With EPP upgrades, ATM operators save money and meet security standards

Source: ATM Marketplace - By Gary Wollenhaupt, Contributing Writer

As security requirements for ATMs evolve, operators have to economically manage the transition from one set of regulations to the other. Upgrading existing ATMs fleets is the most economic way to ensure compliance, rather than replacing the entire inventory. 

After the Payment Card Industry Security Council took over administration of security standards for PIN pads from Visa Inc.’s PIN Entry Device program, the industry has gone through a transition period in which relatively new machines may not meet the current standards. The Visa regulations are also known as pre-PCI, to denote the change in management of the administration. Since the changeover, the PCI Digital Security Standards govern the industry. 

Visa did not establish a sunset date for devices that were on the approved list at the time of deployment. According to Visa, deployed devices with an approval that expired Dec. 31, 2007, may continue to be used after that date. The expiration date applies to new purchases/deployments, and not existing deployments. 

Basically, machines that were installed prior to the deadline can remain in place. But ATM operators must be cautious when moving machines among location so that it is considered relocation and not a new deployment of a machine that then would trigger the requirement to meet current compliance requirements For instance, if a machine is moved from the field back to a warehouse and then back out to the field, it is considered a new deployment. 

Although approval for all pre-PCI PEDs expired, manufacturers can upgrade the machines and have them re-tested and approved. Visa cautions that no devices subject to PCI standards should be purchased after their approval expiration date. 

The regulations have been in place long enough now that ATM operators or vendors may be feeling locked in to a fleet of machines that cannot be moved from their present location without being upgraded. An ATM location may close, and the operator may want to relocate the machine, or put in a larger machine to handle increased volume. But the lack of an up-to-date PIN pad can make the machine obsolete, when it is otherwise still serviceable. 

Most recent ATMs can be upgraded with a PCI-compliant EPP and returned to service in a new location. That saves a significant amount of investment compared to purchasing new compliant machines. But the key is choosing an EPP for upgrading that meets the current PCI standards and will provide long, reliable service.

One project involved installing BBS Denmark EPPs in one model of Greenlink’s own machines. 

The second required installing PCI-compliant EPPs into a fleet of Tidel is2000 units. 

Choosing the right PIN pad for the upgrade project was simple, according to Charlie East, chief executive officer for Greenlink. 

“The BBS Denmark EPP was the best fit for that model of ATMs, it had the look and the feel of the Tidel/NCR line,” he said. 

East selected BBS Denmark model USA-1217 PIN pad for the upgrade project. First, it’s fully PCI- and Triple DES-compliant, like all BBS Denmark models. Stainless steel keys in a polymer frame will stand up to years of use, and customized layouts are available. The raised keys comply with current disability standards as well. 

With upgraded EPPs that meet security requirements, the ATM owner could redeploy the inventory according to current business needs. The machines are no longer locked in to their existing location by outdated components. 

East was comfortable with specifying BBS Denmark EPPs, given the company’s position in the marketplace. 

“BBS Denmark is the leader in the industry, and they’ve been building EPPs as along as anyone and built them for most of the major manufacturers,” he said. “They’re basically the default choice.”