Eight-Digit BIN Standard Goes Live, Brings Changes to Merchants’ Tables

When it comes to Bank Identification Numbers (BINs), there’s a big change afoot at Visa and Mastercard: While six-digit BINs have been the norm, an eight-digit BIN standard is now live, and both card associations require their payment networks including merchants to support eight-digit BINs.

Here’s everything merchants need to know about the change.

BIN Basics

A BIN also known as an Issuer Identification Number (IIN) is the number used by the payment industry to identify an issuing bank. It is essential for the correct routing of transactions from merchants to issuing banks.

Visa and Mastercard each assign individual BINs to issuers. Consequently, if a bank wants to be part of the Visa network and issue Visa credit cards, Visa gives it a unique BIN. If a bank opts to be part of the Mastercard network and issue Mastercard credit cards, Mastercard assigns it a unique BIN. The digits in the BIN are also used as the initial digits of the Primary Account Number (PAN) of each credit card issued.

BINs Transition From Six to Eight

Bank industry growth and other factors have sparked a need to transition from six-digit BINs to eight-digit BINs. In 2017, the International Organization for Standardization (ISO) released an eight-digit IIN standard (ISO/IEC 7812-1, Identification cards-Identification of Issuers Part 1: Numbering system) to ensure a sufficiently large global supply of BINs for the card payments industry. The publication of this standard paved the way for Visa and Mastercard to mandate their payment network to support eight-digit BINs beginning this past month.

Visa has been assigning both six- and eight-digit BINs for the past few years. However, effective with its April 2022 VisaNet Business Enhancements release, the card association will only assign eight-digit BINs to fulfill new requests from issuers. Six-digit BINs will no longer be available. All acquirers and processors must be ready to support the eight-digit BIN standard.

Meanwhile, Mastercard has adopted the ISO eight-digit BIN standard; as such, it is assigning eight-digit BINs to issuers by request. Mastercard requires that as of April 2022, all acquirers and their third-party processors be able to support 11-digit account ranges as well as the eight-digit BIN standard. Acquirers are charged with ensuring that their merchants along with their payment facilitators, payment gateways, third-party vendors, and all other service providers have the ability to support account range processing and the eight-digit BIN standard, again as of last month.

Next Steps

Visa, in a statement, notes that “in preparation for widespread adoption of this industry change, several existing practices were highlighted as having a negative impact at the point of sale” with most such challenges occurring with six-digit BINS. Examples cited include purchasing “bad” BIN files (i.e., off the internet) and failure to update the point of sale and downstream systems/processes to accommodate six- and eight-digit BINs alike.

Another example: Among merchants that employ encryption and BIN tables at the point of sale, failure to make encryption changes to expose the first eight digits of the account number. “These issues exist today, (but) they may become exacerbated as more issuers request new or migrate existing BINs to the eight-digit length”, according to Visa.

Visa anticipates a steady increase in eight-digit BIN assignments over the next two years and has, as a result, increased engagement with merchants and their service providers to ensure awareness of “potential impacts” and best practices to consider. The card association strongly recommends that merchants “assess the impact(s)” of the change in tandem with their processor, vendor, and any other partners that support their transaction processing, routing, and downstream activities.

According to Visa, merchants that do not use six-digit BINs in their internal processes may only see minimal impact on their business from the transition to the eight-digit version. However, in an infographic, Visa says merchants whose internal processes do involve six-digit BINs “may want to”:

• Detail how the issuing BIN is used in their own POS environment and adjust any logic that is based solely on the first six digits of that BIN to accommodate the first eight digits of that BIN.
• Partner with their acquirer and/or processor, as well as with any service providers or other third parties, on all related eight-digit BIN integration and support requirements.
• Assess the impact(s) of the move from six-digit BINs to eight-digit BINs on downstream systems (e.g., loyalty, billing, reporting, fraud management, and others) and make necessary changes to accommodate the longer BIN length.
• Conduct testing to confirm seamless operations and downstream processes
• Confirm their ability to process transactions with their processor, as well as to complete downstream activities regardless of BIN length.

Other “key reminders” from Visa:

• Use only BIN tables from an authorized source, such as an acquirer or payment processor.
• Ensure that all systems are up to date for eight-digit BIN processing.
• Contact the appropriate encryption provider regarding exposure of the first eight digits of account numbers or “comparable solutions they offer”.

E-Complish stands ready to assist its merchant customers as they grapple with the adoption of the eight-digit BIN standard. Schedule a consultation to learn more about it.