EMV in Iranian Banks

EMV standard Implementation in Iranian Banks Risks & Challenges

The purpose of this research is to understand the risks and challenges that are likely to be faced with the implementation of EMV smart cards in Iranian Banks. This technology is already being implemented in European countries and is now beginning to expand into other regions of the world. The initials EMV stand for Europay, Mastercard, and Visa. These three companies worked together to develop the standard. Other companies have also joined including American Express and other local banks around the world. EMV is also known by other names such as IC Credit and Chip and Pin, among others. The development of standards will allow integration between various banking systems and EMV card systems.

EMV is a relatively new concept, which means that there is little academic research to support it. Many companies are migrating this system and it is expected that its use will continue to increase, someday perhaps becoming the standards in electronic funds processing. The system can handle everything a standards credit card can handle, including card not present transactions. Like other electronic interactions, the risk of hacking and potential identity theft remains one of the greatest threats to their system. This research will examine the risks and challenges associated with EMV technology implementation in Iranian Banks.

3.1 Introduction

As EMV is an new technology, there are not a large number of studies available on them at this point in time This research will represent one of the first studies of this type in this particular field. At the current time, not enough information is available to determine the real risks associated with EMV. This study will focus on the perceived risks associated with its implementation. It will examine the risks and challenges before implementation, during implementation and after implementation of the system.

Although not much information is available that specifically addresses the risks and challenges associated with EMV, we do have studies from similar circumstances and can serve as guidance in the development of these study methods. EMV is similar to any other type of software specifically designed to be implemented on a multi-platform, international level.

In a study that examined Risk factors in enterprise-wide ERP Projects, Sumner (2000) used a case study approach. Although, this information gave specific details about the clients that were chosen and their particular problems, this method was only applicable to companies that were similar to the ones in the case studies. This method would not be appropriate in this study, because it is the goal of the researcher to be able to provide information that can be applied to a number of scenarios within the Iranian Banking industry. A case study approach would not yield the general trends that are necessary in the development of the Iranian banking system.

Risk assessment is a challenging research topic. The reason being that risk is a somewhat subjective topic. What some might consider a risk, others will not consider in the same light. In addition, risk is assessed in relation to the company’s ability to meet the challenges and absorb the associated risks. For instance, a large banking institution might be able to take more risk on a failed IT project, than a smaller bank. This is where sample size becomes an important element in the externals validity of the project. The uniqueness of each situation is a key reason for choosing case study as the primary method for studying topics that are associated with risk. Case study is an excellent way to study risks that are already known. However, at this point in the topic of the risks and challenges associated with EMV the associated risks and challenges are only recently beginning to be defined.

At this point in research on the topic of the risks and challenges associated with EMV, a study needs to be conducted that addresses many of the important issues that must be addressed in the future. The purpose of the research is to gain general, rather than specific information about the types of risks and challenges that Iranian banks foresee in the adoption of this technology. Case studies are excellent research methodologies when the research is designed to address specific information. However, at this point, the topic needs to assess the types of risks that might be addressed in future research. For this type of general information, a survey study is often the most appropriate research method, as in the study conducted by Hall (2009). This study addressed the risk issues for Hispanic business owners. This type o risk assessment is similar to the information being sought in this study. Therefore, a similar study technique would be appropriate. This type of study will allow the researchers to gain categorical information on the types of risks that Iranian banks are likely to face in the implementation of EMV.

Whenever the research involves defining a set of factors that influence a certain action or proposed action, two types of questions must be asked. The first is what factors represent risk in the given situation. This type of question can be answered using quantitative survey techniques. The information can be reduced to numerical form and analyzed using descriptive statistics. However, the researcher often wants to know more than a simple yes or no answer in this type of study. Therefore, additional techniques must be used to gain a deeper understanding of the topic area.

Qualitative study techniques are often useful in areas where the information that is to be gained can not easily categorized into well-defined numerical parameters. Two primary methods exist for expanding on the numerical data. The first is to us open-ended survey questions. The second is to conduct follow up interviews in order to gain a deeper understanding of the answers provided in the survey. Both of these techniques will be used in this survey study in order to provide both definitive answers to questions about the risks that Iranian banks face in EMV implementation to allow expansion of these topics. Using a combination of research methods will allow the researcher to gain more in-depth knowledge of the research topic.

3.2 Literature Review

The literature review in Chapter 2 used a number of different types of sources to gain an in-depth understanding of the research topic. There were few academic sources available, therefore the types of documents included in the research review had to be expanded to include a number of non-academic sources as well. These sources were used to gain detailed information on the banking system in Iran and on EMV. The study revealed information that was used in the development of the study questionnaire and face-to-face interviews. The primary information gained during the literature review was used in the development of the survey questionnaire and to identify gaps in the literature that needed to be addressed in the questionnaire.

3.3 Choice of Research Method

Based on an examination of studies that address similar research topics, a quantitative research method will be chosen for this study. The primary reason for this choice is the type of information that is to be collected and the eventual application of that information to the Iranian banking system as it makes the changes necessary to adopt EMVsmart card technology. The primary research method in this study will be the survey questionnaire, but a secondary qualitative research method will be used to provide additional depth and support to this primary research method.

3.4 Research Approach

The purpose of the research study is to provide an overview of the types of risks associated with the implementation of EMV smart chip technology in Iranian Banks. The study will use a quantitative method and will include all banks in Iran as a sample population. This might seem like a lofty goal in many countries, but there are only around 20 banks total in the country of Iran. This study will not include foreign-owned banks, only those that are considered true Iranian banks. It will only include standard banks and will not include credit unions or investment banks (openoffshorebankaccountsfornonresidents, 2010).

Rarely in a research study does one get the opportunity to examine the entire sample population at once. Typical research studies only address a small portion of the target population. It is difficult to eliminate all of the biases that are contained within the sample population so that the results can be applied to individuals that were outside of the test group, but were similar to those in the research study. In the case of this study, the entire population of concern will be able to be included in the research study. Therefore, the results of the study will have no limitations in terms of external validity. The research will be valid and able to be applied to the entire population of banks in Iran.

The research study will be given to the entire population of banks in Iran, but the qualitative portion of the study, consisting of the interviews will only be given to 1/2 of them. This is largely due to time and logistical issues involved in conducting the face-to-face interviews. However, this still represents 50% of the entire sample population. Therefore, it is expected that the opinions expressed in the interviews will be a good representation of Iranian banks.

3.5 Data Collection

The primary aim of the study is to identify the challenges that Iranian banks face in the implementation of EMV. This research is divided into two portions. The first part will be the survey questionnaire. The second will be face-to-face interviews. Where possible, the researcher will visit the bank and administer the questionnaire in person. However, is some cases, this will not be possible, either because of the distances that need to be traveled or the schedule of the bank official. In these cases, the questionnaire will be emailed to the participant and they can return it at their convenience. As the sample pool will consist of all Iranian banks, it is not expected that this data collection method will create sample bias in the study population.

The distances that need to be traveled and time constraints might have an affect in the sample pool for the face-to-face interview portion of the study. The sample pool will be limited to banks in the immediate physical location of the researcher. This sample selection method might create the potential for sample bias in the study population. It might be that the interviews will show regional answers and attitudes. However, it is felt that the sample population is large enough that if these factors are present in the study population, that they will be eliminated due to the size of the sample population in relation to the total number of Iranian banks.

Both data collection methods support the validity of the study and will support the ability to achieve the desired goals of the study. The result of the interview will be used the support and verify the results of the survey study. They will also add depth and clarity to the survey responses. These two data collection methods will add to both the internal and external validity of the research study. It is not expected that the survey response or the willingness to provide face-to-face interviews would be high, due to the schedules of the survey respondents if this approach were not taken by the researcher. The survey will be addressed to the IT department, who will be ultimately responsible for the implementation of the EMV technology. They are very busy and are not expected to have time to respond to the survey or to the interview if this approach to data collection is not taken. This would compromise the integrity of the study results.

3.5.1 Questionnaire

The design of the survey questionnaire was inspired by material found during the literature review. The survey will be provided in paper form, and will be available via a link on the Internet. The survey instrument is divided into three phases that address the risks and challenges before, during and after implementation of EMV technology. For the most part, the survey consists of check box responses. This allows for quick administration of the survey and supports the ability to analyze data more quickly when the survey is complete. However, some open-ended questions were included to add clarity and support the survey/

The first part of the survey addresses the risks and challenges that the IT people feel will be present before the implementation of the EMV. The first section addresses readiness for the implementation process. It asks them to rate the importance of several factors that will affect the implementation process. These include identifying the stakeholders, understanding of EMV and the process involved, budgetary concerns, time constraints. It also addresses technical readiness of the bank and the need to upgrade their existing infrastructure, gap identification, and the planning of any customer service or technical help that will be needed after the project is complete.

The second part of the survey addresses any unforeseeable problems that might occur during the implementation process of installing the EMV technology. Like the first part of the survey, this section asks the respondent to respond to Likert type questions about the importance of various elements. These elements include the need to upgrade the existing system, issue customers new cards, securing card data and disaster recovery, the ability to retain the current level of stability and operational efficiency, and the time needed to make the system compliant with the EMV standard. This section of the study allows the respondent to rank what they feel that most significant challenge in implementing the system will be. If the choices provided do not reflect the desired response, the respondent has the ability to fill in what they feel that most significant challenge will be.

The third section of the survey addresses the challenges that are foreseen after implementation of the new EMV smart card system. The first two questions of this section address the ability to be able to continually upgrade the systems as the EMV standard changes over time. The second addresses the scheme that will be used to assess EMV compliance. The next set of questions ask the respondent to choose which of the following four operations they feel will be the most intensive: update infrastructure, understand guidance and tools, operating procedure, and upgrade existing systems. It might be noted that the researcher might have to explain that infrastructures refers to hardware and the final column (upgrade existing systems), refers to software. This will need to be clarified before administration of the survey. These four elements will be assessed in terms of time, skills, worker experience, cost, and difficulty. The final question in this section is open-ended and asks the respondent to expound on any challenges that they foresee that were not addressed in the questionnaire.

3.5.2 Interview

The interview portion of the study is designed to accomplish two goals. The first is to verify the results of the study questionnaire. The second is to uncover any issues that were not addressed in the questionnaire, but that will have an impact on EMV implementation. The interviews will be free form and will allow the respondent to guide the process to capture their true feelings about the process. However, in order to gain consistency in analysis, the interviewer will make certain that certain topics are covered. Some sample interview questions to assist in keeping the interview on track are:

1. What is the most important challenge that you anticipate that you will face, or that you have faced in the implementation of EMV technology?

2. Do you feel that EMV standards are difficult or easy to follow from and IT perspective?

3. How do you feel that EMV will change your bank and the way that you do business?

4. What security issues do you anticipate?

5. How will you address security issues?

3.4. Data Analyses

Data analysis will be divided into two sections. The survey questionnaire will be analyzed using descriptive statistical techniques and frequency distribution of the number of respondents who checked each survey response. This will be presented graphically and discussed in the final research study. Several different tools are available to perform this type of analysis. These include SPSS and Microsoft Office EXCEL. For this study, the researcher will use Microsoft Office EXCEL for reasons of availability and familiarity with this software package.

The open-ended survey questions and interview responses will be analyzed using categorical analysis, followed by frequency distribution analysis. Categorical analysis means reading the responses and attempting to fit them into specific categories. Some of these categories can be anticipated, but others will emerge during the course of data analysis.

3.6. Recommendations

In the final stage of the research project, the researcher will address the issues that emerged and the importance of those issues, according to the data collected in the study. The researcher will use this data to write recommendations that can be used to help Iranian banks anticipate the problems that they might encounter. It will also make suggestions as to how they might mitigate these problems throughout various stages of the implementation process.

3.7. Ethical Issues

The most important ethical issue that will affect the ability to conduct the study and the ultimate outcome of the research is confidentiality. The researchers will be asking questions that may represent corporate secrets that could affect the bank’s competitive advantage. It very important to stress data confidentiality to encourage participation in the study.

3.8. Conclusion

This research methodology represents the most appropriate method for attaining the desire information. Literature supports this type of research for the research questions that are being asked. It is expected that this research methodology will allow the researcher to achieve the desired goals and aims of the research study. This methodology is expected to result in information that can be used in the development of recommendations to help Iranian banks make a smoother transition as they implement EMV smart card technology.

References

Hall, C. 2009. New study pinpoints risk issues for Hispanic business owners. Houston Business Journal. Friday, May 8, 2009.

“List of Banks in Iran.” 2010. Available at: http://openoffshorebankaccountsfornonresidents.com/ListofBanksinIran.htm. [accessed August 29, 2010].

Sumner, M. 2000. Risk factors in enterprise-wide/ERP projects Journal of Information Technology 15, 317 — 327