During 2019, RPGC conducted research under the sponsorship of the Secure Payments Partnership (SPP) regarding EMVCo’s role as a standards-setting body. The result of this year of research was this whitepaper. 

While EMVCo calls its product outputs specifications, we will use the term “standards.” Since the card brands (e.g. Visa, Mastercard, American Express, Discover, JCB, UnionPay) decree these specifications as the means for participation in their networks these specifications become de facto standards. Because the entire U.S. industry must invest and comply with these specifications, EMVCo specifications, developed jointly with the card brands in an orchestrated strategy, are effectively standards. 

This paper’s operating principle is that standards that exclude certain payment instruments or prevent participants from freely routing payment transactions are collusive, harmful to the U.S. payments industry, and may violate federal law.

 What’s inside?

• Part I includes this introduction, an executive summary, a review of standards and standards-setting organizations, and finally a high-level overview of EMVCo’s organization and its standards-development processes.
• Part II includes an in-depth review of each of the standards for which EMVCo is currently responsible: EMV chip & pin, Near-Field Communication, Network Tokenization, and 3D-Secure 1. This in-depth review covers the standards-development process (to the extent that it is documented), market context and commentary based on interviews with leading industry experts.
• Part III includes an in-depth review of currently deploying solutions 3D-Secure 2 and Secure Remote Commerce.
• Part IV concludes that EMVCo is not an appropriate organization to develop standards that have such a high impact on the U.S. payments industry. Our research spotlights the nature of EMVCo and its relationship with card companies as a tool to deliver standards that further their market dominance.