Starting today, the mobile payments company iZettle AB is saddled with a major restriction in not being able to accept Visa transactions in parts of Europe. Its problem serves as an example to rivals in the U.S. and overseas.
Mobile card readers, like the kind iZettle sells, are typically designed to be simple, and have flourished in the U.S. despite concerns about whether some properly protect data. In Europe, where EMV chip-card technology is commonplace, the requirements for a secure transaction are more stringent — and iZettle's issues could foreshadow the hurdles U.S. vendors will face as this country shifts to EMV.
Based on Visa Europe's description of its requirement process, Stockholm-based iZettle's reader, designed for chip-and-signature transactions, may not have met the requirements in all countries for accepting chip-and-PIN payments.
"We have done extensive work in the last year to ensure these innovative solutions can be deployed but are still secure," Visa Europe spokesman Andrew Herweg says. "Our functionality requirements for mobile POS devices are that they must support EMV chip, magnetic stripe and PIN."
Supporting contactless payments is "optional, but recommended," Herweg said.
In terms of security, an aggregator's software and system must be Payment Card Industry PIN Transaction Security certified, including encryption as a supported function, Herweg adds.
The encryption function is important because it ensures that mobile devices never have access to clear unencrypted card data, he notes.
"When a system meets all requirements, an acquirer must submit some test transactions to Visa," Herweg says. "Once the test results are accepted by Visa, the solution can be deployed in market."
Visa Europe, which is independent from Visa Inc., would not disclose specifically what iZettle needs to address to meet its requirements.
Jacob de Geer, CEO of iZettle, also would not say why Visa Europe restricted its product.
General EMV requirements allow for chip-and-PIN or chip-and-signature processing, he said in an email interview. His company accepts only chip-and-signature transactions because mobile devices "are not allowed" to accept PIN transactions, he says.
Since iZettle received a "heads up from Visa Europe some time ago" about the restrictions, the company has been trying to "find a way forward together in these markets," de Geer says.
IZettle continues to discuss the process with Visa Europe in hopes of getting back to processing Visa transactions soon, de Geer says.
In the meantime, de Geer confuses the matter slightly by insisting that his company meets all industry security requirements, including PCI compliance, and that the iZettle reader never holds data, all of which is encrypted as it moves through payment networks.
Still, de Geer considers iZettle "a win-win" for merchants and other card brands, all of which have accepted iZettle. Eventually, he wants Visa Europe to be part of that equation.
"Whenever you innovate, there is always fear, confusion or someone thinking we'll take away their market," he adds. "You can either work with innovators, or you can sit back like the music industry did and then watch as your industry gets cannibalized."
Square, which is based in San Francisco, serves as a good example of how important it is to get Visa on board right away, says Gil Luria, analyst with Los Angeles-based Wedbush Securities.
"Square was very smart to get Visa engaged early on in making sure its card reader met all of the Visa security requirements," Luria says. "Under that setup, Visa gets things to go their way, and Square gets access to the network."
In the end, all of the third-party payment aggregators "have to get along with both Visa and MasterCard" to have any chance at success, he adds.
The Visa decision comes on the heels of MasterCard becoming an investor in iZettle last month, much in the same manner that Visa has a stake in Square in the United States, published reports indicate.
Visa and MasterCard don't always get along, so it is possible that some card brand politics could be coming into play in the iZettle situation, says Luria.
More likely, Visa Europe simply informed iZettle of some requirements it was not currently meeting and the current setback "does not mean that Visa will never approve of iZettle processing transactions again," Luria says.