1. Core Obligations - Who Has To Do What?

A. Issuer Bank Obligations [Your Bank]:

1. Issue only EMV Chip + PIN cards - In India RBI Circular RBI/2015-16/163 dated 27.08.2015 mandated all banks to migrate all active magstripe cards to EMV Chip and PIN by 31 Dec 2018. All new cards issued must be EMV by default.
2. Ensure ATMs can process Chip and PIN - RBI directed ATM migration by 2017, adherence to EMV liability shift.
3. Certification with EMVCo, Visa, Mastercard, RuPay for chip personalization.
4. Under RBI/2017-18/15 - Customer Protection Circular, issuer must give zero liability if fraud reported within 3 working days.

B. Acquirer Bank Obligations [Bank that gives POS to Merchant]:

1. Deploy only EMV L1/L2 certified POS terminals.
2. Certify terminals for Contact + Contactless + PIN.
3. If acquirer fails to ensure EMV capability, acquirer will be liable for loss to customer in case of failure.

C. Merchant Obligations:

1. Upgrade to EMV-enabled POS terminals.
2. Always attempt Chip transaction first - Fallback to magstripe swipe only if chip fails after 3 attempts and record reason.
3. PCI-DSS + PCI-PTS compliance.
4. Failure = Merchant bears fraud chargeback.

2. The Liability Shift Doctrine

This is the heart of EMV law. Introduced US October 1, 2015.

Principle: Responsibility for fraudulent card transactions shifts to the party that has NOT adopted EMV-compliant infrastructure.

4 Scenarios under Visa/Mastercard Rules:

Visa Reason Code 10.1 - EMV Liability Shift Counterfeit: Applies when skimmed/cloned card used at non-EMV merchant. This is most common chargeback at petrol pumps, unattended kiosks in India now.

Important: EMV shift is not a law passed by parliament, it is a strongly-worded contractual rule from card networks. But RBI has made it de-facto mandatory via circulars.

3. Indian Regulatory Framework

1. RBI Circular DBR.No.Leg.BC.78/09.07.005/2017-18: Zero liability within 3 days, limited liability up to Rs 25,000 between 4-7 days, full liability after 7 days.
2. RBI Circular on International Usage 28.02.2013: All new debit/credit cards to be domestic only unless customer opts-in for international. Such international cards must be essentially EMV Chip.
3. Consumer Protection Act, 2019: Deficiency of service if bank issues non-EMV card or fails to provide PIN-based transaction for domestic POS.

4. Case Laws

A. International - The Defining Case on EMV Liability Shift:

1. B & R Supermarket Inc., et al v. Visa Inc., et al - U.S. District Court, N.D. California
Two Florida retailers filed class action for all US merchants.
Allegation: Visa, Mastercard, Amex, Discover and large banks conspired to shift liability for billions of dollars in card fraud away from issuers to retailers.
Merchants alleged deadline was impossible to meet because network certification was delayed, resulting in thousands of dollars in chargebacks despite having bought EMV terminals.
Ruling: Judge William H. Alsup denied card networks' motion to dismiss and allowed antitrust, conspiracy claims to proceed.
This case is cited globally to show EMV shift must be reasonable and certified.[2016]

2. Similar Cases: Merchants File EMV Lawsuit (2016) - Complaint alleges liability shift imposed despite knowledge that it would be impossible for merchants to meet deadline.

B. Indian Case Laws:

3. SBI Vs Rajesh Grover - Consumer Complaint No. 380/2016, Decided 21.09.2022
Bank argued all debit cards with EMV Chip in India will support PIN based transaction only as per RBI guidelines but for chip based international POS transaction PIN not mandatory.
Commission examined whether non-EMV / non-PIN transaction at international POS without 2FA was deficiency. This case establishes issuer must ensure EMV Chip cards support PIN for domestic transactions as per RBI.

4. RBI's Liability Principle in Judicial Orders:
Indian courts have consistently held: Normally, card issuer is liable for fraudulent transactionunless customer negligence proved. If issuer has not issued EMV card despite RBI mandate post 2018, issuer cannot pass liability to customer even after 7 days.

5. General Forensic Principle:
Indian card fraud examination uses IT Act Sec 66C, 66D, 43A and BNS Sec 318, 319, 336 plus RBI limited liability framework. In fallback transactions where EMV chip card is swiped on magstripe due to merchant not having EMV terminal, courts treat it as merchant negligence under Chargeback Rule 10.1.

5. What You Must Ensure for Compliance - Checklist for Banks / Merchants

For Bank Audit:

• 100% card base is EMV Chip + PIN? Extract from card management system.
• Fallback transaction monitoring - % of chip cards used as swipe > 5% is red flag.
• Visa/Mastercard Letter of Certification for all POS/ATM.
• Customer liability reversal done within TAT 10 days as per RBI 2017 circular.

For Merchant:

• Keep EMV certification letter from acquirer.
• Never bypass chip - Do not force swipe if chip works.
• Store chargeback evidence: Terminal log showing chip read failed.

Penalty for Non-Compliance:

• Chargeback loss + Fine from networks + PCI non-compliance fine $5,000-$100,000 per month + RBI supervisory action.

If you are handling an internal fraud case where EMV compliance failure is used as defence by an employee - e.g., employee intentionally allowing fallback to swipe to facilitate skimming - that becomes a clear case of criminal breach of trust + conspiracy under Syndicate Bank vs Prasad principle combined with EMV liability rules.