Another deadline that may impact my operations?

After racing through EMV compliance implementations (a continuing saga for petroleum retailers), managing PCI compliance, and mitigating evolving fraud and security issues, merchants are sometimes left to wonder when they have time to focus on the core of their business- selling to and retaining customers.

In 2016, Visa announced[1] that effective April 2022 they would be migrating from the current six-digit BIN standard to an eight-digit BIN standard to overcome a foreseeable shortage of available BIN numbers.  For merchants, analyzing the impact that this change may have on their organizations in advance of the deadline will be key to ensuring minimal impact to operations.

How will this impact merchants?

While much of the impact of the eight-digit BINs will be handled by issuers and acquirers, merchants will also need to be active participants in planning for the April 2022 deadline. This begins with staying in close communication with their providers to understand what changes the provider plans to make and if any impact will be seen at the merchant level. Merchants with a complex or customized payments ecosystems will also need to conduct a comprehensive discovery analysis and impact assessment across all facets of operations to determine what the BIN expansion will mean to their organization.

The following examples have been compiled to illustrate potential impacts:

• POS systems and/or payment gateways may require BIN table and/or logic updates, which, if ignored, could incorrectly route consumer transactions.
• If an organization uses six-digit BINs to review fraud analytics or build fraud rules, process and system updates may be required.
• Merchant reporting and billing teams may rely on six-digit BINs for reporting, reconciliation or research. In this case, all relevant reports will need to be updated to ensure limited impact. 
• As it relates to payments security, if an organization uses truncation and would like to expose the full eight-digit BIN along with the last 4 digits, additional security measures (e.g. encryption) will need to be implemented to maintain PCI compliance.

The above list, of course, represents a subset of potential impacts that the BIN expansion poses to a merchant environment. In order to fully understand the scope of changes that will be required for a specific retailer’s operations, W. Capra recommends a comprehensive impact assessment.

Never put off until tomorrow what you can accomplish today

As we’ve witnessed in prior industry deadlines, April 2022 may as well be tomorrow in the scheme of assessing, planning, testing and completing projects to mitigate the impact of the eight-digit BIN change. The compressed timeframe makes determining the impact a top priority. 

For further discussion around maintaining operational integrity through external changes, contact Ashley at amiller@wcapra.com.   

---

[1] https://www.gorspa.org/wp-content/uploads/Visa_Bulletin_Implementation-of-8-Digit-BINs.pdf