Credit unions across the country are working hard to migrate their credit and debit cards to EMV in time for the October 2015 liability shift, but that deadline isn't the only one they have to worry about. Next up is the mass EMV migration for ATMs – and MasterCard's October 2016 liability shift means credit unions are gearing up for another set of hurdles.
Currently, card issuers generally bear the cost of fraud associated with counterfeit cards at ATMs. But after the ATM liability shift, the party that does not support EMV bears the loss. For credit unions that own their ATMs, that means possibly paying for fraud if their ATMs can only read magnetic stripes, even if a member uses a first-generation EMV card that has a chip and a magnetic stripe.
Though Visa's liability shift isn't until a year later, MasterCard's 2016 deadline – coupled with increased recent attention on ATM skimming – is fueling the migration fire. But like card migration, migrating ATMs to EMV is not legally required; rather, it's a way to unload some fraud burden. Nonetheless, credit unions as a whole haven't done much so far, according to a few industry experts.
"I think a year or two years ago, it was maybe on people's radar," Shaun King, vice president of international sales and EMV specialist for the Long Beach, Miss.-based ATM manufacturer Triton, said. "A year ago, there was a begrudging understanding that it was coming. Now I think people finally understand what EMV is. The next point will be, do people understand the urgency and understand what liability shift means. That to me is still largely, I'm really generalizing here, but is really misunderstood."
He added, "In my discussions with folks, with ATM owners, I think a lot of them have said, 'I've had a few chargebacks. It's cheaper than me spending $1,000 or thousands to upgrade.' That could be the case – or it could be a case where they drain the ATM completely, and they do it over a period of time."
But establishing a fleet of EMV-capable ATMs means some potentially hefty capital expenditures. Many ATMs need new card readers that support chip and magnetic stripe cards, for one thing. And credit unions have to ensure their operating systems and ATM software support EMV. Each ATM will also require a tested and approved software component – the kernel – that provides EMV functionality. Data speeds have to be fast enough to process transactions, and the receipt printers will need adjusting to display the required application identifiers. That all means many credit unions will have to make in-person visits to each of their ATMs.
Then there's the shopping around. Some credit unions may still be using core banking systems that don't support EMV, and in that case, they'll not only have to upgrade their terminals and software, but also find an EMV-compliant processor, according to Stuart Mackinnon, president of Columbus Data Services, a processor that drives about 90,000 ATMs in the U.S..
"It's going to be coming down to the costs associated with the integrated chip-card reader, as well as the software card," FIS Senior Product Manager Andrew Oasen said. "The numbers I have seen in the industry, on average, have been somewhere in between about the $1,300 to $1,500 range, just for those."
The site visits will also incur some processor-related costs to update databases, though those are relatively minimal, he added.
Less than 5% of ATMs will need a full replacement to get EMV compliant, Mackinnon thought. "If you're driving a through-the-wall, or an exterior drive-up type ATM, it can be in the $30,000 to $40,000 range," he said. "So it's really a tremendous variable based on the age and upgradability of your hardware."
Read more: There may not be an obvious ROI for the ATM migration …
Knowing who will be liable for certification costs and whether a processor will provide it as part of a value-add or a contract-extension offer – or charge outright for it – is important too, he said.
Adding to the challenge is that the capital expenditures may not have an obvious ROI.
"ATM owners are saying, wait a second, all this doom and gloom and I'm now having to spend another $500, and the benefactors of this are going to be the card issuers," King said. "The card issuers would say, well, hang on a second, this is good for the industry. There's less fraud. We don't want customers walking away from our devices because they're worried that their cards are going to be compromised. That's the only spin on an ROI that I can think of – that it's really defensive."
But there also may be a price to pay for waiting.
"Even if you had 150 terminals and you had to do an upgrade on all of them, typically as a credit union you don't have the technical skills in house to do that yourself," he added. "If there are three Diebold techs in your area and you run Diebold and you need them to upgrade your entire fleet, and they're doing everybody else's entire fleet in the area, you want to understand if there are any timing constraints in getting that done prior to the liability shift."
Mackinnon advised, "If you're a small credit union with five branches and five ATMs and you're looking at an October 2016 liability-shift date, you probably still have time to wait until your processor and all the networks are fully ready, then to go ahead with your upgrade. If you're a large credit union with 300 or more terminals, then you probably should be already in the implementation phase of it, at least preparing your capital plan for upgrading your terminal hardware and software."
Oasen also emphasized the importance of planning, adding: "I would say they need to be thinking several months in advance from the processor's perspective. From the vendor perspective, meaning do I have my software kernel, do I have my necessary integrated chip card reader, things along those lines, I would really recommend they start reaching out to their vendors now if they haven't already done so."
Right now, time is still on the side of credit unions, Oasen said. Most are more worried about their card migration for the October 2015 deadline.
But credit unions shouldn't take their foot off the gas after their card migrations are done, Mackinnon warned.
"Without painting them all with the same brush, ATM operators have a history of waiting until the last minute," he said.
© 2025 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
