BIN Sponsorship: Is your organization ready to issue 8-digits BINs? 💳

What is a BIN Sponsorship? 💳

The first 6 digits of the Primary Account Number (PAN) for credit, debit, and prepaid cards are called the Bank Identification Number (BIN). The BIN is generally used to identify the network and card issuers. Other payment information such as country of issue or card type can be reliably determined by what is called “Account Ranges.” These are simply the first 9 digits of the PAN for Visa and the first 11 digits for MasterCard. The BIN ensures that the payment cards sold are in compliance with banking and payment regulations. Financial institutions holding a BIN sponsorship have a number of responsibilities such as having a sufficiently high level of equity, being compliant with regulatory authorities, being a member of a card network (e.g., MasterCard or Visa), and monitoring the compliance of card scheme payment networks. 

The massive growth of credit card issuers in recent years has resulted in a shortage of available BINs. Due to increasing demand by issuers, ISO has introduced a new standard to extend the BIN from 6 to 8 digits. The overall card number length (e.g., from 16 to 19 digits for Visa and MasterCard in Europe) will not change. Visa and MasterCard have implemented the new 8-digit standard from April 2022. 

The new directive has been adopted by the industry  👀

In response to a sharp increase in the number of card issuers, ISO has announced an expected shortage of new combinations of Issuer Identification Numbers (INNs), commonly referred to in the industry as the BIN. By revising its official guidelines in ISO/IEC 7812-1, ISO now requires an extension of the issuing BIN from 6 to 8 digits. While the length of the Primary Account Number (PAN) will remain variable—ranging from 10 to 19 digits—the issuing BIN change will require action across the payments industry, including banks, processors, fintech companies, and the third-party service providers that support them. 

And while it’s now May 2022 (one month after the official launch date for the first 8-digit BINs), there is still significant risk for payment organizations that have failed to get a plan in place as of yet. 

As the COVID-19 pandemic and current economic climate create cost pressures for financial institutions, some payments organizations might be tempted to continue to postpone their preparedness efforts. However, a lack of urgency in determining the magnitude of potential impact may not allow sufficient time to implement the necessary changes. Issuing BIN expansion requires a comprehensive assessment of how BINs are being used in systems and processes, as well as by payment organizations’ technology providers.

Visa and MasterCard have confirmed their support of the revised ISO standard and have adopted it from April 2022. Both networks have stated that acquirers and acquiring processors will need to be ready to operate on 8-digit BINs. Since April 2022, Visa only issues new applicants 8-digit BINs. Six-digit BINs will no longer be issued. MasterCard has adopted the 8-digit ISO standard and has started assigning these new BINs to issuers from April 2022 as well. To help ensure ecosystem readiness, the schemes have required acquirers and processors to be able to support 9 to 11-digit “Account Ranges” with the new 8-digit BIN standard by the end of April 2022. Acquirers are responsible for ensuring that merchants, payment gateways, third-party providers, and other services are able to handle these new “Account Ranges”. Issuers will be able to convert existing 6-digit BINs to 8-digit BINs, but the networks have not yet mandated the conversion of existing BINs. 

Other major networks, including American Express, Diners Club/Discover, and China Union Pay, have not announced a timeline for adopting the new 8-digit BIN. 

What does this mean for banks, processors, and other players in the payments industry? 👨‍💻

Since April 2022, the payments industry will operate with 6 and 8-digit BINs. Most payment organizations will need to update processes and systems to support the new 8-digit BIN and avoid compromising customer service and cardholder protection. The level of readiness will vary considerably depending on how the issuing BIN is used, ranging from limited adjustments to extensive changes in several functional areas and IT systems. 

For example, some acquiring banks use the issuing BIN to route transactions for authorization validation. To account for the length of the issuing BIN, acquiring banks must consider a range of potential impacts, including issuing BIN reference tables, coding and configuration of underlying applications, and point-of-sale systems. 

While the level of preparation will vary, participation in the payment ecosystem from April 2022 requires an ability to process 8-digit BINs. All payments organizations should begin by conducting a comprehensive impact assessment across the organization and suite of supporting applications to help mitigate risk and inform the scope, resource requirements, and implementation timeline for necessary changes. 

The issuing BIN consists of the first 6 digits of the Primary Account Number (PAN), located on credit card, debit card, and on prepaid cards. With this change, the BIN will consist of the first 8 digits of the PAN. The issuing BIN is used globally to identify the bank that issued the card. Issuing banks may have more than one issuing BIN (most do), but each unique issuing BIN can only be authorized by one issuing bank. 

Impact of the change on merchants 🚨

As more stakeholders adopt 8-digit BINs, it will no longer be possible to rely solely on the first 6 digits of the PAN for transaction authorization, routing, and clearing. It is important to note that the problems will not occur all at once, but will intensify as more and more new payment originators use the new 8-digit BIN standard. Points of failure and the severity of failure will vary depending on the specific use of the issuing BIN and the technology configuration. 

If you are using 6-digit BINs for the following activities, you will need to determine the impact of the 8-digit BIN on your back-end systems. The following will be impacted by the 8-digit BIN: 

• Prepaid card identification 
• Fraud and chargeback analysis
• The calculation of fees
• Identification of the issuer
• Transaction routing
• Identification of BINs for fleet cards, corporate cards, and advantage cards 
• Qualification of cashback programs 
• Approval rate optimization and authorization analysis 

.Merchants who fail to change to 8-digits could experience major problems resulting in incorrect routing of transactions, cashback programs being provided to unqualified cardholders, inability to identify participants in loyalty, and exclusive benefit programs resulting in negative impacts to cardholders, and an inability to provide reliable transaction reporting against POS activity. 

How to prepare? 💡

Most of the changes required for merchants and payment industry players are specific to their own internal or proprietary systems. Each merchant must assess the impacts of this change with their acquirers, processors, vendors, third-party agents, and any other partners that support their processing, routing, and all downstream transaction activities. Merchants need to actively engage and assess the impacts within their organization as soon as possible to maximize their effectiveness and avoid unpleasant surprises. 

Any logic specific to the 6-digit BIN that has been implemented in the processing systems must be modified, especially if you:

• Manage your own POS environment 
• Share BIN information with third parties
• Use proprietary BIN "Ranges" (or also provided by third parties) in transaction processing 
• Have system logic that uses the first digits of the card number (PAN)
• Have BIN logic hard-coded into your POS terminals. 

PCI-DSS allows only the first 6 digits and the remaining 4 digits of a PAN to be displayed. That is the only protection it offers to credit card data at rest. If a merchant wants to display a full 8-digit BIN plus the last four digits, they will need to add one or more data protection methods, such as encryption, hashing, or tokenization. Merchants should consult with their Qualified Security Assessor (QSA) prior to implementation. Modifications required by downstream systems during processing for a merchant may require extended lead times. 

Conclusion 

The payments industry is constantly evolving and reinventing itself, but the broad, global nature of the 8-digit BIN expansion makes it different from most industry changes. Every organization that uses issuing BINs will be impacted, and all industry players must act now to understand the risks and prepare for this significant change. As a result of our partnership with Marqeta, Skaleet offers a Core Banking Platform to financial and payment institutions with the ability not only to issue 8-digit BINs for their payment cards but also to manage payment authorizations and card processing while complying with the new standards and rules issued by MasterCard and Visa card networks. This “Best-of-Breed” partnership allows you to accelerate time-to-market, reduce technical resources, access a solution that is compliant and scalable to new regulatory standards, and reduce the cost of launching your payment card program.