Rollouts of ‘VSAM’ Technology Finally Start to Pick Up Speed

More than three years after it was introduced, a technology designed to make it easier and less costly for transit agencies to accept open-loop payments on their proprietary closed-loop terminals is still only live with a handful of agencies, all in Latin America.

But that could be about to change this year, with plans by a major Canadian transit authority to enable domestic debit card fare payments using the “VSAM” technology on board its buses, metro and other transport modes. Another transit agency, this one serving a southern European capital, will use the VSAM to enable Visa- and Mastercard-branded payments. Backers say more implementations are “in the pipeline.

“We are developing many other projects under invitation of brand schemes and/or system integrators,” Artur Costa, head of Brazil-based Planeta Informática, which originally developed the technology in collaboration with Visa, told Mobility Payments. “In general, we can’t share the info in advance. We need to wait until the customer (releases) the information to the market.”

While not disclosing the VSAM project in Canada, as reported last week by Mobility Payments, Costa did subsequently confirm it. Under the project, Cubic Transportation Systems, the system integrator for Vancouver transit authority TransLink, is using VSAM technology to enable more than 5,000 closed-loop Compass card terminals to accept the Interac domestic debit application. The authority already accepts contactless EMV credit and charge cards branded Visa, Mastercard and American Express and open-loop credentials in NFC wallets.

Costa also confirmed that another agency, in southern Europe, would use the technology to enable the payments from Visa- and Mastercard-branded cards and credentials on validators from South Korea-based LG. The project is being implemented, at least in part, by Australia- and UK-based open-loop payments service provider Littlepay.

Paul Griffin, Littlepay’s global head of commercial, told Mobility Payments that his company has “several projects in the pipeline” using the VSAM, mainly in Europe and South America. The technology enables agencies to continue to use their legacy validators, he noted.

“The installation is super-simple–just open up the validator and slot it into a spare SAM slot,” Griffin said. “But it’s not just about cost. The killer advantage is that it requires almost nothing from the incumbent validator supplier–just a few lines of code to redirect the EMV tap to the right SAM slot.”

SAMs are microprocessor chips, usually in a smart card format, that can be plugged into the contactless terminal. They perform cryptographic operations for card authentication.

Planeta said the technology adds EMV contactless payments functionality to a legacy closed-loop terminal “without changing the validator application software and the (automated) fare-collection system back office.”

How it Works
It does this by intercepting the communication between the card and closed-loop terminal.

If a rider taps a closed-loop card that the validator recognizes, it will accept the card and begin the process of determining whether the customer has sufficient value or a ticket to ride–either stored on the card or in an account in the back office.

If the validator doesn’t recognize the card or credential, it uses a special “virtualization library” that generates the APDUs necessary for the card and reader to communicate. This identifies the EMV card or credential and then begins the steps toward processing of the EMV transaction, provided the card isn’t blacklisted.

APDUs, or application protocol data units, is the language that EMV cards and credentials use to talk with readers. These readers, in turn, are housed inside or are connected to validators. Validators also include a motherboard, communications and other software and possibly a screen and barcode scanner.

Network specifications group EMVCo certifies readers to ensure they meet lower-level contactless and communication protocols when EMV cards or NFC-enable devices communicate with readers. This is known as level-1 certification.

Level-2 certification covers the payment application, with each network having its own contactless “kernel,” such as one for Visa payWave. And level-3 certification ensures the entire system–from the reader through to the merchant acquirer–meets EMV specifications for functionality and security.

The VSAM, which is plugged into the terminal alongside other SAMs, enables one or more of the contactless EMV kernels to function. The VSAM is involved in all level-2 and level-3 certifications, and it also supports Visa’s technology for processing transit payments, called Mass Transit Transaction, or MTT.

The “V” in VSAM originally stood for Visa, because of Visa’s collaboration with Planeta starting in 2018. But since the VSAM also can enable contactless applications from other brands, Planeta says the V now denotes “Virtualization.”

The VSAM cannot replace the need for a level-1 certified contactless reader, however. And if a transit agency wants to support open-loop payments and doesn’t have such a certified reader, it has to buy new hardware.

But Littlepay’s Griffin said that for the past five years, it would be unusual for contactless readers deployed for such popular closed-loop technologies as Mifare and Calypso to not also have EMV level-1 certification. Both closed-loop and open-loop contactless payments rely on the underlying international ISO-IEC 14443 standard, he noted.

Planeta said that if the transit agency doesn’t want to support EMV payments, the VSAM also could “virtualize” Mifare Classic into a more secure form of Mifare, such as DESFire, or even to a competing technology, such as Cipurse from the OSPT Alliance.

Suppliers of open-loop technology, of course, don’t need VSAMs to enable their closed-loop terminals to also support EMV. But Griffin said that the validator vendors are “sometimes unable or unwilling to develop an EMV capability to their validator software, so these validators end up deployed just for closed loop.”

The validator supplier controls the payment software on their devices, he noted. “If they don’t have the experience to deploy a PCI- compliant EMV component, then this creates an impasse. VSAM breaks that impasse by delivering the payment application on a small device that is almost entirely independent from the original validator supplier’s application.”

It’s not clear why Cubic, well-versed in layering open-loop payments technology on top of closed-loop terminals, as it has done in such places as London, Sydney and Vancouver, needs the VSAM to add domestic debit functionality of the Interac Flash contactless application. In Vancouver, Cubic earlier added open-loop payments to TransLink’s closed-loop Compass terminals without VSAMs to support Visa, Mastercard and American Express credit or charge cards. TransLink launched the open-loop service in 2018.

Costs and Time for Canadian VSAM Project
As Mobility Payments reported, Cubic estimated its implementation of Interac debit on the Compass terminals with Planeta’s VSAMs would take around 13 months, at a cost of CA$2.1 million (US$1.7 million). (See table on this page.)

That’s according to Cubic proposal document obtained by Mobility Payments. Mobility Payments has also learned that Interac is believed to be the party paying for the implementation. Interac, declined to confirm that, and none of the parties would confirm whether the costs in Cubic’s proposal have been amended.

Cubic, TransLink and Interac announced plans for the addition of the Interac service last November, and said the service would be launched by the end of this year. That would roughly match the 13-month timeframe for the implementation that Cubic estimated in its proposal.

Backers of the project believe the addition of Interac Flash, which accounted for nearly two-thirds of retail payments in Canada in 2020, could help reinvigorate TransLink’s open-loop service. The agency does not strongly promote the service, and customers pay around 20% higher fares to use open-loop cards as compared with closed-loop Compass cards. That’s one reason Compass made up more than 95% of fare payments last year, while open loop only accounted for around 1.7% of payments.

According to Cubic’s proposal, “non-recurring engineering” makes up by far the largest category of costs, at a little more than CA$1.5 million (US$1.2 million). That includes costs to purchase the VSAMs for 5,000-plus Compass terminals and to integrate them for Interac. But Cubic didn’t break out the costs for the VSAM hardware costs.

With the addition of the new SAMs, all contactless applications would have to get new EMV level-2 certifications, as well as certification of the Interac Flash contactless application itself. There would also have to be another level-3 certification for end-to-end compliance with the EMV specifications. Deployment of the VSAMs to all the terminals on board buses, at metro gates and in validators serving rail and ferry platforms will follow.

According to Planeta’s website, there are only four live projects, all in Latin America and including the Rio de Janeiro Metro. The latter uses readers from France-based Ingenico.

The high profile TransLink project will no doubt add momentum to the deployment of technology that was touted three years ago by Visa but which so far has not been rolled out widely.

_{© Mobility Payments and Forthwrite Media. Mobility Payments content is for individual use and cannot be copied or distributed without the express permission of the publisher.}