In 2019, The PCI (Payment Card Industry) Security Standards Council announced new mandatory security requirements for ATMs and processors. These new mandatory standards impact the processor as well as the ATM hardware, specifically the Electronic Pin Pad (EPP). The EPP is the keyboard that cardholders enter PIN numbers. PCI planned for a phased implementation of updates to provide a more secure method of transferring encryption keys from an ATM’s host processor to the ATM however Covid-19, resulted in a delay to the compliance deadline dates. The dates below reflect the revised deadlines

PCI EPP Compliance Dates

• December 31, 2022: Replace ATMs and upgrade EPP for ATMs with PCI PTS v1 or older (v1 EPPs are Less secure technology)
• January 01, 2025: EPP hardware, firmware and software must utilize TR31 Phase 3 “Key Blocks”

Are your ATMs Compliant?

Probably not. For one, at a minimum all ATMs will require software updates as the manufacturers and processors certify software. Any ATM manufactured prior to March 2021, will most likely need an EPP upgrade. The upgrade path for each ATM will be different, but more than likely a tech will need to visit each ATM. Load new software. Possibly install a new EPP, and related accessories and reprogram the ATM to the new protocol.

Next Steps

This upgrade is mandatory. Simply put, failure to upgrade your ATMs for this mandate will mean that after January 2025 – your ATMs will not process transactions.

Due to the enormous scope of this mandate (basically every ATM in the country needs at least a software upgrade) – we strongly urge you to do not delay. Upgrade your ATMs as soon as you can. PCI has already pushed back their deadline once due to Covid 19. Historically speaking, upgrades are always least expensive early on. Waiting until the last minute may mean not meeting the deadline and going dark, or paying a higher price for an upgrade due to manufacturer price increases the closer we get to the deadline.

Additional Information

Hyosung – ATM Security PCI Compliance Update

Visa PIN Security Bulletin

PCI Security Standards Council

What are we doing?

We have known about this for years now, and last year we stopped selling and deploying ATMs that do not have the correct style EPP. We are currently in the process of contacting large affiliates/ customers and relaying this information to them and signing them up for the upgrade/ selling kits. As of the date of this post- the software is not available and both of our processors (Columbus Data and Switch Commerce) are not certified. Once they are certified, we will begin installing upgrades/ loading software. We expect to begin Jan 2023.

What can you do to prepare?

Contact your ISO to learn which machines need software vs. need software and a keyboard upgrade vs needing to replace the entire machine. For large IAD’s – although this cost may seem daunting – it is always less expensive early on. If you can financially handle it, we recommend upgrading as soon as possible. Start preparing by raising surcharges if you can, and start saving. You have several months to prepare, do not wait until the last minute! We do have financing options available for large operators who process with us.

If you are just starting out- and you are thinking about buying a used machine – do your research. Make sure you understand what the cost will be to upgrade it, OR if an upgrade is even available for that model. In the coming months there is going to be a huge influx of used equipment as people get rid of old hardware. If I had to guess- most of this will not be upgradable. Spending a few hundred dollars to only use a machine for a few month to me, may not make great business sense.

As always, we encourage questions. Feel free to contact us by phone at 877-663-6128 during sales hours M- F 8:30 AM – 4:30 PM Eastern Time. To contact us 24/7 email info@bpsands.com