Numerics Initiative

Why did the payment industry adopt the eight-digit BIN standard?

The International Organization for Standardization (ISO) eight-digit BIN (Bank Identification Number) standard provides additional BINs for future use, allowing the payment industry to continue to innovate and grow well in the future. Visa, in partnership with a diverse group of stakeholders in the payments ecosystem, has expanded the length of Bank Identification Numbers (BINs) on the Visa system from six to eight digits. Since Visa is now only assigning eight-digit BINs for new payment credentials, it is imperative that every part of the payments chain is ready to process six- and eight-digit BINs.

Impacts of the new eight-digit BIN standard

Merchant impacts

As more stakeholders adopt eight-digit BINs, it is no longer possible to rely on the first six digits of the PAN for authorisation, routing and transaction clearing. It is critical to assess the impacts of this change with your acquirer, processor, vendors and other partners that support your transaction processing, routing and downstream activities. If you are using six-digit BINs for the following activities, at a minimum, you need to determine how the BIN expansion will impact your back-end systems:

Identification of card product types for certain merchandise restrictions
Fraud and/or chargeback analytics
Issuer identification
Routing, if applicable to your region and if referenced at the BIN level in lieu of the account range
Unique BIN range identification (e.g., fleet cards, specific corporate card types, benefits cards)
Cash back qualification
Optimisation of approval rates and authorisation analysis

Recommended impact assessments include:

Detail how the issuing BIN is used in your own POS environment and adjust any logic that is based solely on the first six digits to also accommodate the first eight digits (at a minimum).
Assess downstream system impacts (e.g., loyalty, billing, reporting, fraud management, etc.) and make the necessary changes to accommodate the longer BIN length.
Conduct testing to confirm seamless operations and downstream processes.
Confirm your ability to process transactions with your processor and complete downstream activities regardless of the BIN length.
Ensure BIN table information only comes from reliable sources (e.g., your acquirer or registered entities) that receive information directly from Visa (e.g., Visa BIN Attribute Sharing Service).

Merchant resources

In this webinar, you will learn about Visa’s guidance for the International Organization for Standardization (ISO) eight-digit BIN industry change and what merchants should do to adapt.

We recommend that merchants engage and assess impacts across their organisation as soon as possible to maximise efficiencies and avoid surprises. The following documents will provide more information on the processes you may need to change to adapt to the new eight-digit BIN standard.

Acquirer impacts

Acquirers should ensure their routing logic, processing logic and/or applicable tables are updated to process at the six- and eight-digit BIN lengths. It is essential that acquirers and merchants do not make decisions solely on using six digits since issuers commonly use one or more nine-digit account ranges to differentiate between specific products and/or processing parameters for their assigned six-digit issuing BINs.

Issuers may set up their routing preferences using as few as the first four digits of the PAN all the way up to the first 12 digits. The most common length for routing is nine digits. In certain regions, nearly 30% of Visa issuing BINs have routing set up at either the 10th, 11th or 12th digits.

Token BINs

Visa assigns nine-digit token account ranges instead of six-digit issuing BINs, so it is important that all token inquiries be done at the entire nine-digit account range.

A token BIN can have multiple account funding sources (e.g., credit, debit, prepaid) for different account ranges.
Multiple issuers may be assigned token account ranges from the same token BIN.
Each nine-digit token account range will be configured with the specific product and processing attributes and must be processed accordingly.

Specific impacts

Please work with your processors and other payment industry partners to analyse the impacts to your payment processing and downstream systems, which may include:

Transaction Processing: using the six-digit BIN for authorisation routing or transaction clearing may disrupt transaction processing (e.g., it may not capture the correct country, product ID or account funding source).
Fraud Protection and Risk Rules: if you use six-digit BINs in your fraud protection programs and risk rules, functions impacted may include:
- Pre-validation of transactions against specific fraud parameters (including issuing BIN)
- Blocks on specific BINs for authorisation processing, including Office of Foreign Assets Control (OFAC) sanctions
- Reporting and analytics on fraudulent transaction activity at the BIN level (e.g., internal reporting to detect high numbers of disputes from certain regions or issuer BINs, allowing the merchant to directly reach out to the issuer to resolve issues)
- Software or support to merchants for healthcare, fleet or other designated products (e.g., healthcare merchants [pharmacies, chemist’s, etc.]) that needed compare the card number against other software to ensure that the PAN is eligible to purchase the merchandise SKU need to ensure they read out to the eighth digit to properly authorise)

Because the issuing BIN is not used in VisaNet for authorisation, clearing or settlement of transactions or any related exception items, there is no impact on processing from a Visa standpoint.

Partner Readiness

The change to eight-digit BINs may impact your organisation, customers, merchants, other clients, service providers and vendors. Partner readiness is critical to success, and collaboration across all customer and stakeholder groups is essential. This is not just a technology project and requires cross-functional attention.

Acquirers’ resources

Below are resources that acquirers can use to evaluate the impact of eight-digit BINs:

Acquirer processor resources:

Download the Acquirer Processor Infographic

Visit the Visa Numerics Initiative page at Visa Online for additional acquirer-related resources (login required).

Service provider impacts

Service providers should ensure that routing logic is now in place to process at both the six- and eight-digit BIN length. Using the ﬁrst six digits of the PAN for services may result in impacts on back-end systems, including:

Transaction processing
Issuing product management
Cardholder servicing
ATM
Merchant servicing disputes
Fraud management
Data warehousing and reporting
Encryption services

Allowing adequate time for communication and planning with clients, merchants, vendors and other partners and suppliers is a key planning consideration. If the new eight-digit BIN standard is not supported, transaction processes may be impacted and services provided to clients may be disrupted.

Failure points and severity will vary depending on:

Specific issuing BIN use
Supporting technology set-up
Dependencies across service providers
Downstream process flows and associated outputs

Service provider resources

In this webinar, you will learn about Visa’s guidance for the ISO eight-digit BIN change, and what service providers should do to adapt.

Below are resources that service providers can use to evaluate the impact of eight-digit BINs:

Processor impacts

Processors that use the ﬁrst six digits of the PAN to route transactions may experience broad impacts across transaction processing. This could include:

Disruptions to product identiﬁcation
Service eligibility
Authorisation parameters
Reporting and accounting processes

Processors also need to work with their clients to ensure all Visa transaction processing can accommodate both six- and eight-digit BINs. To ensure your clients are ready, please refer to the sections in the navigation on the left.

Processor resources

Below are resources that all processors can use to evaluate the impact of eight-digit BINs:

Download the Processor Quick Start Guide

Visit the Visa Numerics Initiative page at Visa Online for additional processor-related resources (login required).

Issuer impacts

Although issuers are not required to migrate existing six-digit BINs, Visa urges issuers to begin considering the impacts of the eight-digit issuing BIN on current primary account number (PAN) assignment strategies. Beyond limiting PAN assignment to specific nine-digit account ranges, Visa also recommends that clients consolidate in-use nine-digit account ranges into as few future eight-digit issuing BINs as possible.

In addition, if you accept cards from foreign cardholders (e.g., at ATMs, cash advance machines, branches, etc.), you will also need to evaluate impacts to ensure you do not have any acquiring issues if the card being accepted belongs to an issuer using an eight-digit BIN.

Because the issuing BIN is not used in VisaNet for authorisation, clearing or settlement of transactions or any related exception items, there is no impact on processing from a Visa standpoint. However, you will need to work with your processor and other processing and host partners to analyse the impacts on your payment processing and downstream systems.

In addition, if you use six-digit BINs in your fraud protection programs and risk rules, they may be impacted if you are not prepared for eight-digit BINs. These may include:

Pre-validation of transactions against specific fraud parameters (including issuing BIN)
Blocks on specific BINs for authorisation processing, such as Office of Foreign Assets Control (OFAC) sanctions
Reporting and analytics on fraudulent transaction activity at the BIN level
Dispute processes

Issuer resources

Below are resources issuers can use to evaluate the impact of eight-digit BINs:

Issuer processor resources:

Download the Issuer Processor infographic

Visit the Visa Numerics Initiative page at Visa Online for additional issuer-related resources (login required).

PCI compliance impacts

To better understand the implications of the Payment Card Industry Security Standards Council (PCI SSC) requirements and how they may or may not impact the eight-digit BIN standard, we suggest you review this webinar:

Get the full picture on PCI Compliance for eight-digit BINs with the following resources:

Need help?

Contact the Visa Eight-digit BIN team. We’re ready to assist you.

Get started

External Consulting Services

We have also partnered with the following firms to provide support for additional consulting engagements. Please contact:
EY Visa Numerics team at [email protected]
Deloitte Consulting Visa Numerics team at [email protected]