Public Key Index EMV 8F M2 M2

Data Authentication Code EMV 9F45 M2 M2

ICC PIN Encipherment Public Key Certificate EMV 9F2D O O

ICC PIN Encipherment Public Key Exponent EMV 9F2E O O

ICC PIN Encipherment Public Key Remainder EMV 9F2F O O

Integrated Circuit Card (ICC) Public KeyCertificate

EMV 9F46 M3 M3

Integrated Circuit Card (ICC) Public KeyExponent

EMV 9F47 M3 M3

Integrated Circuit Card (ICC) Public KeyRemainder

EMV 9F48 M3 M3

Issuer Public Key Certificate EMV 90 M2 M2

Issuer Public Key Exponent EMV 9F32 M2 M2

Issuer Public Key Remainder EMV 92 M2 M2

Signed Dynamic Application Data EMV 9F4B M3 M3

Signed Static Application Data EMV 93 M2 M3 M2 M3

Data Package 5—VariablesThe data elements shown in Table A.7 contain various internal data.

Changes to parameters in this Data Package are considered as minor andinitiate Change Notification Submission.

Table A.7—Data Package 5—Variables

Name EMV, M/Chip, orCPA

Tag EMV MasterCard

Application Transaction Counter (ATC) EMV 9F36 M1 M1


Data Packages

Data Package 6—Other Data, Minor Impact

Name EMV, M/Chip, orCPA

Tag EMV MasterCard

Bad cryptogram counter M/Chip NA M1

Consecutive offline transaction number M/Chip NA M1

Cumulative offline transaction amount M/Chip NA M1

Diversified key for ICC Dynamic number M/Chip NA M1

Global MAC in Script counter M/Chip NA M1

Key for ICC Dynamic number M/Chip NA M1

Last Online Application Transaction Counter(ATC) Register

EMV 9F13 O O

M/Chip NA M1Master Key for the AC generation

CPA NA M1

M/Chip NA M1Master Key for the SMC generation(confidentiality)

CPA NA M1

M/Chip NA M1Master Key for the SMI generation (integrity)

CPA NA M1

Personal Identification Number (PIN) TryCounter

EMV 9F17 C C

M/Chip NA M1Previous transaction history

CPA C7 NA M1

Script counter M/Chip 9F5F NA M1

Data Package 6—Other Data, Minor ImpactThe fields shown in Table A.8 contain various other elements of information.

Changes to parameters in this Data Package are considered as minor andinitiate Change Notification Submission.

Table A.8—Data Package 6—Other Data, Minor Impact


Application Priority Indicator EMV 87 O C

Application Reference Currency EMV 9F3B O O


Data Packages

Data Package 7—Other Data, Major Impact


Application Reference Currency Exponent EMV 9F43 O O

Application Template EMV 61 C C

Directory Discretionary Template EMV 73 O O

Dynamic Data Authentication Data Object List(DDOL)

EMV 9F49 O M3

File Control Information (FCI) IssuerDiscretionary Data 1

EMV BF0C O O

File Control Information (FCI) ProprietaryTemplate

EMV A5 M1 M1

File Control Information (FCI) Template EMV 6F M1 M1

Issuer Code Table Index EMV 9F11 O O

Issuer Country Code EMV 5F28 O M1

Language Preference EMV 5F2D O O

PSE EMV O O

Service Code EMV 5F30 O O

Security Limits 2 M/Chip NA NA M1

Short File Identifier (SFI) EMV 88 M1 M1

Transaction Certificate Data Object List (TDOL) EMV 97 O O

Log Data Table CPA BF40 O O

Log Format EMV 9F4E O C

Log Entry EMV 9F4D O C

Issuer Application Data CPA 9F10 NA M

Data Package 7—Other Data, Major ImpactThese fields shown in Table A.9 contain various other elements of information.

Any amendment to this data may cause significant behavioral differences insome elements of Data Package 1 (Card Risk Management) or Data Package 2(EMV Data) and are therefore considered to have a major impact.

1. If using this field to store proprietary data that differs from one product to another then contactMasterCard.

2. M/Chip 4 Version 1.1 only.


Data Packages

Data Package 8—Thresholds

Certain parameters have a different Tag value if the Technical Product is eitherEMV, PayPass – M/Chip, or CPA.

Changes to parameters in this Data Package are considered as major andinitiate Sample Submission.

Table A.9—Data Package 7—Other Data, Major Impact


Tag EMV MasterCard

Application File Locator (AFL) EMV 94 M1 M1

PayPass – M/Chip D9 M1 M1

AIP/AFL Entries CPA BF41 M1 M1

M/Chip 9F7E NA M1Application Life Cycle Data

CPA 9F7E NA M1

Card Risk Management Data Object List 1(CDOL1)

EMV 8C M1 M1

Card Risk Management Data Object List 2(CDOL2)

EMV 8D M1 M1

Processing Options Data Object List (PDOL) EMV 9F38 O O

Profile Selection File CPA NA NA O

Profile Selection File Entry CPA C2 NA C

Data Package 8—ThresholdsThe data elements shown in Table A.10 contain thresholds and other checks.

Changes to parameters in this Data Package, where a limit is altered from zeroto non-zero, or where the change results in the de-activation of a velocity checkare considered as major and initiate Sample Submission. All other changes areconsidered as minor and initiate Change Notification Submission.

Table A.10—Data Package 8—Thresholds

Name EMV,M/Chip, orCPA

Template orTag

EMV MasterCard

ATC limit M/Chip NA M1


Data Packages

Data Package 8—Thresholds

Name EMV,M/Chip, orCPA

Template orTag

EMV MasterCard

Bad cryptogram counter limit M/Chip NA C

Counter Data template CPA BF35 NA C

Accumulator Data template CPA BF30 NA C

Cyclic Accumulator x Data template CPA BF42 NA C

Number of Days Offline Limit CPA C3 NA C

Limits Entries template CPA BF3C NA C

CFDC limit for AC session key M/Chip NA C

CFDC limit for confidentiality session key M/Chip NA C

CFDC limit for integrity session key M/Chip NA C

Global MAC in Script counter limit M/Chip NA C

EMV 9F14 O OLower Consecutive Offline Limit 3

M/Chip 9F14 NA M1

Lower Cumulative Off line TransactionAmount

M/Chip CA NA M1

MAC in script counter limit M/Chip NA C

Personal Identification Number (PIN) TryLimit

EMV - - C

EMV 9F23 O OUpper Consecutive Offline Limit 3

M/Chip 9F23 NA M1

Upper Cumulative Off line TransactionAmount

M/Chip CB NA M1

3. Internal processing (CRM): This data shall not appear in the records that are readable by aterminal.


Appendix B How To Complete the CPV Sample SubmissionForm

This appendix details how you should complete the CPV Sample Submission Form.

Prerequisites ..................................................................................................................................B-1

Completing the CPV Sample Submission Form .............................................................................B-1

©2009 MasterCardCard Personalization Validation Guide • January 2009 B-i

How To Complete the CPV Sample Submission FormPrerequisites

PrerequisitesThe CPV Sample Submission Form is made available as a Microsoft Excelworkbook.

To be able to open and work with the CPV Sample Submission Form you needto have Microsoft Excel 2002 or greater.

Macros must be enabled. In Excel’s Tools menu, select Options. Choose theSecurity tab, and click Macro Security... to view and change the settings asrequired.

Completing the CPV Sample Submission FormOnce you open the CPV Sample Submission Form you will be presented withthe following steps:

1. Filling in “Issuer Project Information”

2. Technology/Platform Identification

3. Profile(s) Identification

4. Profile(s) Generation

5. Filling in generated sheet(s)

The completion of Step #1 to #4 are mandatory. If in step 1 you decide that yourequire a technical review of the CPV Sample Submission Form, select the option“Personalization Setting Review” as YES, then you must also complete step #5.

Step #5 allows you to enter technical data for review related to thepersonalization settings that you are proposing.

MasterCard recommend that this review is done as early as possible, preferablyat the time that you are determining the personalization settings and not at thetime the sample cards have been personalized and ready for sample submission.

If “Personalization Setting Review” is selected as YES in step #1, this service willincur a fee as per Global Operations Bulletin No. 12, 3 December 2007, “NewChip Service Prices and Billing Changes”.

©2009 MasterCardCard Personalization Validation Guide • January 2009 B-1

Glossary

Application-CPV Sample Test

GlossaryThis chapter defines various terms, concepts, acronyms, and abbreviations used in thisdocument. These definitions appear for convenience only and are not to be used orotherwise relied on for any legal or technical purpose MasterCard specifically reservesthe right to amend any definition appearing herein and to interpret and apply all suchdefinitions in its sole discretion as MasterCard deems fit.

The following terms are specific for this document. Other terms are explained in theMasterCard Dictionary.

Application

In this guide, an Application is a payment system application.

Card Image

An extract of the data from a Technical Product made using a Qualified CPV Test Tool orthe MasterCard Card Image Extractor Tool.

Card Image Extractor Tool

A tool from MasterCard than can be used to make a Card Image.

Card Personalization Validation (CPV)

A process to ensure that every Technical Product bearing a MasterCard brand mark offersthe correct level of service, acceptance, interoperability, performance, and security tocardholders and acceptance locations.

Change Management System

A system to maintain an audited set of changes that have been applied to a TechnicalProduct.

CPV Management

The functional unit at MasterCard who are responsible for managing Card PersonalizationValidation.

CPV Reference Number

A value allocated by the CPV Service Provider at the start of the Card PersonalizationProcess to the Technical Product that will be tested and can be subsequently used touniquely identify Technical Products that have completed the CPV process.

CPV Sample Test

A suite of tests performed by the CPV Service Provider on Card Images and physicalTechnical Products to ensure that their personalization is compliant with the appropriatestandards.

©2009 MasterCardCard Personalization Validation Guide • January 2009 1

Glossary

CPV Service Provider-Vendor Product

CPV Service Provider

An entity authorized by MasterCard to deliver and invoice for the supply of the CPV Service.

Personalization Compliance Report

A report issued by the CPV Service Provider which states whether the CPV Sample Testwas successful.

Personalization Profile

A Personalization Profile is a set of MasterCard predefined values for chip data elementsthat ensure a Technical Product works in a way that conforms to a chosen behavior, suchas ‘Full Chip MasterCard—Signature, Online PIN and No CVM’.

Qualified CPV Test Tool

A test tool that a customer may use in the CPV process to generate a Card Image. Thetest tool must be qualified by MasterCard and such be in the Validations Tools List inM/Chip Qualified Test Tools.

Technical Product

For the purposes of this document, a Technical Product defines a specific combination ofVendor Product, Application, Personalization Profile and personalization parameter settings,that will be offered by an issuer to its cardholders. An issuer may use the same TechnicalProduct to support more than one type of cardholder offering (for example, an issuer’scommercial offerings, such as Gold and Standard cards may both use the same TechnicalProduct, subject to the guidelines published in this document).

Vendor Product

A Vendor Product defines a card or device with a specific application as provided by amanufacturer before specific personalization parameter settings have been loaded.

©2009 MasterCard2 January 2009 • Card Personalization Validation Guide

cpv manual jan 2009

Documents