As a result, credit unions that haven't started integrating EMV at their ATMs face "very, very, very, very, very slim" odds of being ready on Oct. 1, according to Deborah Spidle, director of EMV solutions at Paragon Application Systems, which helps configure and test ATM networks.

There has been some activity. A study by the ATM Industry Association in March showed most financial institutions and independent ATM deployers have surveyed their fleets to see what needs upgrading. But making actual changes is a separate issue. In 2014, for example, 62% of the respondents in the ATMIA study predicted at least a quarter of their fleets would accept EMV transactions by the end of 2015. But when January 2016 rolled around, only 28% actually had at least a quarter of their fleets accepting EMV transactions.

Facing the Consequences

MasterCard's 384 million debit and credit cards in the United States as of June 30 is less than half of Visa's 826 million card base, making it tempting to wait until Visa's ATM liability shift happens in 2017.

"If you look historically at the type of ATM transactions that are performed at your ATM and you feel that the volume of MasterCard transactions is small enough that you consider that an acceptable risk, then that's certainly your business," Spidle said.

But non-EMV ATMs could become targets, she warned.

"I think maybe the criminals are going to say, 'Hey, this ATM is not EMV ready, so I can do more skimming activity here … I can use my counterfeit cards here easier than at the EMV-compliant ATM,'" she said.

Making Tough Calls

One reason for the slow pace of change may be the cost to upgrade ATMs. According to Aite Group, EMV hardware and software typically runs $300 to $3,000 per machine – a huge outlay for many credit unions.

ATMs that already have chip-card readers likely only need software upgrades, according to CO-OP Financial Services Senior Product Manager Terry Pierce. CO-OP has nearly 30,000 ATMs in its network. However, ATM operators now expect to outright replace 20% of their terminals, according to ATMIA. New ATM technologies and capabilities, such as cardless functions, foreign currency and coin capabilities, and video teller features make it tempting to use EMV as a reason to try to get ahead of the curve now and invest in ATMs that can do it all, Pierce said.

Another reason for the slow pace of change may simply be fatigue. Massive ATM investments in recent years have drained budgets and patience, forcing many credit unions to take a hard look at their fleets before they're willing to spend again, Spidle said. She also noted that some operators might decide it's cheaper to assume the liability risk than to upgrade; others might even kill off some of their ATMs altogether. In fact, ATMIA estimates around 4% of ATMs will likely be retired without an upgrade or replacement.

"A lot of people have decided, 'I had to do migration from Windows 7. I had to do ADA not too long ago,'" she explained. "They dread going back to their hundreds or thousands of ATMs again and again and again to do something."

Mark Young, corporate relationship manager at ATM software company CSFI, said it's a serious predicament for many operators.

"Costs aren't always measured in dollars and cents," he said. "It's client loyalty. It's client retention. It's your ability to gain new clients. Are the new solutions that you are putting in place flexible enough and scalable enough to deliver you into the future successfully?"

ATM operators haven't lost their optimism, though: According to the ATMIA study, 58% believe at least three-quarters of their fleets will be EMV compliant by year-end, and virtually all (91%) said they'll have at least three-quarters of their fleets ready after 2017.