Palmaris Instant Issuance Gökhan Kiraz – Product Group Manager

1. Palmaris Instant Issuance Gökhan Kiraz – Product Group Manager

2. CARDTEK Product Range Prepaid Card Payment Processing Integrated Testing • EMVAnalyzer • SmartQuality • payWave Analyzers • PayPass Analyzers • Personalization Validation System (PVS) • MassQuality • EMV VMPA/MMP Analyzer • Credit Card Management • Debit Card Management • Clearing and Settlement • Dispute and Chargeback Management • ATM Management and Monitoring • Terminal and Merchant Management • Transaction Switch • City Card • Campus Card • Transportation Card • Gift Card • VISA/MC or Closed Loop Loyalty and Campaign • Loyalty Management Terminal and Card Kernel EMV Migration Mobile Payment • MCHIP/VSDC Applet for Chip Card • Level2 Kernel Visual Simulator • Contact&Contactless Level2 Kernel • Card&Application Management • EMV Script Management • Native Platform Scripting • SPKM (Data Prep&Key Man. System) • SmartSoft Mobile Solution Platform • Micro SD Mobile Payment Applets • Mobile Phone Midlet • Trusted Service Manager Fraud Detection & Prevention E-Banking Personalization • Payment Fraud Management System • Oracle Adaptive Access Manager • Central Issuance System • Instant Issuance System • SmartSecure CAP/DPA/OTP • SmartNetBank@Home

4. 360Degree Banking Solutions SmartSoft, offering innovative and imaginative solutions in the field of smartcard technologies between 2001 and 2006, has launched its operations in the field of card payment systems in 2006 and once again proven its ambition and leadership in this field as well.

5. PaymentSystemsRelated Hardware Manufacturing Established also in 2009 in order to satisfy innovative hardware needs of the sector in niche projects in a rapid and reliable fashion.

6. Banking & Non-bankingProcessingServices Foundedin 2009 in order to develop interactive solutions intended for the world of payments and focusing on the banking and loyalty applications, ‘city card’ and ‘city banking’ implementations, new generation processing solutions, public sector-based solutions and services.

7. In line with the global growth strategy of the Group, Cardtek USA brand was launched in the US and Canada in 2010

8. Specialized on NFC&MobilePayment Solutions... Phaymobile, founded in 2011 in order to develop solutions for mobile payment systems, along with other group subsidiaries

9. Cardtekis offering EMV Training & Consultancy Services via its subsidiary, SmartSoft, which is one of the accredited companies globally by MasterCard. These courses cover all the aspects of EMV from basics to deep technical and may be well organized to address all the management levels.

10. “FIRST” Projects Carried out in TURKIYE and the WORLD 2006 The FIRST contactless credit card - Garanti Bank 2006 The issuing of a contactless credit card for the FIRST time via the instant issuance technology - Garanti Bank 2007 The FIRST contactless credit card in transportation- Garanti Bank 2007 One of the 3 NFC pilot projects in the World - Akbank 2008 The World’s FIRST EMV campaign Transportation card (MasterCard) - Bankasya 2008The World’s FIRST e-banking CAP Scripting Application SmartNet– Bankasya 2009 The Credit Card replacing cash (VISA)

11. “FIRST” Projects Carried out in TURKIYE and the WORLD 2010The FIRST MasterCard approved credit card with a display in the World – Turk Economy Bank 2011The FIRST in Europe with micro-SD- Akbank-Visa, Bankasya-MasterCard 2011The FIRST IphoneiCartein Europe - YapıKredi Bank 2011Europe’s FIRST MasterCard approved TSM operator– Turkcell 2011The FIRST Pre-paid System to carry out transactions equipped with NFC technology - Denizbank (Dexia) 2011The FIRST KGS NFC Project-Bankasya

12. AwardsSmartSoft • 2006 “Excellence in PaymentInnovation” Awardby EPCA for “BranchBasedInstantCard Printing System” in the “MostInnovative Software Product” category • 2008 Finalist in “Transportation” categoryamong 223 companiesparticipating in SESAMES • 2009 “Best Cash DisplacementInitiative” Awardfor “InnovativeContactless Bank Asya CreditCardcalledAsyaCard DIT” in “Visa Europe Best Card & PaymentSectorAwards”  (Service provider: SmartSoft). • 2009 “Best New CreditCard Product Launch” Awardfor “Bank Asya CreditCardcalledAsyaCard DIT” at “Cards & PaymentsOrganization” (Service provider: SmartSoft) • 2009ISO InnovativeAwards in the "Human Resources" category

13. 2010Zebra “Best Card Printer Project Award” 2010“The Most Innovative MasterCard® PayPass™ Product Support in Turkey” Award 2010European Identity Awards 2010 “Best Internal Project” (Sekerbank / SmartSoft – Oracle collaboration) 2010SmartWardAwards, "The Most Effective Project of The Year" 2010Deloitte Technology Fast50 and Fast500 Ranking 2010Payment Systems Magazine, Stars of 2010 "Product of the Year : PROCEED« 2011 ACT CanadaInnovationAward“PALMARIS” 2011Deloitte Technology Fast50 and Fast500 Ranking 2011Ishad “Business Life Success Award”

15. CardtekWorldWideCustomers • Asia • Azerbaijan • Philippines • Indonesia • Europe • France • Germany • Italy • Austria • Poland • Belgium • Greece • Slovakia • Romania • Moldova • Middle East • Saudi Arabia • Kuwait • UAE • Iran • Bahrain • Israel • Africa • South Africa • Nigeria • North America • Canada • USA

16. AGENDA

17. Why Instant Issuance • Eliminate delay and costs in delivery • Increase debit/credit usage rates • Increase customer service level • Maximize cardholder convenience First step of NFC Migration with Micro-SD Cards • Helps to gain new customers • Good customer experience when replacing lost or damaged card

19. Instant Card Issuance vs Traditional Card Issuance Traditional 1 card 40sec. 0 (zero) Distribution cost Instant

21. Palmaris Personalization Systems Market Recognition 10 years experience on card issuance solutions Wide experience on chip card technologies (Native Cards, Java, Multos cards) End to end solution provider 20+ Installations in Turkey, USA, Canada, Italy, Moldova, UAE, Azerbaijan... • 70% of Turkish market share (EMV, Contactless, NFC, Micro SD, Prepaid, Loyalty cards) More than 50 million cards are issued per year. • EPCA/ECR awarded the system as “Most Innovative and AdvancedPaymentsSoftware/HardwareProduct” (First SW company in Turkey who won this award)

22. Palmaris Personalization Systems Market Recognition ** 99,67% of branches using instant issuance solution preferred Cardtek .

25. Palmaris Instant Issuance Solution Overview Palmaris Instant Issuance system is a turn key solution for personalization of both contact & contactless EMV and magstripe cards in branches.

27. Palmaris Instant Issuance – System Modules

29. Database Connection MSMQ Database Connection Web Service Database Server IIS Server Application Server CMS Payment Processing System Bank H.Q Encrypted SSL/TCP-IP HTTPS Branch Application Bank Branch

31. Palmaris Instant Issuance Workflow

32. Issuance Steps-0 Bank Branch Application Form Customer fills the application form with necessary information (name, address, etc.) and give it to the banking clerk.

33. Issuance Steps-1 Cardholder Data Bank Branch Cardholder data is sent to banking host system. If the issuance request is accepted by bank headquarter, the process begins.

34. Issuance Steps-2 Database Server Magnetic Data List Banking host system creates the magnetic data for card issuing then sends it to database (via Web Service) which is shared by SPKM. • Data List that send to the shared database • Branch Code • Service Code • Track 1, Track 2 • CVV2 • Cardholder Name • PAN Number • Validity Start Date • Encrypted PIN Block...etc

35. Issuance Steps-3 EMV security keys, certificates, digital signatures Magnetic Card Information Database Server 1 HSMs 2 HSM Server Chip Data SPKM Magnetic Card Information coming from the database server to SPKM and those data is processed by SPKM to produce EMV Data element sets to the relevant records defined in profiles. At the same time in SPKM all relevant EMV security keys, certificates, digital signatures are produced according to predefined SPKM profiles.Hardware security module (HSM) is used during all security sensitive operations. Then magnetic data, EMV profiles (EMV Tag Values), payment keys and certificates are composed as a chip data and this chip data sent to the database for quality control.

36. Issuance Steps-4 EMV Chip Data Control Database Server PVS (Personalization Validation System) Personalization Validation System, SmartSoft’s unique product, controls the correctness of chip data in order to prevent wrong personalization before issuing. If it detects an error in chip data, it doesn’t allow to access next steps and report the situation.

37. Issuance Steps-5 Database Server (ORACLE , MS SQL, IBM DB2) Keys Personalizer 2 PVS 1 Branch Manager Initiation Message After PVS allows the personalization (it can be also seen in the related branch screen as a personalization ready message), bank branch can trigger off the personalization via WEB interface, then Personalizer module gets chosen record (chip data) from the Database.

38. Issuance Steps-6 HSMs HSM Server Personalizer According to branch information, Personalizer communicates with the related branch. Then, Personalizer starts personalization process: 1-Access the HSM server and gets related keys (Card Authentication KeysKMC, CMKac, CMKMac, CMKenc and Issuer KeysKEK-PEK, AC, MAC, ENC). 2- Prepare perso commands (Card Authentication Commands, Card Structure Creating Commands (EF-DF), Data Writing Commands)

39. Issuance Steps-7 Perso Batch Commands Perso Batch Commands Branch Manager&Receiver Personalizer 3- Personalizer sends encrypted perso batch commands to receiver (Branch). 4- Receiver gets related commands and send them to Card Printer machine sequentially.

40. Issuance Steps-8 Post Perso Quality Control Branch SmartQuality After personalization, SmartQuality controls the issued card. If it detects an error, the system wastes the card and the card is not delivered to the customer. If the quality check resulted assuccessful, the card is delivered to the customer. In addition, in branch manager screen operator can see the image of the card and able to control visual quality of the card.

41. Issuance Steps-9 Perso Accomplished Flag Bank Host (CMS) BranchManager In addition, Branch Manager sends perso accomplished flag to the Bank’s Card Management System. Then, card personalization situation is updated.

43. Crucial Features of the System

44. Crucial Features of the System • Card Vendor Independent System • Personalization Machine Independent System

45. Crucial Features of the System • PCI/DSS Compliancy • Support Various Type of PIN Deployment Method

47. Best Performance

49. Case Study, Everlink Processing company in Canada processing 600 M transactions annually Changed its existing vendor with SmartSoft because : • Expertise in chip cards technologies • Short implementation time • Complete project management • Advanced product features • Offering this service to its existing 300+ Credit Unions and bank customers

50. Case Study, Network International Largest acquirer and one of the leading payment solutions providers in the Middle East Region Central and Instant Issuance services are given by Network International to Warba, Emirates NBD, Al Rajhi, BMI banks for now.