Evan Schuman's StorefrontBacktalk

What TIP says is that after next October, a merchant meeting the program requirements does not need to re-validate its compliance. In other words, participating merchants are on the honor system for PCI. They neither need a QSA to assess their compliance, nor do they even need to file a self-assessment questionnaire (SAQ). In the past, when the card brands wanted merchants to introduce new technology, they offered incentive (i.e., lower) interchange rates. This time, Visa is offering no interchange fee discount. Instead, the incentive is the opportunity for Level 1 and some Level 2 merchants (those with more than one million Visa transactions a year) to reduce the cost of their outside assessment. Bottom line: TIP doesn’t cost Visa or its issuers a penny.

Before, issuers paid for merchants to implement new technology (e.g., TIIF and TIIF2 incentive interchange rates). Now they are saying, “Hey, we’ll keep the interchange but save you having to pay QSAs. But if you get breached, the same fines apply.” Neat. They’re transferring who pays.

It is unclear what benefits TIP holds for small and midsize merchants. These merchants self-assess their compliance. If they hire a QSA, it usually is to consult on improving their security, so TIP by itself may not be a particularly significant incentive for these merchants to make the investment in EMV compatibility.

A separate bulletin announced a liability shift that was similarly designed to stimulate implementing an EMV infrastructure. It is this liability shift that may prove to be the incentive that gets every merchant to move.

Effective October 2015, the liability for any U.S. counterfeit transaction (domestic or cross-border) will shift to “the party that is the cause of a chip-on-chip transaction not occurring.” That means a merchant or acquirer that does not make the investment in EMV dual-interface terminals and infrastructure, or an issuer that does not move to chip cards, will be on the hook financially for all card-present fraud.

This point is worth repeating: Merchants, acquirers and issuers that are not capable of processing EMV chip transactions in four years will eat all POS fraud losses. Here’s my simple-minded interpretation of the liability shift: Every cardholder in the U.S. will have an EMV chip card in about four years.

The three themes in Visa’s plans are improving security, speeding the acceptance of mobile payments and accelerating changes in the U.S. infrastructure to enable EMV technology.