acquirer and acquirer processor impact questionnaire
Numerics Impact Questionnaire
Acquirer/Acquirer Processor
Numerics Initiative
The International Organization for Standardization has revised ISO/IEC 7812-1, Identification cards – Identification of issuers – Part 1: Numbering system, to expand the Issuer Identification Number (IIN), also referred to as the issuing BIN, to an eight-digit numeric value from the current six digits.
Since 2015, Visa has communicated with its clients on this industry change which is effective as of April 2022. Given the fundamental importance of the BIN to the payments ecosystem, changes extend well beyond VisaNet to impact the proprietary processing and downstream systems used by its processors, acquirers and issuers. Visa strongly advises its clients to conduct an impact assessment across their internal systems and processes, as well as with their vendors and clients.
Based on input from payments industry experts as well as globally representative clients, the following is a set of questions that can be used to support impact assessments and the identification of potential impact areas. After the assessment is conducted, clients can leverage the findings to develop their plan, estimate the effort required, and implement and test the required changes.
Note: These questions are not a comprehensive view of all potential numerics impacts in any single organization. It is meant to serve as an informed starting point. Each client should perform a comprehensive internal impact assessment customized to their unique needs.
Directions
- Save this PDF to your PC.
- Open the PDF from your PC and type your answers into text boxes under the questions.
- Save the PDF before closing to save changes.
- Use the menu on the left side of the screen to access different Capability sections.
- Use page arrows in the bottom right of the screen to move forward and back through a Capability.
Acquirer/Acquirer Processor
| Capabilities Menu | Questionnaire |
|---|---|
| Numerics Program Management Transaction Processing ATM Merchant Point of Sale (POS) Merchant Servicing & Disputes Fraud Management Data Warehousing PCI DSS & Risk Management | Numerics Program Management Program Management 1. Has a formal Numerics program structure been established? Does the program have executive sponsorship? Budget approval? 2. Has broad internal outreach been conducted to identify stakeholders across technology, lines of business and functional areas (e.g., finance, risk, etc.)? 3. What is the approach for end-to-end testing (including third parties)? Training? 4. For clients operating in multiple geographies, does the program structure and approach reflect regional differences? |
| Capabilities Menu | Questionnaire |
|---|---|
| Numerics Program Management Transaction Processing ATM Merchant Point of Sale (POS) Merchant Servicing & Disputes Fraud Management Data Warehousing PCI DSS & Risk Management | Numerics Program Management Numerics Awareness 1. Are all internal stakeholders aware of the new Numerics standard and the readiness timeline? 2. Is the issuing BIN referred to by any other terms across the organization, such as systems, process documentation, or other business usage? 3. What is the approach to engaging with third parties (processors, vendors, clients) to understand Numerics impacts to their systems, processes, and data? |
| Capabilities Menu | Questionnaire |
|---|---|
| Numerics Program Management Transaction Processing ATM Merchant Point of Sale (POS) Merchant Servicing & Disputes Fraud Management Data Warehousing PCI DSS & Risk Management | Numerics Program Management Third Party Communication 2. What is the communication plan for all clients? 3. What is the approach to understanding clients' readiness for the Numerics changes 4. What is the approach to understanding (and validating if necessary) vendor readiness for the Numerics changes |
| Capabilities Menu | Questionnaire |
|---|---|
| Numerics Program Management Transaction Processing ATM Merchant Point of Sale (POS) Merchant Servicing & Disputes Fraud Management Data Warehousing PCI DSS & Risk Management | Transaction Processing 1. How is issuing BIN used across the transaction processing lifecycle (authorization, clearing, settlement, transaction accounting, reconciliation)? 2. Do the authorization and transaction risk processing business rules include issuing BIN? 4. What tables are used in transaction processing today? Are there any impacts to the tables used due to issuing BIN expansion to eight-digits? For example: • Routing: Are Visa-supplied network-specific routing tables (e.g., Visa Plus, Interlink) used • Clearing: Is Visa-supplied account range definition (ARDEF) table via Edit Package used • Are any proprietary or third-party supplied BIN tables used |
| Capabilities Menu | Questionnaire |
|---|---|
| Numerics Program Management | Transaction Processing |
| Transaction Processing | • Limited acceptance (credit, debit)? |
| ATM | • Prepaid cards, purchasing cards (p-card), flex spending account (FSA) cards, fleet/petrol cards, U.S. General Services Administration (GSA) cards, others? |
| Merchant Point of Sale (POS) | • Cashback? |
| Merchant Servicing & Disputes | • Installment payment qualification? |
| Fraud Management | • Europe Only: Surcharging? Strong customer authentication (SCA) exemption determination? |
| Data Warehousing | • U.S. Only: U.S. General Services Administration (GSA) cards? |
| PCI DSS & Risk Management | |
| 5. Is the issuing BIN used in interchange reconciliation or reporting? |
| Capabilities Menu | Questionnaire |
|---|---|
| Numerics Program Management Transaction Processing ATM Merchant Point of Sale (POS) Merchant Servicing & Disputes Fraud Management Data Warehousing PCI DSS & Risk Management | ATM 4. Is issuing BIN used to route ATM transactions? |
| Numerics Program Management Transaction Processing ATM Merchant Point of Sale (POS) Merchant Servicing & Disputes Fraud Management Data Warehousing PCI DSS & Risk Management | |
| Numerics Program Management Transaction Processing ATM Merchant Point of Sale (POS) Merchant Servicing & Disputes Fraud Management Data Warehousing PCI DSS & Risk Management | 2. What tables are used in ATM transaction processing? Are there any impacts to the tables used due to issuing BIN expansion to eight-digits? |
| Numerics Program Management Transaction Processing ATM Merchant Point of Sale (POS) Merchant Servicing & Disputes Fraud Management Data Warehousing PCI DSS & Risk Management | |
| Numerics Program Management Transaction Processing ATM Merchant Point of Sale (POS) Merchant Servicing & Disputes Fraud Management Data Warehousing PCI DSS & Risk Management | 3. Is issuing BIN used to identify on-us transactions? |
| Numerics Program Management Transaction Processing ATM Merchant Point of Sale (POS) Merchant Servicing & Disputes Fraud Management Data Warehousing PCI DSS & Risk Management | |
| Numerics Program Management Transaction Processing ATM Merchant Point of Sale (POS) Merchant Servicing & Disputes Fraud Management Data Warehousing PCI DSS & Risk Management | 4. Is issuing BIN used to perform on-us services on not-on-us transactions (e.g., for special treatment)? |
| Numerics Program Management Transaction Processing ATM Merchant Point of Sale (POS) Merchant Servicing & Disputes Fraud Management Data Warehousing PCI DSS & Risk Management | |
| Numerics Program Management Transaction Processing ATM Merchant Point of Sale (POS) Merchant Servicing & Disputes Fraud Management Data Warehousing PCI DSS & Risk Management |
| Capabilities Menu | Questionnaire |
|---|---|
| Numerics Program Management Transaction Processing ATM Merchant Point of Sale (POS) Merchant Servicing & Disputes Fraud Management Data Warehousing PCI DSS & Risk Management | ATM 4. Have impacts to ATM terminal support been identified? Software distribution Transaction reporting PIN change capabilities Custom text and graphics Foreign language screens Voice enabled support |
| Capabilities Menu | Questionnaire |
|---|---|
| Numerics Program Management Transaction Processing ATM Merchant Point of Sale (POS) Merchant Servicing & Disputes Fraud Management Data Warehousing PCI DSS & Risk Management | Merchant Point of Sale (POS) 1. Is POS terminal-level logic based on the issuing BIN? 2. Are issuing BINs "hardcoded" on POS terminals? 3. Are BIN tables uploaded to POS terminals? 4. Are POS terminals referencing issuing BIN tables hosted centrally via terminal? 5. Are BIN tables sent to merchants for their internal use? |
| Capabilities Menu | Questionnaire |
|---|---|
| Numerics Program Management | Merchant Point of Sale (POS) |
| Transaction Processing | 6. Are merchants procuring issuing BIN files for their internal use? |
| ATM | |
| Merchant Point of Sale (POS) | 7. Are there any impacts to receipt requirements (e.g., is first-six used to identify issuers)? |
| Merchant Servicing & Disputes | |
| Fraud Management | |
| Data Warehousing | |
| PCI DSS & Risk Management | 8. Are there any impacts to merchant credit returns processes? |
| Capabilities Menu | Questionnaire |
|---|---|
| Numerics Program Management Transaction Processing ATM Merchant Point of Sale (POS) Merchant Servicing & Disputes Fraud Management Data Warehousing PCI DSS & Risk Management | Merchant Servicing & Disputes 1. Is terminal or processing level logic for merchant offer, loyalty or reward programs or other promotions based on issuing BIN? 2. Are there any loyalty program impacts at merchant / co-brand level? 3. Are there any impacts to merchant credit returns processes? Search functionality: Can merchants search by issuing BIN? Screens: Is issuing BIN displayed on any screens (e.g., first-six of PAN)? Reporting: Is issuing BIN included in merchant reporting available for download on the self-service portal? Is there a business need to expand search functionality, screens, or reporting to display first-eight digits? |
| Capabilities Menu | Questionnaire |
|---|---|
| Numerics Program Management Transaction Processing ATM Merchant Point of Sale (POS) Merchant Servicing & Disputes Fraud Management Data Warehousing PCI DSS & Risk Management | Merchant Servicing & Disputes 4. Is issuing BIN included in merchant reporting sent to merchants directly? 5. Is the issuing BIN used in dispute management processes: Issuer disputes Merchant-initiated disputes 6. Is issuing BIN used to identify transactions for dispute case routing 7. Is issuing BIN used in any other merchant servicing processes? |
| Capabilities Menu | Questionnaire |
|---|---|
| Numerics Program Management | Data Warehousing |
| Transaction Processing | 1. Is the first six-digits of the PAN stored as a separate data element? |
| ATM | |
| Merchant Point of Sale (POS) | |
| Merchant Servicing & Disputes | 2. Where is the issuing BIN stored? Application data tables? Data warehouses (financial, operational, etc.)? |
| Fraud Management | |
| Data Warehousing | |
| PCI DSS & Risk Management | 3. Are data searches performed by issuing BIN? |
| 4. Is issuing BIN combined with any other numerics to create a separate data element that may be impacted by expansion to eight-digit BIN? |
| Capabilities Menu | Questionnaire |
|---|---|
| Numerics Program Management | Data Warehousing |
| Transaction Processing | 5. Is the issuing BIN stored as a data element in a master data management (MDM) solution? |
| ATM | |
| Merchant Point of Sale (POS) | 6. Is the issuing BIN stored or used in any other product processors (e.g., core banking system)? |
| Merchant Servicing & Disputes | |
| Fraud Management | |
| Data Warehousing | 7. Are issuing BINs used in any finance reports or as general ledger components? |
| PCI DSS & Risk Management | 8. Is the issuing BIN included in any data or reporting provided to third parties? |
| Capabilities Menu | Questionnaire |
|---|---|
| Numerics Program Management Transaction Processing ATM Merchant Point of Sale (POS) Merchant Servicing & Disputes Fraud Management Data Warehousing PCI DSS & Risk Management | PCI DSS & Risk Management 1. Are there any impacts to methods used to protect data to maintain PCI DSS compliance (e.g., truncation, encryption, tokenization)? 2. Is the issuing BIN used in compliance management system and processes? 3. Is the issuing BIN used in regulatory reporting? |