Yes, you do. A certificate must be generated for every new BIN and loaded onto the card chip, establishing secure communication between the chip and the terminal. This is especially critical for verification in offline transactions.
Why Certificates Matter for New BINs
When a new BIN is opened, generating a certificate specific to that BIN is not a mere formality; it is a critical requirement for the payment infrastructure to run smoothly and to stay fully compliant with payment scheme rules. In the EMV system, every BIN is paired with its own “issuer certificate.” This certificate establishes secure communication between the card chip and the terminal and is used for verification, particularly in offline transactions.
The payment schemes (Visa, Mastercard, etc.) also require a separate certificate registration for each BIN. A BIN without a certificate cannot pass payment scheme tests or receives a non-compliance report during audits. This both prolongs the go-live process and creates operational risk.
Effects and Risks of Reusing an Old BIN Certificate
In some cases, the certificate of an old BIN is reused when a new BIN is opened, in order to speed up the process. Although this looks practical in the short term, it carries serious technical and compliance risks in the long term:
- Verification problems: When the BIN on the card does not match the BIN in the certificate, the POS or switch may detect the mismatch and decline the transaction, especially in offline transactions.
- Payment scheme non-compliance: A certificate-BIN pairing that violates payment scheme rules can be reported as “non-compliance” in tests and audits.
- Key management risk: The expiry date of the old certificate may not line up with the expiry dates of the new BIN’s cards. This can cause active cards in the market to fail offline in bulk. In addition, in case of a compromise, it becomes harder to isolate which BIN was affected.
Under certain conditions, some payment schemes allow a shared certificate for several BINs within the same product group, but official approval must be obtained in advance. Temporary use without approval can turn into major problems later.
Recommended Approach
When bringing a new BIN live, the safest path is to create a separate certificate and key set for each BIN, register it correctly with the payment scheme, and use these certificates during card personalization. If temporary situations arise, the table below can serve as a guide:
| Situation | What to Do |
|---|---|
| New BIN opened | Generate a new Issuer Public Key and certificate, and register them on the payment scheme portal. |
| Same BIN group and the same product type | Apply to the payment scheme and confirm whether use of the same key will be permitted. |
| Temporary use for testing | It can be used in the test environment; the certificate must be separated before moving to production. |
| If using the old certificate temporarily is unavoidable | Check the expiry, submit a written request to the payment scheme for temporary use, and keep the personalization logs clearly separated. |
This approach ensures full compliance with payment scheme rules and prevents security, compliance and operational problems that could arise later. Building the right structure from the start is always cheaper and safer in the long run than short-term shortcuts.
