Contents
Introduction
03
Questions to Ask Your
04
EMV Level 2 Kernel Provider
EMV Kernel Range
06
Contents
One of the most common decisions faced by payment
terminal or ATM manufacturers is
whether to develop in house or buy in the technology
of this critical component.
Those who decide to buy a Kernel from an EMV™*
Level 2 Kernel supplier often do so because they
require a quicker route to market, have limited EMV
knowledge and expertise or do not wish to risk high
upfront cost of developing a solution in house.
Combine this with testing and the formal EMVCo
certification process, the majority of companies decide
to buy in a solution rather than develop it.
An EMV Level 2 Kernel is a critical element of the EMV
chip technology standard, and decisions on which
supplier to choose should be based not simply on the
initial development cost alone. Purchasing an EMV
Kernel for a payment device is not a one-off
technology purchase and should be considered more
of a long term investment. As the EMVCo standards
continually evolve, future code maintenance,
re-certifi-cation and support
will be required and should be considered during the
initial purchasing evaluation in order to reduce risk
and eliminate any unexpected future cost.
This whitepaper provides a list of questions payment
device manufacturers and integrators need to
consider when outsourcing an EMV Kernel project to a
third party, highlighting pitfalls, risks and hidden cost.
* EMV™ is a trademark owned by EMVCo LLC.
Introduction
An EMV Level 2 Kernel
is a critical element of
the EMV chip
technology standard...
”
Questions to Ask Your
EMV Level 2 Kernel
When researching the most suitable Kernel, price should not
be the only purchasing criteria. Anyone considering
purchasing a Kernel from a third party needs to ensure the
Kernel will be maintained and supported for the foreseeable
future. The following 10 questions should be directed to every
Kernel supplier when looking for the best solution:
How many years has the
company been in business?
Purchasing a Kernel is not a one off activity. It is important to choose an established development partner with a proven track record of success in maintaining compliance with the evolving EMVCo specifications and a
demonstrable capability in providing code updates and support.
Creditcall was incorporated in 1996 and is a financially stable, growing company with two main focuses; the first is EMV Kernel technology (since 2002) and the second, payment processing (since 1997). The company has a global reach, operating in Europe, the USA and Canada.
How financially strong is the
company?
As the EMVCo standards change,
economic climate and has no debt. This has been realised through prudent financial management and a worldwide customer base. Creditcall is also a PCI DSS Level 1 Certified payment gateway which provides another diverse revenue stream, again on a global basis. In short, Creditcall is not dependant on a single source of revenue.
How many years has the
company been developing
and maintaining their EMV
Level 2 Kernel?
The EMVCo technical standards are vastly complex and continue to become more so. Maintaining a detailed understanding of these standards requires not only a highly qualified development team but one with years of experience within the world of
transaction processing. To get a project to market quickly and avoid costly delays,
many EMVCo bulletins. This has built up 30 man years of real world experience within its EMV team. This means when we embark upon a customer’s EMV project we can get straight into the development and integration process without wasting time on research and learning, saving the customer time and money.
How many different
platforms does the
company’s Kernel support?
With numerous operating systems and processors in use in terminals today, one EMV Kernel cannot fit all. However manufacturers often have to make their application work across a range of hardware platforms to stay competitive.
Creditcall’s EMV Kernel range includes products for all common platforms
1
2
Are EMVCo pre-certification
testing services provided or
included?
An EMV Kernel supplier should use the same test tools as the EMVCo certifi-cation laboratory before submitting the Kernel for EMVCo certification. This will increase the likelihood of your Kernel passing the formal EMVCo Certification first time, ensuring your project remains within budget and on time.
Creditcall use the same test tools as the EMVCo certification laboratories and to date has a 100% first time pass track record. As pre-certification testing is an iterative process where we normally identify issues, our EMV team can often help you pin point what the issues are and suggest suitable remedies or workarounds.
Does the company have an
excellent relationship with
an EMVCo approved test
laboratory?
Payment devices that incorporate an EMV Level 2 Kernel come in all shapes and sizes from battery powered handheld PIN pads, different types of PoS terminals, right through to floor standing ATMs and ticketing machines. In order to minimise cost, delay and additional complexity the relationship with the EMVCo approved test laboratory is critical.
Over the last 10 years, Creditcall has built a trusted relationship with TÜV Product Service, less than 2 hours from its development centre. TÜV is an internationally renowned testing, qualification and consultancy, and work with Creditcall to maximise efficiency in all aspects of the certifi-cation process, whilst ensuring every detail of the standard is met. Creditcall offers a service where an EMV
Engineer accompanies the equipment to the laboratory to set it up and answer any questions, in addition to assisting the laboratory tester with the more difficult tests.
How many products has the
Kernel been integrated
into?
Every EMV Kernel certification is different and the number of separate products a Kernel supplier has successfully certified their Kernel with is a measure of their breadth of experience and expertise.
Creditcall has successfully undertaken over 100 separate certifications in terminals as diverse as simple PIN pads, ATMs, handheld devices, mobile phones and Windows based ticketing devices.
Do they manage the
EMVCo certification on
your behalf?
A Kernel provider should manage the EMVCo certification process on behalf of the customer.
The EMVCo certification process is often complex and requires that the supplier liaises with EMVCo test laboratory and EMVCo. Creditcall offers a managed EMVCo certification which means all aspects of the certifi-cation are managed, we will even provide links to documentation that needs to be completed and advise when EMVCo requires payment.
Do they offer a source code
escrow service?
For absolute certainty in the maintenance of a critical software component such an EMV Kernel, software escrow can be requested as part of the licensing agreement, such that in the event of the supplier closing down through bankruptcy the source code can be released to the licensee. Creditcall views the request for escrow as the customer’s prerogative, and will fully cooperate with any such
arrangement. For peace of mind, Creditcall uses the well-respected NCC Group for such agreements.
Has their EMV Kernel really
been developed from the
ground up with embedded
platforms in mind?
Many Kernel providers developed their Kernel on larger PC based
environments where processor and memory constraints (both flash and dynamic) are less of an issue. Creditcall developed EMV.LIB and Contactless.LIB specifically for embedded environments with limited memory, processor speed, stack and other resources that are taken for granted in PC based environments. Our embedded products have been used on the most challenging embedded environments from Z180 based systems with 32K of memory to ARM based platforms with less than 256K of memory. Creditcall pioneered the concept of a hardware abstraction layer in relation to EMV Kernels enabling the Kernel to be compiled for virtually any environment with a C compiler.
5
6
7
8
9
10
With numerous operating systems and processors in use in
terminals today, one Kernel cannot fit all. We provide a range of
Kernels to match the architecture of the terminal exactly.
EmvX Windows & Windows CE EMV.LIB Embedded Systems EmvJ Java Contactless.LIB Operating Systems/ Platform Windows 95/XP/7, Windows CE
Any platform that has a C compiler
Any Java Virtual Machine
Any platform that has a C compiler
Supported Development Languages
Any language that supports Windows COM interfaces or .NET (e.g. C++, C#, Visual Basic)
C, C++ Java C, C++
Library Format Windows .DLL using COM interface
Depends on the toolset available (e.g. object files or static library)
.Jar package Depends on the toolset available (e.g. object files or static library)
Advantages Easy to use, handles platform specific functionality automatically Fully ANSI-C compliant and completely Hardware independent, custombuilt for each target platform
Easily portable to any Java platform
Fully ANSI-C compliant and completely Hardware independent, custombuilt for each target platform
Ideally Suited For Retail and kiosk payment applications running on Windows
NFC enabled devices & embedded platforms with limited resources and custom hardware Java-based payment applications andserver-based solution NFC enabled devices & embedded platforms with limited resources and custom hardware
ATM Mobile & Online
EMV Migration
mPOS
Parking Ticketing Vending POS TransportAbout Creditcall
Creditcall makes card acceptance simple from any device, anywhere. Whether
attended, unattended, online or mobile payments, our award-winning EMV-ready
payment gateway and EMV Migration solutions are at the very heart of our clients’
businesses, ensuring payments flow – all day, every day.
Founded in 1996 and with over 14 years of EMV experience, Creditcall has a proven track record in providing payment gateway services and offers EMV Migration solutions that are tried and tested.
Our EMV Migration solution, ChipDNA, is a rapid EMV Migration SDK for Windows, Linux, iOS and Android. It greatly helps ISVs transition from older magnetic stripe technology to EMV and Chip technology. ChipDNA is the easiest and most cost effective way of adding EMV payment functionality into an attended or unattended Point of Sale (POS) application.
We were the first EMV-ready Payment Gateway in the U.S., and completed our EMV certification in April 2014. Our Chip-based EMV Level 1 and EMV Level 2 Kernel software is used globally in contact and contactless environments such as ATMs, mPOS, card readers, PINpads and other POS devices.
We are the first EMV-compliant mPOS solution to allow businesses accept Chip and PIN cards ‘on the go’ via smartphones and tablets.
Millions of users and billions of transactions depend on Creditcall EMV technology each and every day. Creditcall works collaboratively with companies across Europe, North and South America, South Africa and Asia-Pacific to deliver
business-critical payment solutions. Clients include ATOS, DHL, Elavon, Hilton Hotels & Resorts, Toyota, Wayne (a GE Company) and Westfield.
