What do you need to know about how the Bank Identification Number (BIN, also known as Issuer Identification Number, or IIN) is encoded and what role this plays with cards payment?

The BIN, which is used to identify the institution that issued the card, has traditionally composed the first six digits that are embossed on cards payment. A card typically has 10-19 digit number long, which is commonly referred as the Primary Account Number (PAN). The International Organization for Standardization (ISO) standard1 that specifies how PANs are structured now also defines a format for the use of 8-digit BINs as an alternative to 6-digit BINs. As of April 2022 card organizations like Visa and Mastercard will extend the BIN (Bank Identification Number) of their cards from 6 to 8 digits globally. Some payment brands have already started using the first eight digits as the BIN instead of the first six whilst the length of the primary account number (PAN) will remain variable. The issuing BIN change will require action across the entire payments industry, including banks, processors, fintechs, and the vendors who support them. Lets explore what these changes will mean and how the stakeholders in that ecosystems need to prepare for it.

First, Why Is This Happening?

The number of credit card issuers has grown exponentially in recent years, leading to an expected shortage of available Bank Identification Numbers (BINs). The more diverse the payments ecosystem is, the more BINs come into play. The new format will enable the release of more cards in circulation.

How do BINs work?

BINs work to protect both merchants and consumers. Acquiring banks use the BIN to identify the issuer (card type, location etc) and to route transactions for authorization and. The issuer then responds with information about whether or not the account is valid and whether the account has sufficient funds for the transaction. Merchants are given a tool by their Acquirers to sort through these BINs (it is called a BIN File or Table) but as complexity increases, the more likely they are to experience blind spots using these BIN files. No BIN file is truly complete on its own.

After April 2022, Visa and Mastercard will only issue 8-digit BINs whilst no date has been set for discontinuing issuance of 6-digit BINs. Other major networks, including American Express, Diners Club/Discover, and China Union Pay, have not announced timelines for adopting the new 8-digit BIN.

What will not change?

The general length of the PAN remain the same, new BINs will be incorporated into the existing PAN. End users, albeit consumers, will not need to be issued a new card. The receipt they will get in a store will not need to change. The schemes strongly recommend that entities retain the fewest digits of a PAN as possible, they are not required to change their current format for truncation as a result of the migration .

The 8-digit BIN expansion does not directly affect compliance with the PCI Data Security Standard. It is really an operational change with a technical and processing implication.

How Do The Ecosystem Will need to Adjust to these changes?

Identifying the card issuer and the cardholder without requiring the whole card number is important for running business processes such as payment transaction routing, chargebacks, refunds, and fraud detection while minimizing the risk of card data breach. These processes and supporting systems will need to be updated to recognize and act on eight-digit BINs. This may include updates to:

• Point of Sale (POS) hardware and software

• BIN tables and associated processing logic

• Payment application logic (e.g., transaction routing, chargebacks, refunds, fraud management)

• Merchant loyalty and discount programs

• PIN bypass logic for mag-stripe transactions

• Reporting systems

Because both six- and eight-digit BINS will exist after April 2022, merchant and processor systems will need to be able to handle both BIN lengths.

Additionally it is worth to note that the 8-digit BINs are not supported by 3DS 1.0. To effectively serve those customers you need to ensure they comply with the latest EMV 3DS standards.