The payments business is growing at a rapid pace, in part due to innovation. This growth has put pressure on the industry to ensure availability of Bank Identification Numbers (BINs) which comprise the first digits of the Primary Account Number (PAN) and facilitate financial institution identification to stakeholders within the payment ecosystem. BINs are foundational to our business and are governed by the International Organization for Standardization (ISO).
- To determine the best path forward, ISO convened payment industry stakeholders from around the world. After much discussion, they agreed to expand the length of the issuing BIN from six (6) to eight (8) digits.
- Visa and MasterCard support this industry change, and Evertec systems are now ready to handle eight-digit BINs, effective April 2022.
How this change impacts
merchants?
Certain merchants, with their own internal or proprietary systems, could potentially need to examine how the BIN expansion will impact their back-end systems. Examples of merchant activities that should be reviewed, are listed below but do not represent a comprehensive list:
- Identification of prepaid cards
- Fraud and/or chargeback analytics
- Issuer identification
- Routing
- Unique BIN range identification, for example, Fleet Cards, specific types of corporate cards, Benefits cards
- Cash back qualification
- Optimization of approval rates, authorization analysis
- Identification of participants for loyalty and proprietary benefits programs
- Reporting of POS activity
How to prepare?
Most of the changes required by merchants are specific to their own internal or proprietary systems. Each merchant must assess the impact for this change with their acquirers, processors, vendors, third party agents and any other partners who support their transaction processing, routing, and downstream activities.
Evertec recommend merchants actively engage and assess impacts across their organization as soon as possible to maximize their efficiencies and avoid surprises.
Any logic specific to the six-digit issuing BIN that has been implemented in your processing or downstream systems must be changed, particularly if you:
- Manage your own POS environment
- Share BIN information with any third party
- Use proprietary BIN tables in transaction processing or supplied via third parties
- Have any system logic that uses the first six-digits of the card number
- Use hard-coded BIN logic in your POS terminals
- If your reports are processed by Evertec, review the reports and request the specific change by sending us an email to firstbankmerchant@evertecinc.com, please include your Merchant ID (MID).
PCI-DSS allows exposure of the first six and any other four digits in a PAN as the only method for protecting data at rest. If a merchant would like to expose the full eight-digit BIN as well as the last four digits, they will need to add one or more of the other acceptable methods for data protection, such as encryption, hashing or tokenization. Merchants should review any changes to how they plan to protect their data with a Qualified Security Assessor.
The changes required by a Merchant’s downstream and processing systems may require extended timelines. It is critical that this project is scheduled and prioritized now to ensure readiness by April 2022.
Visa and MasterCard will continue to communicate regularly with Evertec regarding the migration to the eight-digit issuing BIN.
Questions?
If you have questions on how the eight-digit BIN changes may affect your business, we encourage you to reach us at firstbankmerchant@evertecinc.com, make sure to include your Merchant ID (MID). You could also contact us at 787.773.5484.
We appreciate your trust and the opportunity to continue serving you.