Source: https://securepaymentstaskforce.org/learn-how-payments-work/payment-profiles/wallet/wallet-regulations-overview/
Timestamp: 2019-04-18 20:48:07
Document Index: 683961108

Matched Legal Cases: ['§ 5311', '§ 1010', '§ 1020', '§ 41', '§ 222', '§ 334', '§ 717', '§ 681', '§ 162', '§ 248', '§ 6801', '§ 1693', '§ 235', 'art 1', 'art 1', 'art 2', 'art 1', 'art 4', 'art 2', 'art 2', 'art 3', 'art 2', 'arts 1', 'arts 1', 'art 1', 'art 1', 'art 3', 'art 4', 'art 1', 'art 2', 'art 3', 'art 1', 'art 1']

Wallet Overview of Laws, Regulations and References on Payment Security (Including Challenges and Improvement Opportunities) – Secure Payments Task Force
Wallet Overview of Laws, Regulations and References on Payment Security (Including Challenges and Improvement Opportunities)
This overview supports the Payment Lifecycle and Security Profile for the Wallet Payment Type.
Wallet Definition: A payment card (e.g. credit or debit) funded transaction whereby a cardholder leverages a digital container accessed by a mobile device (e.g. a smartphone) that stores wallet applications, tokenized payment credentials, loyalty cards, and coupons and is used to make proximity and remote mobile payments. Tokenized payment credentials are either stored securely in the mobile phone [if near-field communication (NFC)] or in the cloud. Wallet transactions may be completed using NFC “pay” wallets (e.g. Apple Pay, Samsung Pay, Android Pay), cloud-based card-on-file wallets (e.g. PayPal, Pay, Amazon), cloud-based card-on-file card network digital “checkout” wallets (e.g. Express Checkout by American Express, Masterpass, Visa Checkout) and closed-loop merchant or financial institution quick reference (QR) code closed wallets (e.g. Chase Pay, Walmart Pay). These transactions may also have the ability to support biometrics, PIN and signature for consumer authentication.
Note: See the Regulations section for the applicable funding method (e.g., ACH, credit or debit card).
Financial Crimes Enforcement Network (FinCEN) Bank Secrecy Act, 31 U.S. Code (U.S.C.) § 5311, et seq.; 31 Code of Federal Regulation (CFR) § 1010.100, et seq. (implementing regulations); Federal Financial Institutions Examination Council (FFIEC), Bank Secrecy Act/Anti-Money Laundering Examination Manual (2014).
Customer Identification Program (CIP) 31 CFR § 1020.220, et seq.
FFIEC Multi-Factor Authentication (MFC) Guidance (for safe mobile applications)
MFA and re-authentication
Maintenance – annual mobile application testing
Use of geo-location for fraud control, transaction monitoring
Open Web Application Security Project (OWASP) standards
Identity Theft Red Flags Rules 12 CFR § 41.90 (OCC); 12 CFR § 222.90 (FRB); 12 CFR § 334.90 (FDIC); 12 CFR § 717.90 (NUCA); 16 CFR § 681.1 (FTC); 17 CFR § 162.30 (CFTC); 17 CFR § 248.201 (SEC)
Gramm-Leach-Bliley Act (1999), 15 U.S.C § 6801 et seq.
Durbin Amendment 15 U.S.C. § 1693o-2; 12 CFR § 235.1 et seq. (interchange transaction fees)
American National Standards Institute (ANSI) X9.8-1 Personal Identification Management (PIN) Management and Security Part 1: PIN protection principles and techniques for online PIN verification in ATM & POS systems (equivalent of ISO 9564)
Applicable to institutions responsible for implementing, managing, and protecting PINs
Provides the minimum security measures required for effective international PIN management (ATM and POS)
Includes PIN protection techniques applicable to card payments initiated in an online environment
Provides a standard means of interchanging PIN data
International Organization for Standardization (ISO) 9564 Banking PIN Package
Provides businesses, government agencies, and other organizations with tools needed to protect against the theft and misuse of personal and financial information
Covers management and security requirements for online / offline PIN handling in ATM and POS systems
ANSI X9.24-1 Retail Financial Services Symmetric Key Management Part 1: Using Symmetric Techniques
Specifies minimum requirements for the management of keying material
Covers manual and automated management of keying material used for financial services such as POS transactions and ATM transactions; messages among terminals and financial institutions; interchange messages among acquirers, switches and card issuers
Deals exclusively with management of symmetric keys using symmetric techniques
This part of this standard does not cover message format, communications protocol, transmission speed, or device interface
ANSI X9.24-2 Retail Financial Services Symmetric Key Management Part 2: Using Asymmetric Techniques for the Distribution of Symmetric Keys
May apply to internet-based transactions, but only when such applications include the use of a tamper resistant security module (TRSM) as defined in section 7.2 of ANS X9.24 Part 1 to protect the private and symmetric keys.
Deals with management of symmetric keys using asymmetric techniques and storage of asymmetric private keys using symmetric keys
ISO/International Electrotechnical Commission (IEC) 7816-4 Identification cards –Integrated circuit cards Part 4: Organization, security and commands for interchange
Independent from the physical interface technology
Applies to cards accessed by one or more of the following methods: contacts, close coupling, radio frequency
ANSI X9.122 Secure Customer Authentication for Internet Payments – Draft in approval stage (Note: It says that to use PIN you must use the Standards already referenced in PIN)
Covers passcodes, passwords, biometrics, magnetic strip authentication values, cryptography, small device authentication, and vendor considerations
ANSI Accredited Standards Committee (ASC) X9.119 Retail Financial Services – Requirements for Protection of Sensitive Payment Card Data
Part 2: Implementing Post-Authorization Tokenization Systems standard focuses on the Tokenization Service and the Token Request Interface. It defines the minimum security requirements when employing a post-authorization tokenization system to protect sensitive payment card data. “Protection” refers to maintaining the secrecy and integrity of the data protected by tokenization from unauthorized disclosure and modification. Data encryption, integrity protection, and the support for key management services are required to protect sensitive payment card data during the tokenization and de-tokenization process
ISO/IEC 18033-2 – Security techniques – Encryption algorithms – Part 2: Asymmetric ciphers – Encryption (or encipherment) techniques protect the confidentiality of stored or transmitted data. An encryption algorithm is applied to plaintext or cleartext data to yield encrypted data (or ciphertext). The encryption algorithm should be designed so that the ciphertext yields no information about the plaintext except, perhaps, its length. Every encryption algorithm has a corresponding decryption algorithm, which transforms ciphertext back into its original plaintext. An asymmetric, i.e. public-key, encryption scheme allows a sender to use a recipient’s public key to transmit an encryption of a message to the receiver, who uses his secret key to decrypt the given ciphertext to obtain the original message.
ISO/IEC 18033-3 – Security techniques – Encryption algorithms – Part 3: Block ciphers A block cipher is a symmetric encipherment system with the property that the encryption algorithm operates on a block of plaintext, i.e. a string of bits of a defined length, to yield a block of ciphertext. The following algorithms are specified in this standard:
ANSI ASC X9.97 Secure Cryptographic Devices (Retail)
To state the requirements concerning both the operational characteristics of secure cryptographic devices (SCDs) and the management of such devices throughout all stages of their life cycle,
Part 2: Security Compliance Checklists for Devices Used in Financial Transactions – Identical to ISO 13491, which specifies use of checklists to evaluate Secure Cryptographic Devices (SCDs) incorporating cryptographic processes, as specified in parts 1 and 2 of ISO 9564, ISO 16609 and parts 1 to 6 of ISO 11568, in the financial services environment. IC payment cards are subject to the requirements identified in this part of ISO 13491 up until the time of issue, after which they are regarded as a “personal” device and outside of the scope of this document.
44 – Key Establishment Using Integer Factorization Cryptography – RSA – Integer Factorization Cryptography
133 – Identity Based Encryption for Financial Services Industry (in drafting stage) – Encryption algorithms used to attain standard levels of cryptographic strength when using the identity of a user (or application) as the public key, as banks often do.
42 – Public Key Cryptography for Financial Services Industry: Agreement of Symmetric Keys Using Discrete Logarithm Cryptography – Diffie-Hellman – Discrete Logarithm Cryptography. Adapted from ISO 11770-3.
98 – Lattice-Based Polynomial Public Key Encryption Algorithm Part 1: Key Establishment
63 – Key Agreement and Key Management Using Elliptic Curve-Based Cryptography – Interoperable Method for Distribution of Symmetric Keys using Asymmetric Techniques
TR 34 Part 1 – Using Factor Based Public Key Cryptography Unilateral Key Transport
TR 31 – Interoperable Secure Key Exchange Key Block Specifications for Symmetric Algorithms
ISO 11770-3 Information technology – Security techniques – Key management – Part 3: Mechanisms using asymmetric techniques
102-2008 Key Wrap Standard – for symmetric key block ciphers whose block size is either 64 bits or 128 bit
69-2012 Framework for Key Management Extensions – Symmetric cryptographic algorithms – Key extensions
79-4-2013 Public Key Infrastructure – Part 4: Asymmetric Key and Public Key Infrastructure
24 Retail Financial Services Symmetric Key Management
Part 1- Symmetric Key Management
Part 2- Using Asymmetric Techniques for the Distribution of Symmetric Keys
Part 3- Derived Unique Key Per Transaction (AES-DUKPT) Symmetric Key Management using AES DUKPT. This is the new standard replacing Triple DES – TDEA.
TR-34-1-2012 Interoperable Method for Distribution of Symmetric Keys using Asymmetric techniques-Part 1 Using Factor Based Public Key Cryptography Unilateral Key Transport – Technical Report provides guidelines for secure exchange of keys using asymmetric techniques between two devices that share asymmetric keys
ISO 15782 (similar to ISO X9.79-4) Certificate management for financial services –Part 1: Public key certificates – defines a certificate management system for financial industry use for legal and natural persons that includes credentials and certificate contents, Certification Authority systems, including certificates for digital signatures and for encryption key management certificate generation, distribution, validation and renewal, authentication structure and certification paths, and revocation and recovery procedures. Also recommends some useful operational procedures.
ANSI ASC X9.124 Format Preserving Encryption of Financial Information – Format Preserving Encryption is useful in situations where fixed-format data, such as Primary Account Numbers or Social Security Numbers, must be encrypted, but there is a requirement to limit changes to existing communication protocols, database schemata or application code. Format Preserving Encryption Counter Mode is a particularly simple and efficient mechanism to achieve format preserving encryption, which shares many of the strengths and challenges of Counter Mode (CTR) as defined in NIST SP38B.
National Institute for Standards and Technology (NIST) SP 38B – Recommendation for Block Cipher Modes of Operation: The CMAC Mode for Authentication – This Recommendation specifies a message authentication code (MAC) algorithm based on a symmetric key block cipher. This block cipher-based MAC algorithm, called CMAC, may be used to provide assurance of the authenticity and, hence, the integrity of binary data.
SimAlliance (Near Field Communication (NFC) with Host Card Emulation (HCE) or secure element) Access mode/network credit/debit
Protection of payment credentials
Communications between mobile device and POS terminal
Global System for Mobile Communication Association (GSMA) NFC Core Wallet Requirements and Mobile Wallet White Paper (WP) (NFC with HCE or secure element) credit/debit
Communication between mobile device and POS terminal
Includes algorithms for PIN encipherment and open network PIN handling
EMV QR Code Specification for Payment Systems – Consumer-Presented Mode Version 1.0 and the EMV QR Code Specification for Payment Systems Merchant-Presented Mode Version 1.0
Source: https://www.emvco.com/emv-technologies/qrcodes/
Defines security requirements and assessment procedures for software vendors of payment applications. This document is to be used by Payment Application Qualified Security Assessors (PA-QSAs) conducting payment application assessments to validate that a payment application complies with the PA-DSS.
Secure payment applications, when implemented in a PCI DSS-compliant environment, will minimize the potential for security breaches leading to compromises of primary account number (PAN), full track data, Card Verification Values 1, PINs and PIN blocks, and the damaging fraud resulting from these breaches.
Provides a method for providers of P2PE solutions to validate their solutions, and for merchants to reduce the scope of their PCI DSS assessments when using a validated P2PE solution for account data acceptance and processing. Specifically, this version contains validation requirements and testing procedures for hardware/hybrid solutions which utilize secure cryptographic devices at the point of merchant acceptance for encryption and for managing cryptographic keys in the decryption environment while utilizing non-SCDs for the decryption of account data.
Provides vendors with a list of all the security requirements against which their product will be evaluated in order to obtain Payment Card Industry (PCI) PIN Transaction Security (PTS) Point of Interaction (POI) device approval.
Global Platform Specifications for secure/interoperable deployment and management of applications on Secure Element (SE), Trusted Execution Environment (TEE) (NFC with SE or TEE) Access mode/network credit/debit
European Payments Council (EPC) credit and debit
EPC492-09 Mobile Payments WP
EPC178-10 Mobile Contactless SEPA Card Payments Interoperability Implementation Guidelines
Mobey Forum (global back focused) analysis and education on mobile wallets (NFC with secure elements) Access mode/network credit/debit
National Institute of Standards and technology (NIST) Cybersecurity Framework (CSF) and Sector-specific variations (Profiles) under development by leading financial services organizations. The CSF was mandated under and Executive Order 13636 in February of 2013 and has had significant domestic and international influence on not only the standardization of cybersecurity practices, but also on regulatory oversight activities. The CSF remains a voluntary standard, but regulators strongly encourage its use and adoption.
Tokens have the opportunity to improve security in the payments ecosystem, and standards would enable more interoperability and the use of tokens in various applications.
The market has evolved to offer different kinds of mobile/digital wallets models. These models may vary in authentication, enrollment, use of tokenization, etc. They can be roughly categorized as the following types: NFC Pay Wallet (e.g. Apple Pay, Android Pay, Samsung Pay), cloud-based wallets with QR codes for POS contactless payments (e.g. Chase Pay, Walmart Pay), eCommerce wallets with Guest checkout, eCommerce wallets with card on file (e.g. Amazon, PayPal), digital checkout wallets provided by card networks (e.g. Visa Checkout, Masterpass, American Express Express); and in-app mobile application wallets (i.e. iTunes and others to access special content or features in a video).
Each wallet accepts a mix of payment methods but not all of the mixes are the same: depends on the wallet type.
Continued development and evolution of best practices for validating card credentials stored in a digital/mobile wallet may help enhance security.
1Card Verification Values: Card Verification Values represent data elements that are (1) encoded on the magnetic stripe or the chip of a payment card; or (2) printed on the physical payment card and are used to validate the card information during the transaction authorization process. Card Verification Values encoded on the magnetic stripe (e.g. CAV, CVV, CVC, CSC) or on the chip (e.g. dCVV, iCVV) are generated via a secure cryptographic process and may be static or dynamic data used to validate the card during the authorization process. Card Verification Values printed on the physical card (e.g. CID, CAV2, CVC2, CVV2) may be three-digit or four-digit codes printed on the front or back of the physical card that are uniquely associated with the physical card and ties the primary account number to the physical card. Note: Payment network rules and the PCI Security Standards Council provide additional definitions of Card Verification Values.