Terminal Quality Management Overview 2010

1. Terminal Quality ManagementOverview2010

2. Agenda • Scope • Requirements • Benefits • Process • Recommendations for TQM implementation • Fees • Contact

3. TQM scope overview Scope • Relevant devices: Terminal Level 1 Components - for contact: InterFaceModules (IFMs) - for contactless: Proximity Coupling Devices ( PCDs) • Relevant Vendors: Vendors developing products embedding an IFM or a PCD Requirements • Same structure as ISO 9001 • Focus on configuration management MethodologyBased on assessment of questionnaires with surveillance by audits.

4. TQM scope - EMV Level 1 Vs Level 2 OSI Model EMV Specifications Product Components 7 Application Level 2 Component = Application Level 2 6 Presentation 5 Session 4 Transport Level 1 Component = IFM for contact Or PCD for contactless 3 Network layer Level 1 2 Data link layer 1 Physical layer TQM only focuses on Level 1 Component (s)

5. Terminal PCD/IFM Level 1 Level 2 TQM scope - Product Configurations in the field Fully Integrated Terminal • Terminal Card Reader Terminal and • PCD/IFM Intelligent Card Reader Level 1 Level 2 Terminal and Terminal • Card Reader PCD/IFM Transparent Card Reader Level 1 Level 2 = Products subject to TQM PCD = Proximity Coupling Device IFM = InterFace Module

6. TQM scope - Terminal Type Approval Level 1 Terminal Type Approval Level 1testing TTA L1Success Terminal Level 1 • Valid only for the tested sample: • Specific Level 1 component containing specific HW + SW • Embedded in specific product (s) • Is compliant with the relevant specification One sample Prototype/ Pre-series The vendor has been able ONCE to develop ONE compliant product configuration

7. TQM scope - Terminal Level 1 within a Product Product Level 1 A change in one of these parts may impact the PCD/IFM functionality Level 1 component: PCD or IFM Level 1 Component interface Product Part without impact on PCD/IFM functionality

8. TQM scope - EMVco policy on changes • Major change does require new Type Approval • Vendor is responsible for assessing whether the change is minor or major and for demonstrating to the Acquirer that the change is minor. Source EMVco bulletin 11

9. TQM requirements • TQM requires the vendor to have implemented a Configuration Management System ensuring that: • The identification of the PCD/IFM and the PCD/IFM interface is sufficient and allows efficient impact analysis of changes on EMV compliance • Appropriate processes are implemented to control and improve the Product configuration management from R&D to maintenance.

10. TQM requirements - Configuration management • MasterCard needs to be confident that: • Product configuration is controlled by the Vendor • Identified • Recorded • Checked • Impact of changes is assessed • Subsequent unauthorized alterations are prevented (guidelines for maintenance, process for information release to manufacturing sites, etc..) That is the TQM purpose

11. TQM added value • A TQM Label gives confidence that products are compliant with level 1 spec. • products manufactured in volume, • products which embed an approved IFM or PCD, but different from the tested model, • products which embed an updated version of an approved IFM or PCD,

12. For the Acquirer Vendor change management is reliable and takes into account EMVCo change policy Configuration management of the products will be controlled and continuously improved by the vendor . Interoperability issues will be managed following a controlled process by the vendor. For the Vendor A means to demonstrate to Acquirers that changes done on their products are only minor changes. Allow more design flexibility with less cost for approvals. Give a marketing advantage. Benefits

13. MasterCard TQM Label TQM process - Overview Mandatory process Conditional process Vendor Registration with Assessment Body Subcontracted to Assessment Body Product Registration Renewal Completion of TQM Questionnaires TQM Compliance Assessment TQM Audit Test of Product Samples TQM Label Recommendation and Preparation TQM Label Grantingby MasterCard

14. TQM process - Outsourcing • MasterCard has arranged for its Terminal Quality Management scheme to be administered by TÜV Product Service. From now on, the TQM primary contact is: MrDale WHITAKER tqmtuv@tuvps.co.uk +44-1489-558342 • All your requests for registration, product plan number, documentation, granting of labels, TQM project management, etc. should be sent directly to tqmtuv@tuvps.co.uk

15. TQM process - Product registration • Objective • Identification of each Vendors IFMs or PCDs requiring a TQM label. • Agreement on submission timescale • Key Steps • Vendor completes an Application Form listing all IFMs/PCDs that need a TQM label) and proposes dates for submission of TQM Questionnaires. • Assessment Body confirms the schedule or agrees with the Vendor on a modified schedule. • Assessment Body assigns a TQM Project Plan number for each PCD or IFM that needs one. • Outcome • Acknowledgement granted by granting of Project Plan number*. ( * formerly called action plan number)

16. TQM process - TQM is not required for • Terminals not subject to TIP, (Terminal Integration Process) • End-of-life products (no longer being manufactured)

17. Vendor Organizational Description (VOD) Valid whatever the PCD or IFM Objectives: Configuration Management System description Identification of organizational changes done after last assessment Corrective actions follow up, Type Identification Description (TID) Specific to one PCD or to one IFM Objectives: Description of the TTA L1 tested configuration Description of all the PCD/IFM “evolutions” Description of all the PCD/IFM implementations within products Identification of product changes done after last assessment Corrective actions follow up, TQM process - Questionnaires Based on self-assessment

18. TQM process - Recommendation to MasterCard • Objective • The assessment body to make a recommendation to MasterCard concerning the TQM Label* granting • Key Steps • Assessment Body send to MasterCard: • The list of IFMs/PCDs involved in the TQM project • A management summary of the TQM project • The final audit report(s), if any • A recommendation for the granting of TQM label(s). *Note that “TQM Label” means a unique reference allocated to an IFM/PCD following MasterCard’s acceptance of the TQM recommendation. Vendors will receive a “Statement of Compliance” listing all their TQM Labels. A physical label is not required to be attached to a terminal.

19. Recommendations for TQM implementation: • Keep written documentation simple • No need for translation into English • Shorter is better • Just improve existing documentation when needed • Use existing processes • Just improve existing process when needed • Use existing tools

20. TQM pricing for EMV Contact and PayPassservices Delivered by TÜV Product Service Note 1: Vendor Registration + 1 or 2 VODs + First TID

21. Contact • TQM assessment body contact: • tqmtuv@tuvps.co.uk • MasterCard contact (for escalation purpose only): • tqm@mastercard.com