Credit unions still weary from the Oct. 1, 2015 EMV card liability shift will need to recuperate quickly, because another EMV deadline is sneaking up on them.
This time, it's a liability shift at ATMs taking place on Oct. 1, 2016. After that date, MasterCard will no longer bear the cost of fraud at ATMs that aren't EMV-compliant. That means credit unions and other financial institutions may need to change their ATM hardware and/or software – and they only have about eight months to do it.
"You're going to have a ton of ATMs that will not be upgraded come Oct. 1," Dolphin Debit EVP and Co-Founder Gary Walston told CU Times.
"As each day passes, it's only going to become more difficult," Walston said. "Most credit unions and banks are in the same boat and so focused on EMV as a card issuer that they haven't thought about the ATM. What you're doing is just condensing all of these ATMs that need to be touched and serviced and upgraded into a more compact period of time. That means the resources are going to be stretched, and chances are that the longer you wait, the bigger the chance obviously is that you can't get it done in 2016."
The Oct. 1 deadline only pertains to MasterCard-branded cards, however; Visa's shift happens in 2017. But Walston said many institutions are working off of the MasterCard deadline. After all, if they're going to go through the trouble of upgrading, they might as well do it all at once, he explained.
In general, two things make an ATM EMV-compliant: A chip-card reader and updated software.
Many ATMs may already have readers if they're less than five or six years old, Walston said, but the software modification can be a little trickier – some of it may not be ready. The software certification process has been going on for the last 12 months, but credit unions with ATMs from small manufacturers might need to call their processors and find out if their software is ready, he said.
"What happens is the big processors end up prioritizing so that the Diebolds and the NCRs get certified first," he said. "Then manufactures that have a smaller market share – they kind of get pushed down in that queue with certification."
And because ATM software usually sits directly on each machine, EMV upgrades also require a technician visit to every single ATM, CU24 VP of Operations Chris Poole said.
Poole said he hasn't heard any credit unions request simultaneous upgrades for cardless access – a technology many in the mobile app business said will improve ATM security. That's largely a software rather than a hardware change, he noted.
The actual work should only take two or three hours per ATM, and many credit unions are already contracted with third-party service providers to perform maintenance on their ATMs, Walston explained. But having enough technicians to go around could prolong things, he said.
"The challenge is, the smaller the institution, the more likely you are to be pushed off by the bigger service organizations," he said. "We've heard some stories where even decent-size credit unions, and I'm talking, you know, $500 million credit unions, are having a hard time getting a return phone call to discuss it and schedule it."
EMV upgrades can add up, too.
"In some, it may only cost $1,500 to a couple of thousand dollars if all the credit union has to do is upgrade software," Walston said. "If they have to upgrade the software and the hardware, you could get between $2,000 and $3,000. In some cases, in order to just do the hardware and software upgrade, it may require additional memory or additional processing speed. That can bump it up by several thousand dollars more."
Poole said his biggest credit union customer has about 50 ATMs. Many have less than 10, which means it may not be a major project for most, he said.
Walston warned that credit unions that don't convert should prepare for a jump in skimming activity. Those that do upgrade will still have to watch for new threats such as shimmers – devices aimed at cracking EMV cards.
"We get clever and the crooks get cleverer," Poole said.
© 2025 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
