Attack:

Autor: Helge Wonka Version: 2.0 Datum : 29.06.2004

Attack NCR

-2-

Content 1 Introduction 3

2 NCR Overview 4 2.1 History – National Cash Register 4 2.2 NCR business activities 5 2.3 NCR Q3 2003 Operating Results 5

3 NCR Sales Strategies and Tactics 7

4 What to say when dealing with NCR 9 4.1 Corporate issues 9 4.2 Hardware related issues 11

4.2.1 PINPAD and EPP 16 4.2.2 NCR 5674 and NCR 5874 19 4.2.3 NCR 5675 and NCR 5875 20 4.2.4 NCR 5684 and NCR 5884 21 4.2.5 NCR 5685 and NCR 5885 / NCR 5886 23

4.3 Dimension issues when replacing NCR ATMs 24 4.4 Service access - Issues with NCR Personas 8x 24 4.5 User access and customer security with NCR 26

5 Why the Wincor Nixdorf Software is better 27 5.1 The Wincor Nixdorf multivendor advantage 27

5.1.1 Sample of success with software as driving factor 28 5.2 Differentiators Wincor Nixdorf vs. NCR 28 5.3 Benefits of using Wincor Nixdorf 29 5.4 What is NCR’s APTRA? 30 5.5 APTRA™ Advance NDC 30 5.6 Comparision ProCash/NDC and APTRA™ Advance NDC 31 5.7 EMV support 32 5.8 APTRA™ Promote support 32 5.9 Installed base 32 5.10 Partner program 33 5.11 Vendor independence 33 5.12 What is APTRA™ Edge 34 5.13 The differences between APTRA™ Advance NDC and APTRA™ Edge 34 5.14 Comparison ProCash/NDC (and ProTopas/Manager) and APTRA™ Edge 35

Attack NCR

-3-

1 Introduction

The objective of this document is to help you secure business from NCR by providing the answers to NCR specific attacks on Wincor Nixdorf and giving you points to say in return. It does contain some direct model for model feature comparisons as they are provided as well in the Intranet. In addition we look at core technologies and philosophies that apply across the ranges.

It should be seen as a compliment to Wincor Nixdorf that NCR are so concerned about the Wincor Nixdorf successes at securing business at NCR expense that Wincor Nixdorf have frequently been subject to NCR direct attacks to spread Fear, Uncertainty and Doubt (FUD) to Banks over committing themselves to Wincor Nixdorf.

This is nothing new, over five years ago a specific team was set up in NCR’s manufacturing center in Dundee, Scotland to find reasons why Wincor Nixdorf customers should not do business with Wincor Nixdorf. By anyone’s criteria the team’s success must have been very limited as Wincor Nixdorf have continually won accounts from NCR. This NCR team has long since disbanded and others have come and gone so there is much miss information being circulated about Wincor Nixdorf within NCR. Much of this information was incorrect to begin with and much of the rest is now out of date.

The questions will cover our products, software and our corporate approach, the following information has been designed to answer these aspects.

NCR appears to be good at twisting information to suit themselves, never the less there can be an element of truth in some of their points which may come across as objections. This document is intended to counter the adverse comments that you will experience which have been circulated by NCR or perhaps seen as objections by our prospective customers.

A simple guide is to acknowledge what NCR have said and then with the knowledge in this document turn it against them to show how they have got it wrong, just one inaccuracy will negate all the others that may have some element of truth.

There are also various items that can be used to our advantage against NCR. This is not a static market and every effort has been made to verify what has been included. But what is correct today may not be tomorrow - so be careful how these points are used.

If you experience any new alleged NCR ‘attacks’ please let Helge Wonka know by e-mail at Helge.Wonka@wincor-nixdorf .com. NCR have never been more vulnerable so do not be daunted by them.

Finally, remember that this document is company confidential and all references about NCR are saying about Wincor Nixdorf or what we can say about them should be phrased as allegedly – unless we have it in writing!

Attack NCR

-4-

2 NCR Overview

Information on NCR can be found in the Internet (www.ncr.com). For detailed information on NCR’s self service products the NCR pages will give some generic overview of the latest NCR Persons ATMs. For discussions with our prospects, more details regarding ATM replacement and competitive information can be found on the Wincor Nixdorf Intranet. As well members of Wincor Nixdorf marketing and sales support can be contacted.

2.1 History – National Cash Register NCR or as it was known at that time as National Cash Register Company, was founded in Dayton, Ohio USA in 1884 by John H. Patterson. The first international branch was set up a year later in the UK. From cash registers NCR developed into the manufacturing of mechanical accounting and adding machines and expanded their operation into over 120 countries. Up until the early 1970s is was the worlds leader in retail and accounting machines. It has also been involved in areas such a chip production, disk manufacturing and is still a major player in the manufacturing of branch and central cheque processing systems.

The company suffered badly being dependent on mechanical technology with the electronic revolution in the early 1970s when it was not able to make the move quickly enough to hold onto its leadership position.

Despite being one of the first computer manufacturers it was unable to compete with IBM which had been founded by Watson who was an ex employee in the 1930s. After struggling for a few years it was the combination of its traditional mechanical expertise and its new electronics capabilities that were used in the development of the ATM. This no doubt saved the company and lead to it becoming number one in the ATM market, gained through its international operations rather than from being in the USA. Its leadership position in Retail has been challenged by IBM and Wincor Nixdorf.

From its beginnings NCR has always been an internationally focused company with CEOs from Europe as well as the USA. The first overseas manufacturing plant was established in the late 1940s in Dundee, Scotland and this became the home of NCR’s ATM R&D and production. NCR were at that time an innovative company. One of their inventions in the 1960s was a “no carbon required paper” that eliminated the need for carbon paper for multiple copies. Another invention was the IT interface SCSI.

The fact that NCR provided the accounting machines and in some instances the computers and cheque handling systems for many of the world’s banks has meant that today they are able to call upon this longstanding relationship. This history goes along way to explain why they are seen as a strategic supplier in many accounts where their presence as an ATM supplier today does not merit it.

NCR have absorbed a number of companies. Usually they disappear into the company and loose their identity. Such examples are Terradata, Gasper whereas with Spinnaker ink dye system they have set it up as a separate organisation known as Fluiditi. Most of the 120+ NCR organisations are wholly owned legal entries but there has recently been a number changes with a move towards distributorship especially in MEA and Scandinavia e.g. EDT in Norway and Sweden.

By far the largest event in NCR’s history were the years spent as part of AT&T 1991- 1996. This created the foundation for the NCR that we face today. The reduced lack of R&D in ATMs by AT&T meant that their ATM products lost the technology lead which even today NCR have not been able to regain. NCR has a strong sales and marketing culture. As an example they are attempting to introduce ATMs in to be developed countries around Asia. They had a Knowledge center in London, which was a much reduced version of AT&T’s Bell Labs. NCR’s showcase center, called Discovery Center is located at the Dundee Plant where the NCR future of self service is on display. Never the less they are now the world’s largest ATM supplier. Despite the tough competition by Diebold and Wincor Nixdorf they are a strong vendor but they and their customer base are the most vulnerable to attack.

Attack NCR

-5-

2.2 NCR business activities NCR operates in the information technology industry, which includes designing, developing and marketing information technology, with products, services, systems and solutions worldwide. NCR categorizes its operations into five segments: data warehousing solutions, financial self service solutions, retail store automation solutions, payment and imaging solutions and systemedia. Data Warehousing Solutions: It combines hardware, software, professional consulting services and customer maintenance and support services. Data Warehousing solutions are designed to enable businesses, across a multitude of industries, to simply and quickly leverage detailed customer, supplier and partner information into actionable opportunities. This field of activity has become the most strategic one within NCR over the last years. Financial Self Service Solutions: The NCR offering provides basically a single line of ATMs with related software and services, but goes not beyond cash dispensing. Cash Recycling technology has never been a strategic product functionality to enlarge the offering. The NCR self service solutions are solely designed to quickly and reliably process high volumes of cash out transactions. A success with information- and transaction terminals like offered by Wincor Nixdorf never materialised. Statement printers by NCR are found only in a few countries in relatively small numbers. NCR’s influence in the segment of non-cash products has diminished. NCR’s self service product line has been over years a cash cow without fundamental investments in new products or new technologies. Retail Store Automation Solutions: Traditional retail solutions such as point-of-sale workstations and scanners, as well as advanced solutions in the emerging areas of self-checkout, web-enabled kiosks and electronic shelf labels are manufactured. It appears that NCR is loosing market share in this segment due to tougher competition. Retail solutions have been a strategic segment till to the 90s but since then lost their key position within NCR. Payment and Imaging Solutions: Within NCR the products of this segment enable item-based transactions to be digitally captured, processed and retained within a flexible, scalable environment. These represent more a kind of niche market for NCR. Systemedia: NCR uses this channel to develops, produce and market business consumables to complement the company's solutions. Products include paper rolls, paper products and imaging supplies for ink jet, laser, impact and thermal-transfer printers. 2.3 NCR Q3 2003 Operating Results NCR reported end of October 2003 their Q3 results for 2003. The operating income for the third quarter was $33 million versus $53 million in the third quarter of 2002. The decline in operating income was due to a $50 million year-over-year negative impact from pension expense of $31 million in the third quarter of 2003, versus $19 million of pension income in the third quarter of 2002. Excluding the impact of pension, NCR generated a substantial improvement in year-over-year operating income in the quarter. NCR reported net income of $18 million, versus net income of $41 million in the third quarter of 2002. Looking at NCR’s key markets, the Data Warehousing Operating Segment showed decreasing operating income in relationship with lower volume. NCR’s Data Warehousing segment reported third-quarter revenue of $274 million, down 4 percent from the third quarter of 2002. Operating income of $21 million for the quarter decreased $6 million from the third quarter of 2002, due to $12 million less revenue generated in the quarter. Although companies continue to install and upgrade their Teradata® data warehouses, Data Warehousing revenue was limited by restrained capital spending.

Attack NCR

-6-

In the Financial Self Service Operating Segment NCR realised higher gross margin and improved profitability on lower revenue. The Financial Self Service segment generated third-quarter revenue of $271 million, down 6 percent from the year-ago period. Revenue growth in the Americas and Europe/Middle East/Africa (EMEA) regions offset a slower-than-anticipated pace of automated teller machine (ATM) installations in the Asia/Pacific region. Operating income of $47 million improved 38 percent from $34 million generated in the prior-year period. The improvement in operating income resulted from improved supply-chain costs and expense management. NCR mentions in their Q3 2003 reporting risks and uncertainties in ATM outsourcing and shifts in market demands. They feel continued competitive factors and pricing pressure. Never the less they have improved gross margins and profitability, especially in their more mature offerings such as Retail Store Automation and Financial Self Service solutions. They mention the impact of shortened product cycles and some difficulties maintaining their leadership position. NCR employs 29.300 people worldwide, with less than 3.000 in the US.

Attack NCR

-7-

3 NCR Sales Strategies and Tactics

NCR try to protect their customer base. So Wincor Nixdorf can expect any kind of attacks when you are up against the NCR Financial Solution Group. Apparently NCR are spreading Fear, Uncertainty and Doubt (FUD) about Wincor Nixdorf , the company and ProCash products. Much of what they say is not founded on factual data and the rest is half truths. This becomes visible in a number of ways: NCR had been questioning for quite a while the long-term future of Wincor Nixdorf. This has stopped as Wincor Nixdorf is growing and successful. The growth rate of Wincor Nixdorf is actually higher than the one of NCR. NCR had been attacking the Wincor Nixdorf cash recycling technology. This has stopped as the Wincor Nixdorf cash recycling machines have been accepted by the European Central Bank. Actually the question has to be raised if NCR does keep up with market developments. Which developments did NCR put on the market lately? The development of the Personas (58xx) is nothing else than wrapping the old fourth generation machines with a more modern (Wincor Nixdorf like) housing. This is nothing else than dressing up the old lady with a new skirt – it will not become a young attractive girl! As NCR monitor closely their competitors, they have been trying to slant everything to suit them. So all Wincor Nixdorf need to do is prove one bit wrong then NCR are undermined completely. NCR have been early in various countries to penetrate the financial industries. NCR have been claiming credit for industry developments that are not down to them. Enhanced self service with information- and transaction terminals was actually developed by Wincor Nixdorf. Wincor Nixdorf was the leader in supporting an open software platform. For years NCR have deliberately kept their customers in a proprietary environment. They still talk of being the market leader since through. The re-branding of all old products under the Aptra label still has not finished. NCR are rather conservative in driving new developments. Only under pressure of the Wincor Nixdorf competition they have slowly followed developments initiated earlier by Wincor Nixdorf. Examples are the compact banking solutions, side cars, cash recycling and others. Interesting to note that when NCR catch up with Wincor Nixdorf developments they stop spreading FUD. In the next step they claim thought and market leadership for themselves. The latest example is cash recycling – after spreading doubt they now try to come up with a system of their own. They try to give the impression that cash recycling is all down to them. With Keba as well entering this market segment, NCR will remain in a “late-follower” position. Quite frequently NCR claim thought leadership. For many years they have focussed on the US for all future banking ideas. As we all know, the US are not leading in banking technology. The US are still old fashioned in their processes of i.e. dealing with cheques and money transfers. Speaking of ATMs installed, the US market is rather attractive for ATM manufacturers. Wincor Nixdorf has taken a very careful approach in penetrating this market and has over the last years built a positive image. NCR stress their US involvement. This is for sure also done due to the presence of Diebold. Wincor Nixdorf are meanwhile involved in the US with various proof of concept installations. Doing so in this highly competitive market, the self service products of Wincor Nixdorf have proven to be at the leading edge of banking. Vendors like Diebold have this already acknowledged. In the development of the Opteva models the influence of Wincor Nixdorf ATM became visible. NCR may lead in cash dispensing units in the USA, but the real leader in multi functional banking is in Europe. The technology development is lead by Wincor Nixdorf. Our users have proven this!

Attack NCR

-8-

NCR had in the past taken advantage of their size and large corporate structure. Comparing the self service unit in Dundee, Scotland with the Paderborn facilities we have heard many times from our visitors who have seen both plants, that the Wincor Nixdorf factory and production processes are much more structured and more impressive. As a result our prospects should always tour our plant and visit our demonstration area. NCR can not compete with our attractive facilities when they are hosting customers. NCR has a hierarchy with European (North-American/LAMEA/Pacific) and regional management structures which does involve various senior management levels being involvement in the sales process with not always fast responses to deals. Due to the high cost of supporting these various layers of management NCR has during 2003 reduced manpower. During the last quarterly reporting the NCR CEO mentioned the lack of pricing discipline. NCR has in various cases aggressively discounted to hold a customer, to avoid bringing down the market price. When questioned it becomes obvious to many clients that NCR have been over charging their customers to subsidise others until there is competition! NCR does move the basis of decision for a sale if a multinational account is involved. NCR has set up a global account programme and will use it when it suits them to make the deal involve multiple countries. The Wincor Nixdorf procedure is described by short decision tracks and quick responses by a lean business management. Wincor Nixdorf is capable to offer a broad band of self service solutions with products for cash-in and cash-out and information- and transaction terminals. NCR are not able to pull that interesting range of products and services together to make the same attractive offering. To heel this disadvantage they sometimes will include Gasper at little charge to their customer. NCR usually have a broad base of contacts in a bank and will bring the purchasing, business and technical people together to press their case. Because of this range of contacts NCR sometimes tries to get around ITT constraints etc. With its size and structure NCR appears sometimes inflexible. In the past they have used their dominance of the market to decline customer requests. Customers - also in the financial industry - do remember this and become in increasing numbers upset with this kind of behaviour. Wincor Nixdorf acts more open and wants to be categorised as fair and reliable partner in supplying self service solutions in a multi vendor environment. NCR is often seen as vendor who in the past could play the card of being the sole vendor. NCR still acts in a kind of commanding position. In the current competitive scenario NCR see that all that can happen is that their market share will go down. So they appear to be as unhelpful as possible to working with competitors. Wincor Nixdorf has made this experience in multiple projects. Then when schedules got delayed NCR tried to blame the other supplier, tried to take control and show how easy it is. A rather frequent customer remark heard is that NCR acts arrogant and obstructive to protect their accounts knowing that once another supplier is introduced then NCR have problems.

Attack NCR

-9-

4 What to say when dealing with NCR

Wincor Nixdorf may address various aspects when attacking NCR. In these days NCR run a number of business activities which are not strategic to them. The Teradata data warehousing segment is named to be strategic, but is not as successful as they would like it to be. The Financial Self Service and Retail Store Automation Solutions are cash cows and do not get as much corporate attention and support as possible. It appears sometimes that the self service group is subsidising other businesses of NCR. As well the fact that NCR’s self service manufacturing facilities are located in Scotland and the world headquarters are located in Dayton, USA are not helpful either. Wincor Nixdorf is focussing on self service solutions and has a long term view. The self service business has always been successful and even got stronger when the company got independent from Siemens. The investment company KKR has realised this several years ago. They did see Wincor Nixdorf’s ability to be a global player and how Wincor Nixdorf approached the market. A steady growing number of customers have selected Wincor Nixdorf rather than sticking to NCR with their old fashioned, conservative product range. All this should be viewed under the aspect that it is by far more difficult to win a new customer than keeping an existing one. 4.1 Corporate issues

NCR have tried a number of approaches designed to question Wincor Nixdorf’s long term future after KKR. This included Wincor Nixdorf’s ability to be a global player and our approach to the market. All are aimed at making customers think about selecting Wincor Nixdorf rather than seeing the true benefits of our offer. The following statements compare the Wincor Nixdorf facts and lists remarks relating to NCR.

Wincor Nixdorf NCR

Wincor Nixdorf is a profitable company, gaining constantly market share. The financial figures show that Wincor Nixdorf is a substantial company. As a result Wincor Nixdorf has i.e.taken over Prokent AG located in Ilmenau, Thuringia as latest financial investment.

The long term future of NCR’s self service activities is uncertain as they are part of NCR corporation. The self service business is not seen as strategic. The Personas ATMs are no new products, they are only repackaged fourth generation machines. New products have not been developed lately. Similar to NCR’s experience in the retail business NCR’s dominance in self service is decreasing.

Wincor Nixdorf is an independent company. KKR as well as Wincor Nixdorf senior management have a share in the company. KKR have a reputation of creating profitable companies and as they have in the US with Safeway they retain a share in the company.

NCR puts most of its attention on the Teradata warehousing. The financial figures of NCR corporation and competitive market situation in self service have resulted in a drain of workforce. This became visible again in the latest quarterly reporting of NCR.

Wincor Nixdorf is acting as a key vendor in the market and is financially healthy. In long term Wincor Nixdorf might go public to allow even further progressive growth.

As a result no matter what NCR say it is extremely unlikely that Wincor Nixdorf will be taken over by NCR or Diebold as this will go against community rules on monopolies etc.

Wincor Nixdorf impresses prospects and customers with an attractive visitor center and a modern production line.

Customer knowing NCR’s and Wincor Nixdorf’s facilities score the Paderborn experience higher.

Attack NCR

-10-

Wincor Nixdorf NCR

Wincor Nixdorf integrates the customer in developments which might look like customer specific for an external individual. Products manufactured are generally available and take care of individual customer wishes.

Wincor Nixdorf has shared at an early stage ATM visions based on blue tooth technology, the Blue safe ATM and cash recycling. NCR cannot show anything as impressive as bulk note cash recycling and this is what they are afraid of.

Wincor Nixdorf is recognized for listening to what our customers will be doing in the future and uses this knowledge to develop solutions that our customers want.

NCR offers rather standardized products. It was the availability of Wincor Nixdorf products which resulted in the wider choice of colors for the housing and integration of additional features.

Wincor Nixdorf runs since several years a well recognized Product- and Trend show with many important visitors from the financial industry.

NCR has nothing like the Product- and Trend show. Trends and visions are neither shared on CeBIT or during the RDS.

Wincor Nixdorf developed the ProCash 2150 with much input from Barclays Bank.

NCR have copied the design with their P86. But more importantly they tell people that they worked with Barclays. You cannot have it both ways. The success of the ProCash 2150 within Barclays proofs this.

In today’s world the trends are global and in Europe there is more relationship between what is happening in European countries such as Germany and Spain than what is happening in the US. Wincor Nixdorf with its roots here keeps a close look at Europe. The US is a good example of what can happen regarding simple cash dispensing developments but it is Europe with statement printing, passbooks, cheque- and cash-in handling that is leading the way for multi functional self service solutions.

NCR appears to push their customers down the US route. NCR believes that future banking trends come from the USA.

Neither customer specific nor innovative product developments will get a chance with an approach as practiced by NCR to hunt for big numbers with a small product portfolio.

Wincor Nixdorf’s strength is the way how we closely work with our customers. This should be presented as a strength. Wincor Nixdorf uses this focused approach to understand more the customer requirements than NCR.

NCR says that it is too large to offer their customers anything else other than their standard products. Obviously NCR explains this with their production processes. This attitude is not satisfying for customers. This should be understood as a weakness and expressed as such.

Wincor Nixdorf is supporting the countries/regional organizations with a direct line of communication to its Paderborn headquarters. In any kind of delicate decisions like pricing or technical support the appropriate departments are directly available. A quick response is guarantied.

NCR had over the last years created multiple management layers. It appears that this concept is currently streamlined to save cost and to act closer to the market. For a Scottish ATM manufacturing facility an additional administrative, corporate HQ in the USA is adding no benefits. Accordingly decisions have to be referred to the USA. This is a potential bottle neck.

Attack NCR

-11-

Wincor Nixdorf NCR

Wincor Nixdorf’s open customer focus is according to our clients an advantage as customers can have access to key management very quickly.

NCR’s layers of management increases the overheads and means that the customer has to go through layers of executives before getting to the key people.

Wincor Nixdorf is a more dynamic company than NCR. Wincor Nixdorf is growing faster and is taking on countries at a significant rate over the last years. There have been over 10 new countries added, Hungary was one of the later ones for self service (retail activities were already handled by the Budapest office). Today Wincor Nixdorf is represented in all key countries which signal a demand for self service solutions.

NCR was well established as international corporation with 100+ years of experience. On the other hand it has become some sort lazy and is continuously loosing customers. This is visible as well in the fact that Wincor Nixdorf have taken over many clients which were of greater importance to NCR. Barclays Bank is only one of many examples. With decreasing success NCR has been trying to get itself out of several countries by giving them over to distributors. Examples in the European area are Sweden and Norway. Here NCR have handed over their business to a distributor. Similar effects apply to Ireland and Portugal.

Wincor Nixdorf runs its own service organizations. Only where an own service group is not justified Wincor Nixdorf deals with external service partners. SBS, the service partner for ATMs in the UK maintain more NCR ATMs than NCR, with internationally known banks like LloydsTSB and HSBC.

Wincor Nixdorf is willing to work with third parties to maintain ATMs unlike NCR who do their utmost to prevent anyone other than NCR maintaining their systems.

4.2 Hardware related issues

Wincor Nixdorf have over the last years gained significant market share with the ProCash 2xxx product family. With statement- and transaction terminals the Wincor Nixdorf product range goes beyond the NCR offering which focuses very much on ATMs. Over many years NCR had with their fourth generation ATMs 56xx an attractive ATM concept. Currently NCR ATMs installed in the field are the NCR 56xx units and the Personas 58xx ATMs. The 50xx machines were third generation products and are the oldest ATMs already replaced over the last years. The majority of NCR ATMs in use are still the fourth generation 56xx units. NCR was so unsuccessful with their non-cash products that these products are barely visible in the field. The 5663 statement printer was not continued, neither the NCR 5682 transaction terminal.

Attack NCR

-12-

The fourth generation machines can be identified by the numbering 56xx. The third digit is either the 7 for indoor machines or 8 for outdoor units. The fourth digit is either 4 for mono functional units or 5 for multifunctional usage machines. A like for like comparison shows the ATM equivalents of NCR and Wincor Nixdorf xe systems.

Attack NCR

-13-

NCR have traditionally been seen to develop good quality products but in recent years NCR’s approach has been to release products that appear to be designed down to a price level. This apparently relates to the positive impression which Wincor Nixdorf has achieved with the ProCash 2150 in the Barclays project. The prime example was the unsuccessful Personas 86 which was brought to market to compete with the ProCash 2150. The P86 facia looks like a straight copy which is a compliment to the Wincor Nixdorf design. The mechanics were not as good as required. This resulted in ongoing problems with the NCR dispenser mechanism as NCR tried to correct the problems in the field. This approach of correcting in the field always annoys customers and the service companies.

Wincor Nixdorf NCR

Wincor Nixdorf has released with the ProCash xe machines a new dispensing mechanism to further increase uptime, serviceability and reliability.

NCR have repackaged the 56xx ATMs several years ago to look more attractive. These 58xx machines are called Personas but show no technical enhancements to the fourth generation ATMs. Wincor Nixdorf had implemented the idea of color customization earlier. Neither significant developments nor dispenser improvements have taken place with NCR ATMs lately.

Attack NCR

-14-

Wincor Nixdorf NCR

Wincor Nixdorf and other ATM manufacturer use friction pick in their dispensers. Friction provides a number of advantages over vacuum pick. Friction is the most reliable way of picking and moving documents. Photocopy machines are the best example to proof this.

NCR’s vacuum pick dispenser mechanism was developed from a De La Rue system. The vacuum note pick system works by the note being removed from the cassette by plungers creating a vacuum over the note thereby pulling it away from the cassette.

Originally it was implemented with the vertical note dispenser on the NCR earliest ATMs e.g. 1780. It was then changed to horizontal which is not the best position for vacuum picking.

Durst and dirt being sucked into the dispenser may result in faults of the vacuum system.

The cash cassettes deployed by Wincor Nixdorf use the stepper motor which guarantees a steady pressure on the stack of notes. Even the last banknote can be dispensed this way.

NCR goes a much more basic way in using a spring in their cash dispensing cassette. The more cash is filled into the canister the tighter the spring. The spring relaxes the more notes have been dispensed out of the cassette, so the more likely is the situation that the last notes do not get properly dispensed.

Friction based technology is better at picking single notes in most situations than vacuum. Wincor Nixdorf has no reported miscounts.

New notes often suffer from static electricity that sticks them together. Customers tell us that NCR has still serious problems with Euro notes. Miscounts with higher and lower amounts dispensed do happen frequently on new NCR ATMs. In these circumstances with vacuum pick there is the potential for an increased rate of double picks which reduces the dispensing capacity of the ATM. Damaged notes can be difficult to form an air tight seal so vacuum pick can be a problem. This is not a problem with friction pick.

Wincor Nixdorf friction pick technology automatically adjusts for wear and tear. Wincor Nixdorf take into account that the picking mechanism tolerances increase with usage.

The NCR vacuum pick needs an engineering visit to clean the filter and pump. Anything that is sucking in air is going to suck in dirt and debris – notes are full of dust and reside from handling, again a possible cause of trouble.

Wincor Nixdorf uses friction because it is working fast and everywhere.

Vacuum pick is slower than friction in picking notes. The vacuum pick is less tolerant of altitude and especially minus temperatures.

Friction does work at any common atmospheric pressure and is not prone to excessive temperatures.

NCR ATMs need a positive internal atmosphere. NCR has to make sure that air at outside temperatures does not enter the cabinet. Vacuum pick technology relies upon rubber type seals, as the temperature drops the seals get hard and can be more prone to leak.

Attack NCR

-15-

Wincor Nixdorf NCR

The reject- /retract cassette has two compartments to separately store retracted and rejected notes. This way a revision control is achieved best.

The NCR reject- /retract box is by far not as advanced, as it does not differentiate between both incidents. As a result the ATM will go out of service as otherwise a revision is impossible.

Wincor Nixdorf is looking on the whole ATM dispenser mechanism as this effects the capability of the ATM.

NCR used roller technology in their third and fourth generation ATMs. As of the new NCR Personas 86 they have adopted the Wincor Nixdorf able to match Wincor Nixdorf developments and there have been many reports of problems with i.e.the P86.belt philosophy. NCR seem not

Wincor Nixdorf ATMs are printing the receipt “face up“ which is user friendly and allows for receipt advertising on the back.

In NCR’s ATMs receipts are printed “face down”. NCR say that our receipts are not customer friendly as they do not keep their printed account details confidential. The reality is that you would not be able to read the printed figures so it is no major issue. Face up is in fact more convenient for customers. If the receipt is face down then some customers may think that they have been given a blank receipt. Printing the receipt face up does not reduce the impact of advertising as customers do see both sides of the receipt when they handle it.

Wincor Nixdorf has a cash recycling system in place which is approved by the EZB.

NCR is saying to work on the development of a next-generation recycler. A ready to go product is not yet available.

Wincor Nixdorf has EMV level 2 certification. All certification processes are in place and developments follow accordingly. With the large number of ATM customers we have implemented EPP enhancements for years. Wincor Nixdorf deploys EPP 4+ and is leading the development.

NCR state that they have their software and hardware certification in accordance with EMV standards.

NCR and Wincor Nixdorf cash out cassettes can be installed either with locks or tamper indicators to show if they have been attacked. Wincor Nixdorf has the value of the stepping motor against the spring in NCR cassettes. Wincor Nixdorf can dispense to the last note which is rather important in the day to day handling.

NCR cassettes are easy to open, the shutter on an NCR cassette can be opened by using two screwdrivers (or similar tools). The only indication that this had happened would be on the tamper indicating cassette where the insertion number had incremented by one. Who would notice this anyway?

The Wincor Nixdorf ATM fascia can be easily racked out into the street if a light or a decal has to be changed or work on the shutter, EPP or LCD has to be performed. This work can be done quickly and without dismantling the ATM.

NCR used the argument that thieves seeing that the fascia racks out could attempt to force bank staff to get cash out of the safe. Actually any repair at NCR shutters or EPPs requires major dismantling of the NCR machines.

Attack NCR

-16-

The following picture was taken by a customer while a NCR field engineer was trying to fix some components in the head of a NCR Personas ATM. Mind that even the side panels of the ATM head had to be demounted.

4.2.1 PINPAD and EPP NCR is weak in discussions on the topic of PINPADs. Wincor Nixdorf provides customer- and country specific PINPADs. The units are out stainless steel and give tactile feedback. The PINPADs transfers the PIN in a coded way to the electronics of the self service system. Wincor Nixdorf follows the ISO 8583 rules.

Attack NCR

-17-

It appears that NCR is not aware of the capabilities of the EPP V4x (Encrypting PIN Pad) which prevents any kind of external attacks. The unit follows the security regulations of ISO 9564-1. Various standing bodies in key countries (like the ZKA-Zentraler Kredit Ausschuss in Germany or CB in France, the Austrian Payment System Services) and Mastercard and VISA request “EMV” functionality for their smart card transactions.

Wincor Nixdorf makes sure that the PIN will be coded directly within the keyboard. This way the PIN gets not visible at any time. Wincor Nixdorf has designed the EPP that any kind of manipulation will result in a loss of the keys and the software. NCR says incorrectly that the internal security software and keys could not be loaded in secured and proven manner by third parties. Wincor Nixdorf EPP V4 have the following functionality:

Single DES Triple DES RSA Prozessor EPP V4.0 X X no Dallas 5002 EPP V4 RSA X X max. 1024 Bit Dallas 5002 +

RSA Coprocessor EPP V4+ X X max. 4096 Bit Dallas 5240

The EPP V5 fulfills even higher security requirements than the one of competitors. Wincor Nixdorf follows the ISO 13491 und ISO 9564-1 specifications to be a „tamper responsive hardware security module“. The Wincor Nixdorf EPP V5 is by far more advanced than the NCR equipment. It works as a central security device to code the PIN on its way to the Host. The EPP V5 supports the EMV requirements regarding Triple DES (3DES) und RSA functionality.

Wincor Nixdorf NCR

Since 1995 Wincor Nixdorf provides an external approved tamper resistance PIN Entry Device, called EPP. Since 1998 Wincor Nixdorf offers an online key loading function for the EPP V4 family by using as initial transport key a double length Triple DES Key. I.e.Deutsche Bank had 1400 ATMs and Swed Banken about 1000 ATMs use this procedure since 1998.

NCR EPP offers only a key loading function with public key infrastructure. For implementation of the RSA key pairs with a customer specific signature, those NCR EPP must be exchanged. Wincor Nixdorf EPP V4+ and EPP V5 have the feature to implement those customer specific signed key pairs in the field. This is a real benefit for Wincor Nixdorf.

The whole range of Wincor Nixdorf EPPs V4 are able to support Triple DES without a hardware exchange. (EPP V4 was released in 1998). All WN EPP V4, V4+ and V5, have the possibility for a secure software upgrade in the field. (Depending on network protocol and software distribution tools (ProView Tivoli)).

NCR are weak on Triple DES 3 support, The NCR BAPE does not offer this – only their HI BAPE and Yes. Details on the NCR download function are not known.

In 2001 Wincor Nixdorf delivered the first EPP V4+ with RSA to France, which fullfilled the Cartes Bancaire requirements. This EPP V4+ includes a Dallas 5240 Crypto processor.

The PIN Entry Devices from NCR (EPP) and even Diebold (EPP 4) using the Dallas 5240 were first released in the middle of 2002 – significantly later.

In 2003 Wincor Nixdorf released the 5th generation of PIN Entry devices. The EPP V5 also includes 4 SAM* plug in sockets for to be defined extensions of crypto algorithms in the future. (*SAM Secure Acess Module ID0000 smart card)

The NCR EPP and Diebold EPP 4 do not include such sockets. These competitor EPP must be exchanged if a new crypto algorithm becomes a standard.

Attack NCR

-18-

Wincor Nixdorf NCR

The Wincor Nixdorf EPP V4+ and EPP V5 will be able to support AES. But today no banking products do use AES, neither a product specification is available. Wincor Nixdorf will provide a firmware (EPP Software), when first product specifications become available.

NCR did announce that the EPP supports AES. How can NCR say so, when neither host- and card products have been already specified for AES usage?

On the subject of remote key loading In a multi vendor project in the UK, Wincor Nixdorf defined before NCR the EMV and Remote Key loading function.

The Wincor Nixdorf specification was also the base input for the CEN XFS 3.0 standard.

The NCR and Wincor Nixdorf remote key loading solution (using Public key Infrastructure/RSA Private and Public key) are using the same technology. It is called signature based.

NCR claim incorrectly a benefit for themselves. NCR’s solution is not better

The Wincor Nixdorf PIN Entry Devices follow the Guidelines (CSA, BSA, ADA etc.) for handicapped people. In comparison to NCR the Wincor Nixdorf ATM provide EPPs with larger key tops. Numeric keys (B x H) 23,5 x 18,5 mm Function keys (B x H) 50,0 x 18,5 mm Visible Keyboard area 1 60 x 102,5 mm The advantages are bigger numbers and characters and key tops which are visible also for impaired people. Wincor Nixdorf also follows the guideline to have a high contrast between characters and overlay surface. This is the reason why Wincor Nixdorf uses color brackets/lines in the function keys. Customers with Red/Green deficiencies have also a chance to recognize the text on the function keys.

The NCR keys are smaller: Numeric keys (B x H) 22 x 16 mm Function keys (B x H ) 22 x16 mm Visible Keyboard area 130 x 90 mm Rather negative is that they use black letters on completely red or green function keys. In this case NCR do not follow CSA and ADA guidelines for high contrast labeling.

Regarding security Visa requires a secure procedure for repairs of PIN entry devises. In the past some attacks already happened, because some criminals added spy devices between the keyboard and the hardware security module. A disconnection of the EPP keyboard and the hardware security module activates automatically the alarm switch which destroy immediately all sensitive data inside the EPP. Because of the different cryptic functionality and the knowledge of the sensitiveness of this device, Wincor Nixdorf defines the EPP as a field exchangeable part. The repair is only possible in a secure approved environment.

NCR provides a service operator mode which makes a quick exchange of the keyboard possible. Regarding security this gives way to criminal attacks to include spy equipment . It must be quoted that VISA international does not accept this NCR EPP feature.

Attack NCR

-19-

4.2.2 NCR 5674 and NCR 5874

The NCR 5674 and Personas 74 (official code 5874) are mono functional lobby ATMs. With the more attractive ProCash 2000xe we can easily show to be better than NCR.

Attack NCR

-20-

The NCR units are less user friendly than the ProCash 2000xe. Wincor Nixdorf made the ProCash 2000xe smaller in width than the NCR 5674. The NCR card entry device is located to far to the right and the cash gate is not centered as with the Wincor machine. A NCR ATM user will feel less protected when operating the machine. This applies in the same way to the NCR 5874. NCR appears to have primarily focused on the colour customisation and design. The bag rest which was introduced first to the ProCash units has been copied with the Personas. Regarding technology no changes showed up.

4.2.3 NCR 5675 and NCR 5875 The NCR 5675 is the multifunctional indoor ATM. Typically the Wincor Nixdorf ProCash 2100xe would be the replacement option of choice. The equivalent on NCR side is the Peronas 75. Although the 5875 gained some improvement in design over the old fashioned 5675 the Wincor Nixdorf ProCash 2100xe gets more credit as it is smaller in size and requires less service space.

Attack NCR

-21-

4.2.4 NCR 5684 and NCR 5884 The NCR 5684 is the outdoor ATM being deployed where a mono functionality with cash out only is required. Typically the Wincor Nixdorf Procash 2050xe is the ATM to attack NCR 5X84 installations. The next generation NCR Peronas model would be the 5884.

The NCR 5684 is a fairly old fashioned ATM. With its dark attire, bigger width and unfriendly access for field engineers to the screen, its PinPad etc. the NCR unit is no state-of-the-art model anymore.

Attack NCR

-22-

The NCR Personas 84 appears wider in size than the Wincor Nixdorf 2050. The security for the client withdrawing cash is more limited as a human body can cover less area at the Personas 84 than at a ProCash 2050. The left centered screen and the cash gate to the right are less optimal than a centered solution with the ProCash 2050. The Wincor Nixdorf ATM user feels safer, no one else can shoulder surf the transaction process and see how the user takes his cash.

Attack NCR

-23-

4.2.5 NCR 5685 and NCR 5885 / NCR 5886 The NCR 5685 is the TTW multi function ATM for outdoor installations. The following picture clearly show that the NCR 5885 is nothing else than new wrapping of an old fashioned unit.

Wincor Nixdorf can easily attack these installations with the ProCash 2150. The first customer which took his old NCR estate out was Barclays Bank. Wincor Nixdorf continuously receives orders from this and other customers as the ProCash 2150 is more attractive in size and more user friendly.

As NCR did see their chances diminish with the release of the Wincor Nixdorf ProCash 2150, they developed the Personas 86. The NCR 5886 is a dedicated development by NCR as response to the success of the ProCash 2150. NCR did fail with this approach. Barclays as many other customers were not convinced.

Attack NCR

-24-

4.3 Dimension issues when replacing NCR ATMs Wincor Nixdorf has placed multiple replacement activities and could prove in all cases to easily exchange old NCR ATMs. Wincor Nixdorf is working since years with a removable plinth concept. We have seen multiple cases where the NCR plinth has been made by solid concrete which resulted in major effort to destroy these even when a newer NCR unit was to install.

For those who believe that when migrating from NCR 56xx to Personas 58xx no building work would be required the following drawing clearly shows that i.e. with the NCR 5884 an extension of the hole becomes necessary. In the left corner an additional hole in the size of a shoe box has to be cut out.

So unlike Wincor Nixdorf NCR does not have a smooth migration path. They do say so, but the drawing above proves the opposite – major building work is required when migrating from NCR’s fourth generation ATMs to the Personas machines. 4.4 Service access - Issues with NCR Personas 8x Customers with a very detailed experience on NCR have always remarked the bad access to components like the PinPad, shutter, screen, etc. in TTW machines. This did apply to the fourth generation NCR 56xx ATMs and is still valid with the Peronas models. The photo shows a field engineer trying to get access to the interior components in the head of a Personas ATM.

Attack NCR

-25-

Compare by yourself how easy and quick this is with the ProCash 2xxx units. The fascia on an outdoor Wincor Nixdorf Procash 2xxx can be rigged out much more easily and parts exchanged without body gym.

One of our customer has measured the efforts of exchanging various components on the Wincor Nixdorf ATM and compared this to NCR.

4 minutes2 minutesIllumination

50 minutes5 minutesShutter

15 minutes1 minutePrivacy visor

15 minutes5 minutesScreen

60 minutes2 minutesKeyboard

Duration NCRDuration ProCash 21x0

ComponentExchange

4 minutes2 minutesIllumination

50 minutes5 minutesShutter

15 minutes1 minutePrivacy visor

15 minutes5 minutesScreen

60 minutes2 minutesKeyboard

Duration NCRDuration ProCash 21x0

ComponentExchange

Attack NCR

-26-

4.5 User access and customer security with NCR Wincor Nixdorf is leading in security issues and works on customer friendly solutions. We do talk to our clients and come with attractive solutions. We do avoid scenarios like the following NCR installation:

Wincor Nixdorf i.e. uses innovative skimming detection by sensor monitoring. A magnetic field sensor would detect a permanent change of the field in front of the reader. NCR thinks that a simple plastic throat in front of the card reader is sufficient. Wincor Nixdorf did get the ATM security best technology award in 2003.

Attack NCR

-27-

5 Why the Wincor Nixdorf Software is better

With regards to NCR’s APTRA development Wincor Nixdorf is ahead of competition. NCR have made a number of defense remarks regarding ‘ProTopas’ which were intended to show that APTRA might be better than ProTopas. The Wincor Nixdorf early success with many international customers have proved that Wincor Nixdorf has the only truly open system with an ongoing development program.

5.1 The Wincor Nixdorf multivendor advantage The international Self Service Platform against NCR is ProClassic. This component based architecture has developed over time from a monolithic, then client/server approach to an object web scenario.

With the ProTopas solution Wincor Nixdorf offers more than 5 years experience in multivendor software. In many projects ProClassic is used and has been deployed by top international banks. ProClassic is proven in live installations and runs as plug and play solution within all the standard host protocols such as NDC, (as well Diebold 9xx , PBM). Its benefit lies in the fact that it is a 100% developed on NT and is not ported from OS/2 or other platforms. Banks generally require a flexible, reliable and efficient solution to run their ATMs. In the past the banks have lacked an open and modern software architecture to allow for a 100% multi vendor approach. They have felt locked in by NCR and are in the process of leaving this mouse trap . ProTopas is using the flexible, scripted Host connector architecture to bind web-technology and classical connectivity (SNA, X.25, ..). ProTopas handles the TWIN connection (Host system to Application server) in parallel and synchronous. Obviously the financial institutions look to reduce the total cost of ownership. Next to hardware issues mostly the idea of only one single application for all Self Service Systems is born. In these days flexibility to introduce new functions quickly and cost effective is required. With the ProTopas software the implementation of changes can be realized at once and a roll out to any open self service system can offer independence from NCR as a single hardware vendor.

Attack NCR

-28-

The same thought applies to standard solution for installation and updates. Wincor Nixdorf offers the better solution for monitoring. We do have a very successful solution with a large installed base and a proven track record of being constantly ahead of technology trends (ie. Full Web-Connectivity, PC/E…).

5.1.1 Sample of success with software as driving factor

In Rabobank the ProTopas standard solution focused on the network integration of 2.800 NCR ATMs based on ProTopas and WOSA/XFS. Here as well the bank wished a supplier independence across the whole self service network.

5.2 Differentiators Wincor Nixdorf vs. NCR

Taking a closer look at NCR in the above graphic compares the environments.

Attack NCR

-29-

5.3 Benefits of using Wincor Nixdorf

The Wincor Nixdorf approach is to operate ATMs of different vendors (i.e. NCR) with standard features such as PinPAD, card reader etc. by applying vendor specific device drivers. Beyond this, additional functionalities are offered. NCR is not capable doing this.

Attack NCR

-30-

Wincor Nixdorf has proven over the past their ability to predict and influence the future aspect of self service regarding software as well. This will continue with our steady growth. NCR can not show their customers real successful cases such as Wincor Nixdorf with Rabo Bank and others where ProTopas is running across NCR and Olivetti platforms. We have more ProTopas multi vendor installations than NCR with APTRA. What you need to know is that in a marketing ploy NCR renamed old systems as APTRA to give the impression of progress.

5.4 What is NCR’s APTRA? NCR’s APTRA solution is based on Microsoft’s NT, Active X, COM technologies. It is also based on the ActiveXFS standard, which has been adopted by CEN as the COM interface for WOSA/XFS. ActiveXFS was a joint venture between NCR, Microsoft and Nexus to develop a new Multi-Vendor standard based on the Microsoft COM Architecture. ActiveXFS Objects form the basis of NCR’s APTRA Solution. NCR try to say that these features are industry standards but we all know that they are manufacturer based and are not as open as WOSA XFS or Java XFS which Wincor Nixdorf have adopted. 5.5 APTRA™ Advance NDC ‘Direct connect’ ATM applications (e.g. NDC, Diebold 910 and 911/912 or PBM) are based on old direct connect software architectures and design philosophies dating back to 1979. In the late 70s, these systems were designed as state of the art for unintelligent systems (PC-based systems did not appear until the end of the 80s). Control in these architectures is assumed by the host or switch. If one of the two cannot be reached, the entire ATM network comes to a standstill. Moreover, all changes that are made to the ATM software must be downloaded to all the individual direct connect terminals via the network. As NDC is NCR’s proprietary interface they do not automatically make every new version of this specification available to its competitors. They usually obtain the specification in return for a fee or via unofficial channels through ‘friendly’ banks, who rarely possess the latest version. Comparing to Wincor Nixdorf, we can say that the outdated NDC architecture and the proprietary, non standardized protocol for current network architectures and the possibilities these offer, involve too many restrictions. APTRA™ Advance NDC does not represent a generation change but is ‘merely’ a new version of the old NDC software application that can still be found running on OS/2 systems today. APTRA™ Advance NDC is Windows-based (Windows NT or XP) and also supports Web browsers. However, the product is not XFS-based and thus not multi vendor capable, but the software does support the old fashioned NDC “states and screens”. As is the case with any direct connect software, changes have to be made to the host and APTRA ATM software if customers want to implement new functions. The “states and screens” technology was designed specifically for self-service systems in direct connect environments, and therefore limits software reusability in other channels or control of ATMs with the same software that is used for other Web-based channels.

Attack NCR

-31-

5.6 Comparision ProCash/NDC and APTRA™ Advance NDC NCR lists several arguments in favor of using APTRA™ Advance, which also apply to Wincor Nixdorf’s ProCash/NDC; in addition to this, our product is also XFS-based and multi vendor-capable. NCR’s arguments showing the benefits of using APTRA™ Advance (quoting NCR) are: Protection of investments made in the NDC host by migrating the ATM channel to Windows Update the existing self-service environment (hardware and software) to open development

environment (Windows) with support for new devices Enhanced support for the ATM channel in areas such as deposit automation, marketing,

advertising, security standards and legal requirements.

Wincor Nixdorf ProCash/NDC NCR APTRA™ Advance NDC

EMV and RKL are supported via extended Wincor Nixdorf specifications as agreed with the switch providers, preparation of Wincor Nixdorf’s own specification..

EMV and RKL support happens via extended NDC specs.This is a proprietary extension, since NCR does not publish the interface and, in particular, does not make it available to competitors.

The functions of APTRA™ Promote are standard delivery in ProCash/NDC.

APTRA™ Promote is an add-on product and is only standardly supported as of AANDC 2.04.

To date, ProCash/NDC (NT) is deployed in more than 12,000 installations in over 50 countries.

AptraTM Advance NDC is only used by 50 customers in 27 countries.

Wincor Nixdorf ProCash/NDC offers full integration with NT standard software and integrated ADRS (Automatic Device Repair System). The ProView or SST agent (incl. SNMP) enables integration in all monitoring/ management systems (TIVOLI, CA Unicenter, BMC Patrol, etc.).

NCR offers an integration with industry standard software and health management products. It is compatible with the GASPER product line.

Wincor Nixdorf provides the market with an NDC emulation. Emulation providers are normally at a disadvantage until they become ‘official’ owners of the proprietary specifications.

NCR owns the NDC specs – NCR does control the further development of NDC so that it keeps ahead of its competitors.

Wincor Nixdorf ProCash/NDC supports CEN-XFS defined status messages and original NDC status messages.

NCR supports original NDC status messages but no XFS support.

Wincor Nixdorf ProCash/NDC can be used with a minimum of 64 MB RAM. We do recommended at least 128 MB when using the HTML interface.

NCR mentions a minimum memory requirement of 64MB.

The Wincor Nixdorf support for new devices is implemented fast under XFS and then submitted to CEN for standardization. Any changes that CEN proposes are automatically included in later versions.

NCR offers a proprietary implementation in support for new self-service devices, but no support for the CEN-XFS specifications.

Wincor Nixdorf uses either conventional or Web-based interfaces (included in ProTopas/NDC). The use of HTML pages that are not stored offline in the system are supported from the add-on product ProTopas/Web-Extensions.

NCR gives only standard support for Active-X and Internet.

Attack NCR

-32-

Wincor Nixdorf ProCash/NDC NCR APTRA™ Advance NDC

Numerous standard communications cards are supported (Eicon C91, Ethernet cards, Token Ring, V.24).

Only PCCM support (special communication card from NCR).

Wincor Nixdorf supports more transactions, e.g. credit transfer, PIN change, etc. Others are available on request.

---

5.7 EMV support EMV is a standard, defined by Europay, MasterCard and VISA. It aims to prevent credit card misuse and abuse resulting from the use of magnetic stripe cards. EMV is defined for smart card based credit and debit transactions and also supports future multi-application smart cards. The migration from magnetic stripe to chip requires EMV cards, EMV terminals (ATM & POS), network and host alignment to support EMV transactions. On January 1, 2005, liability is due to shift from the issuer to the acquirer. At national level, the dates for the shift vary. This naturally speeds up the demand for EMV systems. In November 2002, Wincor Nixdorf released its add-on product ProChip/EMVDebit/Credit (WIN NT) V1.0. This EMV kernel has already been granted level 2 approval. Adjustments to ProCash/NDC have already been made, as have agreements with key switch providers. At the end of 2002, NCR also introduced EMV extensions for APTRA™ Advance NDC 2.04. They do not have any advantages compared to Wincor Nixdorf although saying so.

5.8 APTRA™ Promote support The creation and administration of marketing and advertising campaigns is supported in NCR self-service networks in conjunction with APTRA™ Advance NDC 2.04. It enables the following objects to be managed and adjusted:

PCX, JPEG and bitmap images with a resolution of 640 x 480 or 800 x 600, 16 million colors

Audio files in standard Windows NT format (.wav) Animation files in MPEG type II format

It is also possible to set various trigger points for advertising. The functions of APTRA™ Promote are already a standard delivery with Wincor Nixdorf’s ProCash/NDC as of version V1.2. Only with APTRA™ Advance NDC version 2.04 NCR does support the functions of the add-on product APTRA™ Promote 2.0. 5.9 Installed base NCR has a relatively small installed base with APTRA™ Advance NDC at small and medium-sized banks. These include:

Bank of Ireland Royal Bank of Scotland Nationwide Universal Savings Bank Commercial International Bank

Attack NCR

-33-

National Bank of Oman Al Fallah Bank Qatar National Bank Doha Bank KocBank Abu Dhabi Islamic Bank Emirates Bank International

The ProCash/NDC installed base is much larger and the list of customers includes the following banks:

Lloyds Bank (UK) Rabobank ABN/Amro JP Morgan Chase (USA) BNPI (Lebanon) Interpay (NL) ACS (Slov.)

5.10 Partner program APTRAXpress is NCR's software and service partner program. A Business Manager and a technical Consultant give the switch partners access to the latest information on NCR's software strategies, roadmaps, training courses and hardware. The switch partners rely on NCR’s hardware and software support in order to test their solutions prior to customer deployment. The Wincor Nixdorf equivalent is ProClassic PARTNERplus, a successful partner program that has met with widespread acclaim. 5.11 Vendor independence Wincor Nixdorf has over the last years gained a fine reputation of being a leading provider of vendor-independent software. Wincor Nixdorf was the first to have developed an open application solution for self-service systems. The first product of its kind in the form of WOSA/XFS and OS/2-based ATM software was installed on schedule for Deutsche Bank on April 28, 1995. In February 1995, a CSC cash dispenser with WOSA/XFS on WINDOWS NT had been delivered to the National Westminster Bank in London. On the basis of this standard, Nat West was developing its own application for automated teller machines. This step enabled SNI to provide the first ATMs worldwide with vendor-independent standard platform components for certification in customer environments. It was only much later that NCR announced support for XFS and vendor independence for self-service systems. Migration to XFS and the Windows operating system can be completed in one step on automated teller machines, since the operating system change makes it necessary to replace the entire terminal software. NCR states the following reasons for planning the two different steps (first APTRA Advance NDC, then possibly APTRA Edge): building block principle, less risk; spread investments over a longer period; one successful step justifies the next. The original NDC status messages are detailed and more exact than the messages from the CEN-XFS interface (faster, easier to eliminate errors; higher ATM availability) whereas the messages of the CEN-XFS interface guarantee vendor independence; in contrast to APTRA™ Advance, ProCash/NDC therefore offers both options as standard.

Attack NCR

-34-

According to NCR, other vendors with NDC emulations already offer vendor independence via the host. However, true vendor independence can only be achieved on the basis of XFS. Since APTRA™ Advance NDC is not based on XFS, NCR has difficulty finding the right arguments at this point. 5.12 What is APTRA™ Edge NCR’s APTRA™ Edge supports the following transactions:

Cash dispensing Account balance Credit transfer Envelope deposit SOP Receipt and paper journal Encrypting PIN Pad Aggregate Builder for easy installation CEN-XFS 2.0

Further development (planned):

Fast cash Complete and mini statement printing PIN change APTRA™ Promote Consumer flow with full transaction support Passbook support Support for Dual Dispense, iMCRW and DipSmart. Electronic journal (in APTRA™ ActiveXFS) Spray dispenser

Planned for later versions (according NCR) are:

CEN-XFS 3.0 functionality Remote Status Authorization (encryption key loading) Coin dispensing Barcode reading Card dispensing – small media output Cash recycling

5.13 The differences between APTRA™ Advance NDC and APTRA™ Edge There are some basic differences as briefly listed: APTRA™ Edge claims:

to be based on open industry standards. Should allow vendor independence through CEN-XFS. Reusability of investments (Web technology, tools, know-how, …) in other channels. Cross-channel development and transaction sharing. Modern, object-oriented design – intuitive programming environment, i.e. significantly faster

application development.

Attack NCR

-35-

APTRA™ Advance NDC is:

Host-driven Based on “states and screens” Windows® based version of NDC (NDC+, US NDC)

5.14 Comparison ProCash/NDC (and ProTopas/Manager) and APTRA™ Edge Arguments showing the benefits of using APTRA™ Edge (statements from NCR)

New services and devices can be added easily and at speed (‘no disruption’ architecture) An additional ATM channel is created to support new security standards and changing legal

requirements. Multichannel usage, reusability of software and know-how in other channels, cross-channel

development, transaction sharing. A single application used in all ATM channels, even when ATMs come from different vendors. The ATM channel as the central component of the customer relationship management (CRM)

strategy. APTRA™ Edge enables the integration of data warehouse and self-service technology.

Standards such as IFX, CEN-XFS, ACTIVE XFS, SNMP, EMV, NDC, 911, 912 are supported. Apart from a few marketing slogans, NCR only makes slight reference to the fact that APTRA™ Advance NDC and APTRA™ Edge are completely different products. It places major emphasis on the evolution strategy, compared with what they say is a more risky complete realignment.