Virginia became the first state to mandate the use of advanced chip authentication security features, i.e., “chip” payment card technology for state government agencies when Governor Terry McAuliffe signed Executive Directive 5 on May 5, 2015, entitled “Securing Consumer Transactions” (the “Directive”).
The Directive instructs state agencies and merchants that accept payment cards from citizens to have in place chip technology no later than December 2015. It also instructs the Secretaries of Technology and Finance, the State Treasurer, and the State Comptroller to embrace electronic payment technologies that “meet or exceed” federal standards for the commonwealth’s merchant, prepaid debt card, and purchase card programs. State officials are also required to provide a plan to the governor’s office by October 1, 2015 detailing the Treasury’s plans to enhance the security features of merchant and prepaid debit card programs to include user authentication, confidentiality, cardholder reporting of unauthorized withdrawals or suspected fraudulent transactions, and data breach reporting and notification. Separately, state agencies must also develop and adopt electronic identity management standards.
Gov. McAuliffe’s actions follow the Executive Order signed by President Obama in October 2014 that mandated that all federally issued credit and debit cards employ enhanced security features including chip-and-pin technology. Unlike the federal Executive Order, however, the Virginia Directive only requires use of chip technology, not chip-and-pin.