Visa Minimum

U.S. Online Only

Terminal Configuration

Introduction As U.S. merchants, acquirers, and

processors plan for the migration to
testing and decrease complexity, Visa
introduced Quick Chip for EMV® in
EMV® contact and contactless chip, April 2016. The balance of this paper
many stakeholders ask: “What are focuses on Visa’s Online Only terminal
Visa’s minimum requirements for a configuration in the context of the U.S.
chip terminal in the U.S.?” market.
Visa’s U.S. market strategy is to Online Only terminals always send a
focus on online only acceptance, transaction online for authorization
using existing online messaging and when supporting face-to-face
infrastructure which is robust, transactions will provide for signature
real-time, and always online for support, as well as for cardholder
authorization and authentication. receipts. If PIN support is needed (e.g.
The primary goal of this strategy is PIN debit) a PIN Pad is added to the
to limit disruption by simplifying hardware configuration.
Intended Audience implementation.
Merchants are encouraged to work
This document is Chip terminal implementations are directly with their acquirer and/
intended for U.S. more complex when compared against or terminal provider to determine
merchants, acquirers, their magnetic-stripe counterparts. the approved EMVCo terminal
processors and terminal However, Online Only chip terminals configurations offered that satisfy
providers who are are significantly less complex when Visa’s U.S. Online Only terminal
planning deployments compared to offline capable solutions. requirements. Approved EMVCo
of EMV contact and Finally, the scope and effort associated terminal configurations (chip reader
contactless chip with testing an Online Only chip and chip software) are a global industry
terminals in the U.S. terminal is significantly reduced when requirement, and the U.S. is no
compared against all other terminal exception.
configurations. To further streamline

EMV® is a registered trademark in the U.S. and other countries and an unregistered trademark elsewhere. The EMV trademark is owned by EMVCo, LLC.
© 2022 Visa. All Rights Reserved.
Terminal Type – Online Only
A terminal configuration is essentially a collection of parameters that drive
specific behavior associated with a chip transaction. The first parameter
considered when setting-up an Online Only terminal is Terminal Type (tag ‘9F 35’).
Examples of Terminal Type values for Visa’s U.S. Online Only configuration are:

‘21’ – Online Only, Attended Merchant (POS)

‘24’ – Online Only, Unattended Merchant (POS)
‘14’ – Online Only, Unattended Financial Institution (ATM)

However, when the Level 2 configuration supports a Terminal Type of Offline Online Only chip
with Online Capability these can easily be deployed as Online Only configurations implementations
by ensuring the Terminal Floor Limit and Terminal Action Code (TAC) values are are significantly
configured as defined in this document. less complex when
While the Terminal Type data object is important in expressing the device compared against
capabilities, alone it is not sufficient to ensure that terminal will always attempt to offline capable
go online. The Terminal Floor Limit (tag ‘9F 1B’) must be set to zero (‘00 00 00 00’) solutions.
and the Terminal Action Code – Online byte 4, bit 8 must be set to 1.

During an EMV transaction, the Floor Limit is compared against the transaction
amount. When the transaction amount is greater than or equal to the Floor
Limit, the terminal sets an indicator in Terminal Verification Results (tag ‘95’).
The Terminal Verification Results (TVR) is a 5 byte bit map which tracks specific
transaction events.

An EMV terminal will determine how to direct a transaction (online, offline, or

decline) by comparing the TVR with Terminal Action Codes (TACs) and Issuer
Action Codes (IACs). These action codes share the same 5 bytes bit map format
as the TVR. The terminal compares the Action Codes in pairs against the TVR as
follows:1

1. TAC/IAC – Denial; any match vs. TVR results in decline request. Compared in
GenAC 1. Card must respond with decline cryptogram.

2. TAC/IAC – Online; any match vs. TVR results in online request. Compared in
GenAC 1. Card must respond with online cryptogram or decline cryptogram.

3. TAC/IAC – Default; only if terminal cannot go online; any match vs. TVR results
in decline request. Compared in GenAC 2. Card must respond with decline
cryptogram.

Minimally, Visa’s (POS) Terminal Action Codes must carry the following values:

Terminal Action Code – Denial = ‘00 10 00 00 00’

Terminal Action Code – Online = ‘DC 40 04 F8 00’*
Terminal Action Code – Default = ‘DC 40 00 A8 00’*
* Alternatively, xFFFFFFFFFF may be used.

An Online Only device must configure Terminal Action Code – Online byte 4, bit
8 = 1. As the Terminal Floor Limit has been set at zero, this forces the setting of
TVR byte 4, bit 8, meaning if a terminal has not already determined a condition to
decline the transaction it shall be forced online, based on the process described
above.

1
See EMV v4.3 Book 3, Section 10.7 for a summary of special Online Only kernel options associated with Terminal Action
Analysis. In summary, an Online Only terminal may forgo the normal Terminal Action Analysis and always request to go online.

Visa Minimum U.S. Online Only Terminal Configuration 2

© 2022 Visa. All Rights Reserved.
Application AIDs
Visa Application Identifiers (AIDs) allow the terminal to recognize and interact with Visa’s payment
applications on the chip. The Visa AIDs that must be programmed to an Online Only terminal are:

Visa Credit/Debit (Required) ‘A0 00 00 00 03 10 10’

Visa Electron (Required) ‘A0 00 00 00 03 20 10’ (processed in the U.S. as Visa credit transactions)
Plus (Required - ATM Only) ‘A0 00 00 00 03 80 10’
Interlink (Optional - POS Only) ‘A0 00 00 00 03 30 10’

The Visa U.S. Common Debit AID may be added to support debit routing arrangements:

Visa U.S. Common Debit AID (optional – POS and ATM) ‘A0 00 00 00 98 08 40’

Terminal Capabilities and Additional Terminal Capabilities

Terminal Capabilities (tag ‘9F 33’) and Additional Terminal Capabilities (tag ‘9F 40’) will also carry specific
settings for an Online Only terminal. These data objects are both formatted as binary bit maps and their
settings are expressed as such. For a Visa U.S. Online Only terminal, the minimum settings are as follows:

Terminal Capabilities (tag ‘9F 33’)

Byte 1, bit 7 Magnetic stripe (when the chip terminal integrates such hardware)
Byte 1, bit 6 IC with contacts
Byte 2, bit 7 Online Enciphered PIN when Terminal Type is ATM
Byte 2, bit 6 Signature when Terminal Type is POS

Additional Terminal Capabilities (tag '9F 40')

Byte 1, bit 8 Cash must be set when Terminal Type is ATM
Byte 1, bit 7 Goods must be set when Terminal Type is POS
Byte 1, bit 6 Services must be set when Terminal Type is POS
Byte 4, bit 8 or bit 7 Printer attendant or printer cardholder

Quick Chip
Quick Chip implementations use the Online Only framework and tweak it slightly for a simpler test suite, and a
simpler implementation. Quick Chip removes unnecessary features in the Online Only environment, such as
Issuer Authentication and Issuer Scripting. This allows for the removal of the card before the terminal receives
the issuer response. These features are not used in Online Only markets like the U.S. and should not be
supported. Removing the functionality also means testing of these features is out of scope for a Quick Chip
implementation, further streamlining testing and certification.

Additionally, Quick Chip and qVSDC (Quick Visa Smart Debit Credit) (see Contactless Considerations later in
this document) complement each other very well. Both allow for insertion or tapping at any point during the
transaction, which creates a consistent cardholder experience, no matter how the cardholder wants to pay.

To implement Quick Chip, a slight change to the Online Only flow is required. For more information, see Quick
Chip for EMV® and qVSDC Specification.

Visa Minimum U.S. Online Only Terminal Configuration 3

© 2022 Visa. All Rights Reserved.
Final Contact Chip Terminal
Considerations
Readers familiar with EMV terminal configurations will note that
features common in other regions of the world are not expected
FEATURE SETTING
in Visa’s U.S. Online Only terminal configuration. In particular, no
Terminal Type 11’, ‘12’, ‘14’, ‘15’, ‘21’,
Offline Data Authentication (ODA) is specified in the Terminal
‘22’, ‘24’, ‘25’
Capabilities. Online Only devices are not recommended to
support ODA features, reducing the need for EMV terminal key
management. Additionally, a PIN Pad need not be supported by Magnetic Stripe Conditional
Visa’s U.S. Online Only POS terminal, thereby reducing Payment IC with Contacts Yes
Card Industry (PCI) scope.

PIN Pads remain a requirement for POS terminals that process Online Enciphered PIN Conditional
debit transactions via Interlink and ATMs. It is recommended Signature (paper) Conditional
that when accepting online PIN for magnetic-stripe debit, chip
debit also be accepted with online PIN. Support for offline PIN No CVM Conditional
is not required when supporting online PIN, as those offline PIN
preferring cards from foreign markets are also required to support
Signature allowing for traditional acceptance in the U.S. market. Transaction Type – Cash Conditional
Finally, if a merchant does not support PIN today then there is no Transaction Type – Goods
Visa requirement to support PIN on chip in any format. Conditional
Transaction Type – Services
U.S. EMV cards and Online Only terminals typically do not support Conditional
offline approvals, meaning merchants/acquirers with temporary
network connectivity issues should consider adopting a Deferred
Authorization approach. This Deferred Authorization approach, Print, Attendant Conditional
sometimes called Store & Forward, is common in many magnetic Print, Cardholder Conditional
stripe environments and is equally suited to Online Only EMV Display, Attendant Conditional
environments. Such an approach addresses network latency Display, Cardholder Conditional
issues for EMV without the cost, development, and complexity of
a fully offline capable EMV solution.
Partial AID Selection Yes
All Visa U.S. EMV transactions will initially attempt to go online
(i.e. GenAC 1 = ARQC). When a host connection is unavailable, the Common Character Set Yes
card/terminal will typically perform an EMV offline decline (i.e.
GenAC 2 = AAC) due to the Zero Floor Limit and the mandatory
Fail CVM Yes
Terminal Action Codes, followed by a Deferred Authorization.
When implementing Deferred Authorization, however, merchant
rules and policies may allow the customer to take possession of Floor limit checking Yes
the goods or services and defer the ARQC authorization request
until the network connection is restored. Terminal Risk Management
irrespective of AIP setting
No special terminal logic is needed to determine if a Deferred
Conditional
Authorization is allowed, such as checks on Terminal Verification
Results (TVR) or Transaction Status Information (TSI),2 which
could override the card decision to initially send the transaction
online. In the U.S., chip data in clearing is optional for Visa.
However, if the merchant chooses to include chip data in the
clearing record, the GenAC 1 ARQC, and not the GenAC 2 AAC,
should be included assuming an approval was received. In the
event the Deferred Authorization request was declined that
transaction must not be cleared or settled.

2
As most TVR and TSI settings are primarily relevant to offline functionality, and most U.S. cards do not support offline functionality, it is strongly
recommended that TVR and TSI settings not be used to filter transactions for eligibility for Deferred Authorization.

Visa Minimum U.S. Online Only Terminal Configuration 4

© 2022 Visa. All Rights Reserved.
In a Deferred Authorization environment, the merchant must consider the risk of completing the sale and
implement appropriate risk management such as velocity checking and total cumulative amount on repeat
purchases. Deferred Authorization risk management for EMV is identical to magnetic stripe situations,
carrying the same open to buy risk, meaning an issuer could decline for insufficient funds and merchants
would absorb such a loss should this occur. However, such exposure is typically small and can be sized by
evaluating the current overall decline rate, applying the likely number and value of transactions that would
occur during a host outage. Visa’s Acceptance Solutions team can help evaluate the financial impact of a
Deferred Authorization approach.

Finally, while chip data is required to be included in the authorization request and authorization response
messages, there are no requirements to carry chip data in the clearing and settlement messages or returns.
This means that in the U.S. these merchant and acquirer interfaces remain largely unchanged.

EMV Configuration
EMV terminal providers will be intimately familiar with the configuration options associated with their
particular device and will provide guidance on satisfying Visa’s Online Only requirements. However, to
facilitate discussions with terminal providers the table provided on the previous page is an extraction from
the EMV application kernel Implementation Conformance Statement (ICS). This extraction summarizes the
necessary options for a Visa Online Only terminal; these features are also expressed on the EMV Letter of
Approval (LOA).

Other brands may have other requirements which are outside the scope of this paper.

Contactless Considerations and Streamlined qVSDC

Configuration
Please refer to the Visa U.S. Merchant Contactless Chip Deployment Quick Reference Guide.

Additional Reading on Visachip.com and Visa Technology

Partner (VTP)
• Visa Smart Debit/Credit and Visa PayWave U.S. Acquirer Implementation Guide – Acquirer guidance for
chip acceptance

• Visa’s Transaction Acceptance Device Guide – Overview of terminal chip acceptance

• Quick Chip for EMV® and qVSDC Specification – Specification for how to implement Quick Chip and
qVSDC

• Visa U.S. Merchant Contactless Chip Deployment Quick Reference Guide

• Visa U.S. EMV® Chip Terminal Testing Requirements

• Visa Global Level 3 (L3) Testing Guidelines and FAQ

• Quick Chip Implementation Steps

• EMV Contact and Contactless Payment Acceptance for Restaurant Merchants

The following resources are available via acquirer licensing:

• EMV in the U.S.: Simplifying Deployment in a Zero Floor Limit Environment – Detailed review of the Visa
online only strategy
• Visa Transaction Acceptance Device Requirements – Summary of Visa acceptance business rules

Visa Minimum U.S. Online Only Terminal Configuration

© 2022 Visa. All Rights Reserved.