AES Migration Program Updates

Archives

23 November 2023

In July, work commenced on the first six months of the Initiation and Mobilisation phase of this project. This phase is focused on the technical blueprint and options to approach the migration.

Technical blueprint

In August, the first Standards and Requirements Working Group (SRWG) meeting was held, and a draft set of standards for the AES Technical Blueprint representing the industry target state for migrating Australian card payment system to AES.

Following this meeting, further SRWG meetings were held to develop a draft Technical Blueprint Handbook which underpins the set of standards for the AES Technical Blueprint. This handbook will enable Members to plan their respective projects in support of the AES Migration Program. AusPayNet anticipates the final release of the handbook will occur in April 2024.

Migration options

AusPayNet continues work to establish a set of viable options for approaching the migration to AES, including co-existence of AES with the current encryption standard for the Australian card payments system, TDES (Triple Data Encryption Standard).

In February 2024, a Migration Planning Working Group (MPWG) will be established with Member representation across the Australian card payments system. The goal of the MPWG is to define a strategy, approach, and plan to migrate to AES. The first objective of the MPWG will be to define an interim release of AES Migration Strategy by June 2024. This strategy will provide support for Members to define their projects to migrate to AES.

18 August 2023

In December 2022, work commenced on developing a Program Initiation Document (PID) for the AES Migration Program, detailing the background, rationale, approach, and plan for migrating to AES for the national card payments system. A consultative approach was taken to developing the PID, allowing Members to review, endorse, and validate content for the PID through several working groups, representing Members from the Issuers and Acquirers Community (IAC).

Since December 2022, four iterations of working group meetings have been held, resulting in the final draft of the PID being endorsed in May 2023.

The plan to migrate to AES has two phases:

• Initiation and Mobilisation (July 2023 – December 2024): This phase includes preparatory activities to finalise outstanding issues – including the technical blueprint, testing strategy, migration approach, legal, risk and compliance assessment – to provide time for participants to formalise their business cases, secure funding, and mobilise teams. It is anticipated that participants will be ready to commence their programs by January 2025.
   
• Execution (January 2025 – December 2030): This phase includes industry readiness activities leading to an industry pilot, with migration to follow. An extended period of coexistence has been planned for the migration. This enables assets to be upgraded in line with their natural replacement cycles, as far as is possible, thus reducing marginal effort and cost. Execution will complete once all assets have been upgraded and TDES (Triple Data Encryption Standard) has been removed.

In July, work commenced on the first six months of the Initiation and Mobilisation phase, focused on the technical blueprint and options to approach the migration.