Define risk management

Overview

To support low-value transactions (LVT) without authentication and transit payments, the digital wallet application must define risk management settings.

These settings:

• Apply only to digital cards that support CDCVM and allow LVT without authentication.
• Define the thresholds used by the LVT accumulators.

LVT accumulators

NFC Wallet SDK tracks LVT accumulators, including:

• cumulative transaction amount without authentication
• number of consecutive LVT payments without authentication

When an accumulator reaches its configured limit, NFC Wallet SDK prompts the end user to authenticate.

After a successful authentication (during an HVT or LVT), NFC Wallet SDK resets the accumulators.

SDK integration

Risk management parameters

Define risk management using CustomConfiguration during NFC Wallet SDK initialization. See Initialize the NFC Wallet SDK.

The following parameters are available:

Configuration parameter	Description
maxConsecutivePaymentsForLVT	Set the maximum number of consecutive LVT payments allowed without authentication. When the limit is reached, the next LVT requires authentication. Default: 0 (require authentication for every LVT). Maximum: 50. Note: This counter increments regardless of transaction currency.
singleTransactionAmountLimitForLVT	Set the maximum amount allowed per LVT without authentication. Any LVT above this limit requires authentication. Default: 0 (require authentication for every LVT). Applies only when the transaction currency code matches domesticCurrencyCode.
maxCumulativeAmountForLVT	Set the maximum cumulative amount of LVT payments allowed without authentication. When the limit is reached, the next LVT requires authentication. Default: 0 (require authentication for every LVT). Applies only when the transaction currency code matches domesticCurrencyCode.
domesticCurrencyCode	Set the ISO 4217 numeric currency code used for LVT accumulators. Used with: singleTransactionAmountLimitForLVT maxCumulativeAmountForLVT Accumulators update only when the transaction currency matches this value. Default: 978 (Euro).
suppportTransitWithoutCDCVM	Enable transit payments without CDCVM. Transit transactions do not update LVT accumulators (amount or count). When enabled, transit payments do not require authentication. Default: false.

The following examples show how currency minor units affect accumulator thresholds:

// South Korean Won: Currency with 0 decimal
.domesticCurrencyCode(410) //KRW
.maxCumulativeAmountForLVT(10) // 10 KRW
.maxCumulativeAmountForLVT(100) // 100 KRW
.maxCumulativeAmountForLVT(1000) // 1000 KRW
.maxCumulativeAmountForLVT(10000) // 10000 KRW

// Euro: Currency with 2 decimal
.domesticCurrencyCode(978) //EUR
.maxCumulativeAmountForLVT(1) // 0.01 EUR
.maxCumulativeAmountForLVT(10) // 0.10 EUR
.maxCumulativeAmountForLVT(100) // 1.00 EUR
.maxCumulativeAmountForLVT(1000) // 10.00 EUR
.maxCumulativeAmountForLVT(10000) // 100.00 EUR

// Jordanian dinar: Currency with 3 decimal
.domesticCurrencyCode(400) //JOD
.maxCumulativeAmountForLVT(1) // 0.001 JOD
.maxCumulativeAmountForLVT(10) // 0.010 JOD
.maxCumulativeAmountForLVT(100) // 0.100 JOD
.maxCumulativeAmountForLVT(1000) // 1.000 JOD
.maxCumulativeAmountForLVT(10000) // 10.000 JOD

PURE risk management

PURE (Thales white-label EMV payment network) can also provide risk configuration in the digital card profile.

When processing a transaction, NFC Wallet SDK applies PURE risk management in addition to CustomConfiguration.

The following table shows how PURE risk parameters interact with the risk management parameters you set in CustomConfiguration.

PURE risk parameter	SDK behavior
maxTransactionNoCVM	Compare with maxConsecutivePaymentsForLVT and use the most restrictive (lowest) value.
muta	Reject the transaction when the amount exceeds this value and the transaction currency code equals crmCurrencyCode (from the PURE profile).
issuerCVMLimit	If the transaction currency code equals domesticCurrencyCode, compare with singleTransactionAmountLimitForLVT and use the most restrictive (lowest) value. Otherwise, use issuerCVMLimit.
maxTransactionAmountNoCVM	If the transaction currency code equals domesticCurrencyCode, compare with maxCumulativeAmountForLVT and use the most restrictive (lowest) value. Otherwise, use maxTransactionAmountNoCVM.