Preparing for Eight-Digit BINs
Available Now, April 2022 Final Effective Date
EIGHT-DIGIT BIN IS AN INDUSTRY STANDARD CHANGE (ISO/IEC 7812-1)
- The payments business is growing at a rapid pace, in part due to innovation. This growth has
put pressure on the industry to ensure availability of Bank Identification Numbers (BINs) which
comprise the first digits of the Primary Account Number (PAN) and facilitate financial institution
identification to stakeholders within the payment ecosystem. BINs are foundational to our
business and are governed by the International Organization for Standardization (ISO).
- To determine the best path forward, ISO convened payment industry stakeholders from around
the world. After much discussion, they agreed to expand the length of the issuing BIN from six to eight digits and ISO announced the new standard in 2017.
- Visa supports this industry change and our systems are now ready to handle eight-digit BINs.
Effective April 2022, Visa clients (acquirer and processor) must be able to support the new issuing BIN length. Issuers can set their own timeline for BIN expansion.
- ISO is now assigning eight-digit BINs to new requestors. Given that the number of eight-digit BINs in the payment ecosystem will continue to increase over time, Merchants who make these necessary changes will be well positioned to support their clients’ needs and build their business. Those not prepared to handle the new BIN length risk negative impacts to both their clients and brand.
HOW THIS CHANGE IMPACTS MERCHANTS
- As more stakeholders adopt eight-digit BINs, it will no longer be possible to rely on the first six digits of the PAN for authorization, routing and transaction clearing. It is important to note that all risks will not occur immediately, but rather will ramp-up as more payment originators make use of the new eight-digit BIN standard. Failure points and severity will vary depending on the specific usage of the issuing BIN and set up of the supporting technology.
- In particular, if you are using six-digit BINs for the following activities you will need to determine how the BIN expansion will impact your back end systems. Examples are listed below but do not represent a comprehensive list:
– Identification of prepaid cards
– Fraud and/or chargeback analytics
– Issuer identification
– Routing
– Unique BIN range identification, for example, Fleet Cards, specific types of Corporate cards, Benefits cards
– Cash back qualification
– Optimization of approval rates, authorization analysis
- Merchants who fail to make the necessary eight-digit BIN changes could experience major issues resulting in the incorrect routing of transactions, cashback provided to non-qualified cardholders, inability to identify participants for loyalty and proprietary benefit programs (for an eight-digit BIN) resulting in negative cardholder impacts (e.g., missed benefits, increased cost), inability to correctly report on POS activity, etc.
HOW TO PREPARE
- Most of the changes required by merchants and their clients are specific to their own internal or proprietary systems. Each merchant must assess impacts for this change with their acquirers, processors, vendors, third party agents and any other partners who support their transaction processing, routing and downstream activities.
- Visa recommends merchants actively engage and assess impacts across their organization as soon as possible to maximize their efficiencies and avoid surprises.
- Any logic specific to the six-digit issuing BIN that has been implemented in your processing or downstream systems must be changed, particularly if you:
– Manage your own POS environment
– Share BIN information with any third parties
– Use proprietary BIN tables in transaction processing or supplied via third parties
– Have any system logic that uses the first six-digits of the card number (PAN)
– Use hard-coded BIN logic in your POS terminals
- PCI-DSS allows exposure of the first six and any other four digits in a PAN as the only method
for protecting data at rest. If a merchant would like to expose the full eight-digit BIN as well as
the last four digits, they will need to add one or more of the other acceptable methods for data
protection, such as encryption, hashing or tokenization. Merchants should consult their Qualified
Security Assessor (QSA) prior to implementation.
- The changes required by a Merchant’s downstream and processing systems may require
extended timelines. It is critical that this project is scheduled and prioritized now to ensure
readiness by April 2022.
RESOURCES TO HELP YOU PLAN
Visa will continue to communicate regularly with payment industry stakeholders regarding the migration to the eight-digit issuing BIN. Check the following channels for updates.
Numerics Initiative Page on Visa.com
Visa has developed a set of tools leveraging our deep subject matter knowledge to drive your analysis, planning and transition to the new eight-digit BIN standard. Please go to the Numerics Initiative page on Visa.com to review the Numerics Initiative: Discovery Interview Findings, the Numerics Initiative Impact Questionnaires, Frequently Asked Questions and much more. Check back often for regular updates.
Visa BIN Attribute Sharing Service (VBASS)
The Visa BIN Attribute Sharing Service (VBASS) is a new API which enables sharing of Visa BIN Attributes to improve merchant processes and checkout experiences. Merchants can obtain BIN Attribute data through an acquirer or acquirer sponsored third party.
Questions?
If you have questions on how the eight-digit BIN changes may affect your business or have questions specific to Visa’s approach to the new 8-digit BIN standard, we encourage you to reach out to your acquirer who maintains a Visa relationship to discuss the impacts today.
