by Hanife Yıldıztekin
While Paycore offers card personalization options, printing from a branch, and mass printing, it also gives you the confidence of having more than 20 years of experience in the field. It offers the most up-to-date version of the agenda with easily manageable card personalization systems.
Europay, Mastercard and Visa, which set common standards for the use of cards all over the world (EMV), define numbers for institutions based on their own products. These numbers are called “Bank Identification Numbers”, or “BIN” for short.
A BIN is also referred to as an IIN (Issuer Identification Number). In fact, the “ISO/IEC 7812-1” document, which the standard is based on, is also described with this term. Since the ISO standard is a general one, the abbreviation is defined as “Issuer Identification Number”, while the banking sector has adapted this definition and changed it to “Bank Identification Number”.
BINs, which consisted of 4 digits before 1989, are determined as 6 digits today. As payment systems grew day by day, 6 digits were no longer sufficient, and the ISO (International Organization for Standardization) decided to update this range to 8-digit BIN. No change will be made for previously issued BINs, but for BINs remaining in the hands of the certification authorities, a regulation has been passed for them to be defined to institutions as 8 digits from now on. Thus, the ISO multiplied the number of BINs pending in the pool by 100 and increased the number of BINs to be distributed.
The last date notified by the certification authorities for this change is April 2022, after which 8-digit bin distribution will commence. In the current period, card issuers and banks are expected to carry out the necessary work to adapt to this change. EMVCO recommends that companies operating with 6 digits become compatible with 8 digits but does not require it.
Changes
- Payment Systems will continue to accept 6-digit bin and 8-digit bin transactions. No difference is expected in the flow of current online transactions.
- The card number will continue to be used with 16 digits.
- The BIN information printed on the card will continue to be printed in the same way; there will be no change to the order of the information printed on the card, etc.
- Changes will also apply in card-present or card-not-present situations.
- Certificates created with 6-digit BINs will continue to work. Older cards will not be affected by switching to 8-digit BINs.
- ODA (Offline Data Authentication) verification will not be affected by IPK created with 6- or 8-digit BINs and will continue its current flow.
- Terminal functions will not be affected. The change will not lead to any difference for the customer.
In summary, no change is foreseen in the current workflow regarding the transition to 8-digit BIN. Institutions should regulate their internal flows, and if there are 6-digit specific sections in their current software, these sections should be updated.
New Data Element 9F0C
It is currently kept under the BIN 42 tag. While considering expanding this tag to hold 8-digit BINs, it was decided, according to the view of the companies, to create a new tag for 8-digit. The reason is that some terminals expect the 42 tag to be 6 digits and consider the data to be invalid otherwise. The 9F0C tag, created in order to avoid this confusion, will ensure that the terminal continues to be used for both BIN lengths.
- Issuer Identification Number (’42’)
- Issuer Identification Number Extended (‘9F0C’)
BIN information can be found in the newly created 9F0C tag or 42 tag. It is not mandatory to have both tags filled.
When we consider other data elements, the following tags containing BIN information are already suitable for 8-digit BIN. It does not necessitate any work.
- Primary Account Number (Tag ‘5A’),
- Track 2 Equivalent Data (Tag ’57’),
- Issuer Public Key Certificate (Tag ’90’),
- ICC Public Key Certificate (Tag ‘9F46’), and
- ICC PIN Encipherment Public Key Certificate (Tag ‘9F2D’)
Evaluation of 8-Digit BIN Change in Terms of PCI DSS
According to PCI DSS rules, the first 6 digits and the last four digits of the PAN number are clearly shown to the user, and the remaining parts can only be displayed with special authorization. It is necessary to document this need in order to see more of the card data openly. This situation is also valid for 8-digit BINs. In short, the transition to 8 BIN does not result in any difference in terms of rules. The existing rules continue. This rule also applies to storage methods. BIN and the last four digits can be stored in non-encryped state, and the remaining part can be stored encrypted in the database.
