The Need for 8-Digit BINs and the Migration Process in the Virtual POS World
As the payment system ecosystem grows and interest in card-based systems accelerates, 6-digit BINs are approaching exhaustion. The International Organization for Standardization (ISO) has decided to transition to 8-digit BINs as a solution to this challenge.
The Need for 8-Digit BINs and the Migration Process in the Virtual POS World
Due to the overall growth of the payment system world and the accelerating interest in and need for card-based systems driven by the pandemic, 6-digit BINs are approaching exhaustion. The International Organization for Standardization (ISO), aware of the danger and wanting to take preventive action as soon as possible, has decided to convert 6-digit BINs to 8-digit BINs before they run out. It announced April 2022 as the deadline for its migration action plan.
At this point, let me briefly mention the International Organization for Standardization (ISO):
The International Organization for Standardization (ISO) oversees the standard that defines Issuer Identification Numbers (IINs), known as 'BINs' in Visa/Mastercard terminology. The American Bankers Association (ABA), on behalf of ISO, globally manages the existing IIN pool for card issuers.
Although this decision by ISO may seem like a minor change, for Visa alone in April 2022, the Visa pool of approximately 100,000 six-digit BINs could potentially expand to 10,000,000 eight-digit BINs. In summary, the number of unissued BINs theoretically increases by a factor of 100. After April 2022, 6-digit BINs can no longer be assigned.
In addition, existing 6-digit BINs will continue to be supported as they transition to 8-digit BINs. The following stakeholders in the payment system cycle will be affected by this transition:
- Card Issuers
- Acquirers
- Processors
- Merchants
Why Is This Process Being Initiated?
As I summarised in the opening paragraphs of this article, a few years ago 6-digit BINs were sufficient for processing credit card payments. Payment processors and card-issuing institutions had built rules and systems around 6-digit BINs. The rapid and continued growth of technology, the emergence of numerous shopping and transaction options for cardholders, and a cardholder holding many BINs from any bank they choose — credit cards, prepaid cards, supplementary cards, special cards, virtual cards, etc. — are all pushing 6-digit BINs towards exhaustion. For this reason, ISO has decided to transition to 8-digit BINs, which renew the available pool. All stakeholders and organisations involved in the payment system network must start the process without delay in order to continue processing payments.
Impact on Stakeholders in the Payment System Cycle
Card Issuers, Acquirers and Processors — major players in the payment system cycle who communicate directly or indirectly with payment system networks — must be in communication to carry the 6-digit BIN process, on which they previously agreed in terms of protocols and integrations, to the new 8-digit BIN process.
In particular, if Card Issuers have not returned BINs they will not use by the deadline, they may be required to pay fees for all retained BINs. Unused 8-digit BINs must be returned to the issuer pool. Merchants integrated directly with Virtual POS Acquirer bank systems and service provider integration firms, as well as third-party ready-made package and payment gateway application providers, cannot communicate directly with networks such as Visa/Mastercard.
For this reason, all organisations that communicate with payment system networks must establish environments in which the firms or third-party application providers integrated into their systems can test and verify the transition and prepare accordingly.
The Migration to 8-Digit BINs Will Disrupt Established Norms
The previously known BIN lists specifically assigned as 6-digit identifiers for banks are being replaced by greater variety.
For example, to illustrate with Ziraat Bank:
Two 6-digit BINs — 539134 and 540130 — were provided by Mastercard and issued by Ziraat Bank for use by its customers. Based on recent checks, Ziraat Bank currently has close to 60 similar BIN numbers.
Assuming Ziraat Bank needs 60 BINs with the 8-digit BIN transition, it would be expected to declare that it will use the ranges between 53913400 and 53913460 and return other BINs and ranges.
53913400……60 — This means that after the transition, BIN number 53913461 could be a BIN issued by a different institution.
Business Segmentation and Security
It appears that 6-digit and 8-digit BINs will continue to operate together for a certain period. For this reason, in particular merchants and applications acting as gateways must carefully assess both structures. They must build systems that can provide BIN ranges for transitioning to 8 digits alongside their 6-digit static definitions, and that can manage bank assignments. Initially, flags can be added to distinguish those parts continuing with 6-digit BINs from those that will continue with 8-digit BINs. If a routing system tied to BINs is in place and BIN information is held in local databases, updated information and bank range intervals should be requested from the bank or relevant authority. In addition, some online BIN services offered by institutions such as Visa, Mastercard and BKM can be examined to obtain information. Today, on virtually all websites where we make payments as end users, we can see Visa/Mastercard or bank logos appear as soon as we enter the first 6 digits or all of the card number. The very simple QueryBIN service operating behind this structure is what makes this possible. If this structure does not function correctly, end users' instalment transactions could be routed as single-payment, or single-payment transactions as instalment. Or worse, the transaction may not proceed at all.
Similarly, if this service has been integrated with incorrect information, an Akbank card's instalment transaction could be routed to a Finansbank Virtual POS, or a Finansbank card's single-payment transaction could end up at a Denizbank Virtual POS.
In addition to all these processes, it is important not to forget that all systems processing card data are subject to certain certification processes. Regarding PCI-DSS, one of the most important of these certification processes, it is important to monitor announcements from banks, payment institutions, PCI consultants and service providers regarding whether the 8-digit BIN process will have any impact on storage and masking processes.
Going one step further, it would also be beneficial to review GDPR processes.
The Anatomy of a Bank or Credit Card Number
- MII (Major Industry Identifier).
- IIN or BIN. Identifies the card-issuing institution.
- Account Identifier Number. The customer's account number.
- Check digit. Validates the credit card number using the Luhn algorithm.
- PAN (Primary Account Number)