Reference

Payment Technology Migrations

What is replacing what — magnetic stripe to EMV, 3DES to AES, MT to ISO 20022, FAPI 1.0 to 2.0, passwords to passkeys, batch to instant, PSD2 to PSD3 — with how far each migration has got, the dates that drive it, what changes for engineers, and the tools and guides on this site that cover it.

Domain
Kind

Timeline, 2014–2035

Each bar runs from the first milestone to the target year. Colour and the marker say how far along it is; the vertical line is 2026.

Completed · Old technology retired, or the new one mandatory wherever it mattersIn progress · Mandates in force; both generations run side by sideAnnounced · Dates and specifications set; few production deployments yetHorizon · Standards or pilots exist; no mandate or sunset date yet

Cards & EMV

In progressReplacement2014–2033

Magnetic stripeEMV chip and contactless

Indicative progress of the installed base: 90%

The longest migration in the industry is in its last phase: chip is universal, contactless dominates card-present volume, and the stripe itself is being removed from cards.

Why it is happening

Static track data is trivially cloned. Chip cryptograms (ARQC) make each transaction unique, and liability shifts pushed the cost of fraud onto whichever party had not upgraded.

What changes for engineers

  • Fallback-to-stripe transactions are declined or re-routed by most issuers; POS entry mode (DE 22) and service codes still carry the history.
  • Track generators and stripe encoders remain only for testing legacy acceptance.
  • Terminal estates converge on contactless kernels; the card itself may ship without a stripe.

Milestones

  1. 2005-01UK liability shift to chip and PIN
  2. 2015-10US EMV liability shift for POS
  3. 2021-08Mastercard announces the phase-out of the magnetic stripe
  4. 2024Newly issued Mastercard cards in Europe no longer need a stripe
  5. 2027No new Mastercard cards issued with a stripe in most markets
  6. 2033No Mastercard credit or debit cards carry a stripe
EMV contactless kernelsPOS entry mode referenceService code decoderTrack data generator
AnnouncedVersion upgrade2022–2035

RSA offline data authentication and 3DES cryptogramsElliptic-curve ODA and AES session keys (EMV 4.4, Kernel 8)

Indicative progress of the installed base: 5%

EMV's cryptography is being renewed for the first time since the 1990s: ECC replaces RSA for card authentication, AES replaces 3DES for cryptograms, and Kernel 8 is the contactless kernel built on both.

Why it is happening

RSA key sizes and 3DES block sizes are at the end of their useful life, and a smaller elliptic-curve footprint suits contactless timing budgets. It also positions the card system for the post-quantum transition.

What changes for engineers

  • Certificate authority public keys, issuer keys and ICC keys get ECC equivalents; terminal CAPK tables grow a second family.
  • Cryptogram verification, UDK derivation and session-key generation need AES paths alongside 3DES.
  • Personalisation profiles, HSM firmware and kernel certification all move together; expect long dual-running.

Milestones

  1. 2022EMV Contactless Kernel 8 published, built on elliptic-curve authentication
  2. 2023EMV 4.4 specifications add ECC offline data authentication and AES options
  3. 2025First Kernel 8 terminal approvals and card profiles
  4. 2030Scheme roadmaps place RSA retirement alongside the post-quantum migration
Kernel 8 and the kernel familyARQC calculatorUDK calculatorPost-quantum payments
CompletedVersion upgrade2017–2026

6-digit BIN8-digit BIN (ISO/IEC 7812-1:2017)

Indicative progress of the installed base: 75%

The issuer identification number grew from six to eight digits. The standard and scheme rules are in force; issuer ranges and downstream systems keep converting.

Why it is happening

Six-digit BINs were running out as issuers, products and tokens multiplied. Eight digits give a hundred times the address space.

What changes for engineers

  • BIN tables, routing rules and fraud models keyed on six digits must handle eight.
  • PCI DSS masking moved with it: first eight plus last four is permitted for PANs of 16 digits or more.
  • Tokens and test ranges are issued from eight-digit blocks.

Milestones

  1. 2017-01ISO/IEC 7812-1:2017 published
  2. 2022-04Visa and Mastercard 8-digit BIN rules effective
  3. 2022-03PCI DSS v4.0 allows first-8 / last-4 display
BIN lookupToken format checkerPCI DSS reference
In progressReplacement2014–2030

PAN stored on fileNetwork tokens (EMV Payment Tokenisation)

Indicative progress of the installed base: 60%

Wallets have been token-only since 2014; card-on-file e-commerce is following, with Mastercard targeting no manual card entry in Europe by 2030.

Why it is happening

A token bound to one domain is useless if stolen, lifecycle updates arrive automatically when a card is reissued, and tokenised transactions approve at higher rates.

What changes for engineers

  • Merchants and PSPs become token requestors; cryptograms (TAVV, DSRP) travel with the token.
  • PAN-based reconciliation gives way to the Payment Account Reference (PAR).
  • Vaults shrink in PCI scope; issuer token services decide provisioning and lifecycle.

Milestones

  1. 2014-03EMV Payment Tokenisation specification v1.0
  2. 2014-10Apple Pay launches on network tokens
  3. 2022-10India (RBI) mandates card-on-file tokenisation
  4. 2024Mastercard sets 2030 for ending manual card entry in Europe
  5. 2026-07EMV Payment Tokenisation v2.4 published
  6. 2030Mastercard target: tokens, Click to Pay and passkeys replace manual entry in Europe
Tokenization guideMerchant tokens vs network tokensToken format checker

Authentication & Identity

In progressVersion upgrade2016–2027

3-D Secure 1.0EMV 3-D Secure 2.x (2.2 → 2.3.1 → 2.4)

Indicative progress of the installed base: 85%

3DS 1.0 is gone; the industry is on 2.2 and moving to 2.3.1 for Secure Payment Confirmation, richer out-of-band and decoupled challenges.

Why it is happening

The 1.0 redirect broke mobile checkouts and PSD2 required risk-based, data-rich authentication with exemptions. Each 2.x release adds a channel or a challenge type.

What changes for engineers

  • AReq/ARes data elements grow per version; device channels (browser, app, 3RI) each have their own fields.
  • Challenge flows diversify: OTP, app push, passkeys via SPC, decoupled approval.
  • SDK and server versions are certified separately; the PCI 3DS SDK standard is being sunset.

Milestones

  1. 2016-10EMV 3DS 2.0 specification published
  2. 2019-09PSD2 SCA regulatory technical standards apply
  3. 2022-10Visa and Mastercard retire 3DS 1.0
  4. 20242.1 retired by the schemes; 2.2 becomes the baseline
  5. 2026-10PCI 3DS SDK standard sunset
  6. 20272.3.1 widely deployed; 2.4 in draft
3-D Secure guide3DS message decoderCAVV calculator
In progressReplacement2019–2030

Passwords and SMS one-time codesApp-based SCA, FIDO passkeys and identity wallets

Indicative progress of the installed base: 45%

Knowledge factors and SMS codes are giving way to device-bound cryptographic authentication: banking-app approval today, payment passkeys and the EUDI Wallet next.

Why it is happening

SMS is phishable and SIM-swappable, passwords are reused, and regulators now require possession-plus-inherence with dynamic linking. Passkeys make the possession factor a signature.

What changes for engineers

  • Issuer ACS and bank apps add WebAuthn verification; Secure Payment Confirmation ties the signature to amount and payee.
  • Dynamic linking data moves into what the user signs, not just what they see.
  • From end-2027 EU PSPs must accept the EUDI Wallet as an SCA method.

Milestones

  1. 2019-09PSD2 strong customer authentication applies
  2. 2022-05Apple, Google and Microsoft commit to FIDO passkeys
  3. 2024Visa and Mastercard launch payment passkey services
  4. 2025EMV 3DS 2.3.1 Secure Payment Confirmation challenges in production
  5. 2027-12EUDI Wallet acceptance mandatory for SCA at EU PSPs
  6. 2030Mastercard target: passkeys and tokens replace manual entry and passwords in Europe
SCA and 3DSEUDI Wallet & paymentsOID4VP request decoder
AnnouncedVersion upgrade2024–2028

eIDAS 1.0 national eIDs and certificateseIDAS 2.0 EU Digital Identity Wallet

Indicative progress of the installed base: 10%

Every member state must offer a certified wallet by end-2026 and regulated firms must accept it by end-2027. Verifiable credentials replace document uploads and bank-specific authenticators.

Why it is happening

eIDAS 1.0 produced fragmented national schemes with low uptake. A wallet with selective disclosure, hardware-bound keys and legal effect across the EU is the fix.

What changes for engineers

  • Verifier integrations for OID4VP, SD-JWT VC and mdoc; issuers of bank attestations use OID4VCI.
  • KYC and SCA share one credential stack; dynamic linking rides in the Key Binding JWT.
  • QWAC and QSealC remain for machine-to-machine identity under PSD2.

Milestones

  1. 2024-05eIDAS 2.0 (Regulation 2024/1183) in force
  2. 2024-12Implementing acts on wallet protocols and certification adopted
  3. 2026-12Member states must offer at least one certified wallet
  4. 2027-12Banks and PSPs must accept the wallet for SCA and KYC
EUDI Wallet guideSD-JWT VC decoderOID4VP request decoder

API Security & Open Banking

In progressReplacement2016–2028

Screen scraping with shared credentialsRegulated open-banking APIs with consent

Indicative progress of the installed base: 80%

PSD2 and the UK CMA order made bank APIs mandatory in Europe; the US is following through FDX and the Section 1033 rule. Credential sharing survives only where APIs do not.

Why it is happening

Giving a third party your banking password cannot be audited, scoped or revoked. Consent-bound tokens over certified APIs can.

What changes for engineers

  • TPP identity moves to eIDAS certificates and OAuth clients; consent becomes a first-class resource.
  • Availability and performance SLAs apply to dedicated interfaces; PSD3/PSR tighten them further.
  • Data quality and coverage become API-contract questions rather than parsing problems.

Milestones

  1. 2018-01PSD2 applies; UK Open Banking APIs go live for the CMA9
  2. 2019-09PSD2 RTS on SCA and secure communication apply
  3. 2024-10US CFPB finalises the Section 1033 personal financial data rule
  4. 2025-01CFPB recognises FDX as a standard-setting body
  5. 2028PSR obligations apply in the EU
Open Banking & PSD2 guideRegional API standards
In progressVersion upgrade2021–2029

FAPI 1.0 Advanced with bearer-style risksFAPI 2.0 Security Profile (PAR, PKCE, sender-constrained tokens)

Indicative progress of the installed base: 25%

The OpenID Foundation's financial-grade profile was redesigned around a formal attacker model. New ecosystems start on 2.0; the large 1.0 ecosystems are planning dual-running migrations.

Why it is happening

FAPI 1.0 layered defences against known attacks and was hard to implement correctly. FAPI 2.0 keeps only what the security proof needs: PAR, PKCE, the iss parameter, and tokens bound by mTLS or DPoP.

What changes for engineers

  • Authorization servers drop hybrid flow, JAR-at-the-front-channel and s_hash; clients adopt PAR and iss checks.
  • DPoP becomes an alternative to mTLS for token binding; refresh-token rotation is switched off.
  • Non-repudiation moves to the separate Message Signing profile; certification is re-run on 2.0.

Milestones

  1. 2021-03FAPI 1.0 Baseline and Advanced final
  2. 2025-02FAPI 2.0 Security Profile and Attacker Model final
  3. 2025-07Final FAPI 2.0 conformance tests and certification
  4. 2025-09FAPI 2.0 Message Signing final
  5. 2026-01ISO/IEC DIS 26083 ballot on FAPI 2.0 closes
  6. 2027Brazil and Australia dual-running periods; UK and Saudi on 1.0 Advanced
FAPI guideFAPI 1.0 vs 2.0Migration checklist
HorizonReplacement2024–2032

Proprietary HMAC webhook and API signaturesHTTP Message Signatures (RFC 9421) and Web Bot Auth

Indicative progress of the installed base: 5%

Every PSP invented its own webhook signature. RFC 9421 standardises signing of HTTP messages, and agent-identity schemes (Web Bot Auth, Visa TAP) and FAPI HTTP Signing are building on it.

Why it is happening

Per-vendor HMAC schemes differ in what they cover and how they handle replay. A standard signature base with covered components, key identifiers and content digests is verifiable by anyone.

What changes for engineers

  • Signature-Input and Signature headers replace X-Vendor-Signature conventions over time.
  • Content-Digest covers bodies; created and expires cover freshness; key discovery via JWKS or directories.
  • Verification libraries converge; HMAC and asymmetric keys both fit the same structure.

Milestones

  1. 2024-02RFC 9421 HTTP Message Signatures published
  2. 2025Web Bot Auth drafts and Visa Trusted Agent Protocol adopt RFC 9421
  3. 2026FAPI 2.0 HTTP Signing draft for resource requests and responses
HTTP signature decoderWebhook signature verifierFAPI message signing
HorizonCoexistence2025–2032

Human-driven checkoutAgent-initiated payments with mandates (AP2, ACP, x402, TAP)

Indicative progress of the installed base: 5%

AI agents buying on a person's behalf need provable authority and identity. A protocol stack is forming: agent identity, signed mandates, checkout handshakes and machine settlement.

Why it is happening

Bot traffic was blocked by design; a delegated agent must instead prove who it is, what it was authorised to buy and at what price, in a form a merchant and an issuer can verify.

What changes for engineers

  • Merchants verify agent signatures on HTTP requests and mandates as verifiable credentials.
  • Issuers and networks define agentic transaction indicators and liability rules.
  • Settlement can stay on cards or move to stablecoin rails such as x402.

Milestones

  1. 2025-05x402 HTTP 402 payment protocol launched
  2. 2025-09Google AP2 and OpenAI/Stripe ACP announced
  3. 2025-10Visa Trusted Agent Protocol; Mastercard Agent Pay
  4. 2026-04AP2 v0.2 donated to the FIDO Alliance
Agentic payments guideAP2 mandate decoderx402 guide

Cryptography & Keys

CompletedReplacement2014–2025

Variant and proprietary key wrappingKey blocks (TR-31 → ANSI X9.143)

Indicative progress of the installed base: 95%

Keys exchanged between HSMs, processors and terminals now carry their usage and mode of use inside an authenticated block. PCI PIN phased it in over three deadlines, the last in January 2025.

Why it is happening

Variant-wrapped keys could be swapped between purposes; a PIN key used as a data key leaks PINs. Key blocks bind usage, algorithm and exportability to the key with a MAC.

What changes for engineers

  • Every key-exchange interface speaks TR-31 / X9.143 blocks; legacy variant imports are disabled.
  • HSM commands and key-management tooling expose usage and mode-of-use fields.
  • TR-34 and remote key loading wrap key blocks rather than raw keys.

Milestones

  1. 2019-06PCI PIN phase 1: key blocks inside internal HSM connections
  2. 2022ANSI X9.143 supersedes TR-31
  3. 2023-01PCI PIN phase 2: key blocks between processing entities
  4. 2025-01PCI PIN phase 3: key blocks to POI devices
TR-31 & TR-34 guideTR-31 key block builderKey block decoder
In progressReplacement2017–2030

3DES PIN encryption, DUKPT and master keysAES (AES DUKPT, ISO 9564 format 4 PIN blocks, AES key blocks)

Indicative progress of the installed base: 35%

NIST disallowed Triple DES for new protection after 2023; the payment stack is replacing it layer by layer, from PIN blocks and DUKPT derivation to issuer master keys.

Why it is happening

A 64-bit block and effective 112-bit strength are below modern baselines, and 3DES sits on the same retirement path as RSA in the post-quantum plans.

What changes for engineers

  • AES DUKPT (X9.24-3) replaces TDES DUKPT on new terminal deployments; both run in parallel for years.
  • ISO 9564-1 format 4 is the PIN block for AES; formats 0 and 3 stay with TDES.
  • Key hierarchies, key-check values and HSM commands need AES equivalents; KCVs become CMAC-based.

Milestones

  1. 2017ANSI X9.24-3 AES DUKPT and ISO 9564-1 format 4 published
  2. 2019NIST SP 800-131A Rev. 2 deprecates 3DES for encryption
  3. 2024-01NIST disallows 3DES for applying protection
  4. 2025PCI PIN and scheme rules push AES for new PIN entry deployments
  5. 2030Legacy 3DES estates targeted for retirement alongside key-length upgrades
DUKPT calculatorPIN block encoderAES calculatorDES / 3DES calculator
AnnouncedReplacement2024–2035

RSA and elliptic-curve public-key cryptographyPost-quantum algorithms (ML-KEM, ML-DSA, SLH-DSA) and hybrids

Indicative progress of the installed base: 3%

NIST has published the replacement algorithms and a retirement schedule for RSA and ECC. Payments has the longest-lived keys in the economy, so planning is under way even though deployments are early.

Why it is happening

A large quantum computer breaks RSA and ECC outright, and harvest-now-decrypt-later means long-lived key material is already at risk. TLS, TR-34, EMV offline authentication and code signing all depend on them.

What changes for engineers

  • Inventory every RSA and ECC use: EMV CA keys, TR-34, TLS, token signing, HSM firmware signing.
  • Hybrid TLS first (classical plus ML-KEM), then signatures; sizes grow by an order of magnitude.
  • HSM firmware with validated PQC and crypto-agile key management become procurement requirements.

Milestones

  1. 2024-08NIST FIPS 203, 204 and 205 published
  2. 2024-11NIST IR 8547 draft: deprecate RSA and ECC by 2030, disallow by 2035
  3. 2025-06EU coordinated PQC roadmap: transition under way by end-2026, high-risk systems by 2030
  4. 2026First HSM firmware with validated ML-KEM / ML-DSA
  5. 2030Deprecation of 112-bit classical public-key security
  6. 2035RSA and ECC disallowed under the NIST schedule
Post-quantum payments guideTR-34 key distribution
CompletedVersion upgrade2015–2021

SSL and early TLS (1.0 / 1.1)TLS 1.2 with modern cipher suites, and TLS 1.3

Indicative progress of the installed base: 98%

The transport layer migration is done for compliant estates: PCI DSS retired early TLS in 2018 and the IETF formally deprecated 1.0 and 1.1 in 2021. FAPI and PCI now reference BCP 195.

Why it is happening

POODLE, BEAST and weak cipher suites made SSL 3.0 and TLS 1.0 unsafe; TLS 1.3 removes the negotiable weaknesses entirely.

What changes for engineers

  • Server-to-server endpoints run only recommended cipher suites; browser-facing ones add HSTS preloading.
  • Legacy terminals and host links that cannot negotiate 1.2 are the remaining exceptions.
  • Certificate checks per RFC 9525 and mTLS for client authentication build on the same stack.

Milestones

  1. 2015-04PCI DSS v3.1 declares SSL and early TLS not strong cryptography
  2. 2018-06PCI DSS deadline to disable SSL and early TLS
  3. 2018-08TLS 1.3 published as RFC 8446
  4. 2021-03RFC 8996 deprecates TLS 1.0 and 1.1
FAPI transport requirementsPCI DSS reference

Messaging & Rails

In progressReplacement2018–2027

SWIFT MT and proprietary high-value formatsISO 20022 MX messages (CBPR+, HVPS+)

Indicative progress of the installed base: 80%

The big-value rails have cut over; the cross-border coexistence period has ended for payment instructions, and the remaining work is structured data, especially addresses.

Why it is happening

MT free-text fields cannot carry structured parties, purposes or remittance data. ISO 20022 makes screening, reconciliation and automation possible across rails.

What changes for engineers

  • pacs.008 / pacs.009 replace MT103 / MT202; camt.053 and camt.110/111 replace statements and investigations.
  • Structured or hybrid postal addresses become mandatory; truncation rules change.
  • Legacy back-office systems need translation layers until native MX is end to end.

Milestones

  1. 2023-03TARGET2 big-bang and start of CBPR+ coexistence
  2. 2024-04CHIPS moves to ISO 20022
  3. 2025-07Fedwire Funds Service migrates to ISO 20022
  4. 2025-11End of MT/MX coexistence for cross-border payment instructions
  5. 2027-11Fedwire structured address enforcement (moved from November 2026)
ISO 20022 guideISO 20022 validatorMessage referenceSWIFT MT validator
HorizonCoexistence2014–2035

ISO 8583 card messagesISO 20022 for cards (nexo, ATICA)

Indicative progress of the installed base: 5%

Card authorisation still runs on scheme dialects of ISO 8583. ISO 20022 card messages exist for terminal-to-acquirer (nexo) and acquirer-to-issuer (ATICA) use, but no scheme has set a sunset for 8583.

Why it is happening

Bitmap messages are compact and battle-tested; the benefit of XML or JSON card messages is richer data and alignment with the rest of the payment stack, not speed.

What changes for engineers

  • Expect 8583 parsers and bitmap tooling to stay in service for the foreseeable future.
  • Terminal integrations in Europe increasingly use nexo retailer and acquirer protocols.
  • Settlement and reporting feeds adopt ISO 20022 structures before authorisation does.

Milestones

  1. 2003ISO 8583:2003 published; schemes stay on 1987 and 1993 dialects
  2. 2014nexo standards association formed for ISO 20022 card acceptance
  3. 2016ATICA acquirer-to-issuer ISO 20022 messages published
  4. 2035No scheme sunset for ISO 8583 announced
ISO 8583 guideISO 8583 parserISO 20022 message reference
In progressReplacement2016–2027

Batch credit transfers and ACHInstant payments, 24/7 with payee verification

Indicative progress of the installed base: 55%

Real-time rails are now mandatory in the euro area, live in the US and dominant in Brazil and India. Batch does not disappear, but it stops being the default for retail transfers.

Why it is happening

Consumers and merchants expect immediate finality; regulators want competition with cards and fewer failed payments, hence the Instant Payments Regulation with Verification of Payee.

What changes for engineers

  • Always-on processing, sub-10-second SLAs and irrevocable settlement change liquidity and fraud controls.
  • Verification of Payee calls precede every SEPA credit transfer.
  • Reconciliation moves from daily files to event streams.

Milestones

  1. 2016-04India UPI launches
  2. 2017-11SEPA Instant Credit Transfer scheme live
  3. 2020-11Brazil Pix launches
  4. 2023-07US FedNow launches
  5. 2025-01IPR: euro-area PSPs must receive instant payments
  6. 2025-10IPR: euro-area PSPs must send instant payments and offer Verification of Payee
  7. 2027IPR obligations extend to non-euro member states
Verification of Payee simulatorIBAN validatorISO 20022 guide
In progressCoexistence2018–2030

Card rails at checkoutAccount-to-account pay-by-bank

Indicative progress of the installed base: 20%

Open-banking payment initiation, Pix, UPI and Wero let merchants pull funds straight from bank accounts. Cards keep the lead in most markets, but A2A is the fastest-growing method.

Why it is happening

No interchange, instant settlement and no chargebacks appeal to merchants; regulators want an alternative to the card duopoly. The missing pieces, recurring payments and disputes, are being added.

What changes for engineers

  • Checkout integrates PIS redirect or decoupled flows next to card forms.
  • Refunds and disputes follow credit-transfer recall rules, not chargebacks.
  • Variable Recurring Payments and Request to Pay bring subscriptions and invoices onto the rail.

Milestones

  1. 2018-01UK Open Banking payment initiation live
  2. 2020-11Pix becomes Brazil's dominant retail method within two years
  3. 2024Wero (European Payments Initiative) launches
  4. 2025UK commercial Variable Recurring Payments pilots
  5. 2028PSR strengthens open-banking payment rights in the EU
Open banking consent and payment flowsPayment flow diagrams

Digital Money

AnnouncedCoexistence2021–2030

Fiat correspondent settlement for card schemesStablecoin settlement on public blockchains

Indicative progress of the installed base: 5%

Visa and Mastercard settle with selected issuers and acquirers in USDC and other regulated coins, seven days a week. It is an option beside fiat settlement, not a replacement, and US law now defines who may issue.

Why it is happening

Weekend and holiday gaps, cut-off times and cross-border friction disappear when the settlement asset moves on a 24/7 ledger.

What changes for engineers

  • Treasury handles on-chain wallets, token decimals and finality instead of nostro accounts and cut-offs.
  • ISO 8583 settlement fields map to transfers; reversals and chargebacks have no on-chain equivalent.
  • Issuer selection narrows to coins compliant with MiCA and the GENIUS Act.

Milestones

  1. 2021-03Visa settles its first transaction in USDC
  2. 2023-09Visa USDC settlement on Solana with acquirers
  3. 2025-07US GENIUS Act signed
  4. 2027-01GENIUS Act cutoff for non-permitted issuers
Stablecoin payments guideSettlement simulatorISO 8583 to on-chain mapper
In progressReplacement2023–2027

Unregulated stablecoinsLicensed e-money and payment stablecoins (MiCA, GENIUS Act)

Indicative progress of the installed base: 60%

Issuance is becoming a licensed activity with reserve, redemption and disclosure rules. Coins that do not comply are delisted in regulated markets.

Why it is happening

Reserve failures and runs showed that a payment instrument needs the same guarantees as e-money: full backing, redemption at par and supervision.

What changes for engineers

  • Acceptance and settlement choices restricted to compliant coins per jurisdiction.
  • Issuer attestations, reserve reports and freeze functions become integration inputs.
  • Exchange listings and card-network settlement follow the regulated list.

Milestones

  1. 2024-06MiCA rules for e-money and asset-referenced tokens apply
  2. 2025-07GENIUS Act signed into US law
  3. 2027-01GENIUS Act issuer cutoff
Stablecoin referenceStablecoin payments 101
HorizonCoexistence2023–2032

Correspondent banking and batch interbank settlementTokenised deposits on shared ledgers

Indicative progress of the installed base: 3%

Banks are tokenising deposits so interbank and cross-border payments can settle atomically on shared ledgers, with Swift, Partior, Kinexys and central-bank projects running pilots.

Why it is happening

Correspondent chains add days, fees and reconciliation; a shared ledger with ISO 20022 data and tokenised money settles in one step with programmable conditions.

What changes for engineers

  • Payment commitments become smart-contract state; ISO 20022 payloads travel with the token.
  • Nostro liquidity management changes shape; finality is a block, not an end-of-day position.
  • Interoperability between bank ledgers and CBDC settlement assets is the open design question.

Milestones

  1. 2024-04BIS Project Agorá launched with seven central banks
  2. 2025-09Swift announces a blockchain-based shared ledger
  3. 2026-07Swift shared ledger pilot live with 17 banks
Tokenised deposits guideSWIFT shared ledger
HorizonCoexistence2020–2030

Cash and commercial bank money onlyRetail central bank digital currency

Indicative progress of the installed base: 5%

China runs the largest pilot; the ECB has finished the digital euro preparation phase and is building, pending EU legislation. Nowhere has a retail CBDC replaced existing money.

Why it is happening

Central banks want a public digital means of payment as cash use falls and private stablecoins grow, with offline capability and pan-European acceptance.

What changes for engineers

  • Acceptance obligations for merchants and distribution duties for banks under the EU proposal.
  • Offline payments, holding limits and privacy rules shape the wallet and POS integrations.
  • A new settlement asset for tokenised-deposit and wholesale ledgers.

Milestones

  1. 2020e-CNY pilots begin in Chinese cities
  2. 2023-11Digital euro preparation phase starts
  3. 2025-10ECB concludes the preparation phase and moves to the next phase
  4. 2029Earliest digital euro issuance per the ECB, subject to legislation
CBDC flow simulatorTokenised deposits guide

Compliance & Standards

CompletedVersion upgrade2022–2025

PCI DSS v3.2.1PCI DSS v4.0.1

Indicative progress of the installed base: 100%

The 3.2.1 standard retired in March 2024 and the future-dated v4 requirements became mandatory in March 2025, including payment-page script inventories and change detection.

Why it is happening

Threats moved to e-commerce skimming, credential stuffing and cloud estates; v4 adds targeted-risk analysis, customised validation and controls for client-side payment pages.

What changes for engineers

  • Script inventory and integrity monitoring on checkout pages (6.4.3, 11.6.1).
  • MFA for all access to the cardholder data environment; stronger password rules.
  • Customised approach allows alternative controls with documented risk analysis.

Milestones

  1. 2022-03PCI DSS v4.0 published
  2. 2024-03PCI DSS v3.2.1 retired
  3. 2024-06PCI DSS v4.0.1 published
  4. 2025-03Future-dated v4 requirements become mandatory
PCI DSS referenceCustom tokens and PCI scope
CompletedReplacement2019–2022

PA-DSS payment application validationPCI Software Security Framework (Secure Software and Secure SLC)

Indicative progress of the installed base: 100%

PA-DSS was retired in October 2022. Software vendors now validate under the Secure Software Standard and, optionally, the Secure Software Lifecycle standard.

Why it is happening

PA-DSS assumed packaged software on merchant premises; the SSF covers cloud, continuous delivery and modular architectures with objective-based requirements.

What changes for engineers

  • Vendors move from per-release validation to lifecycle-based assessments.
  • Module-specific requirements (for example, terminal software and web software) replace one checklist.
  • Acquirers and schemes reference SSF listings instead of PA-DSS listings.

Milestones

  1. 2019-01PCI Software Security Framework published
  2. 2021-06New PA-DSS submissions closed
  3. 2022-10PA-DSS retired
PCI PTS and SSF referencePOS and SoftPOS compliance
In progressCoexistence2018–2030

Dedicated PCI PTS PIN padsSoftPOS on commercial devices (SPoC and CPoC → MPoC)

Indicative progress of the installed base: 20%

Tap to Phone turned ordinary smartphones into terminals. PCI consolidated its two early standards into MPoC, and Apple and Google opened their NFC stacks to it.

Why it is happening

Hardware terminals are expensive for micro-merchants and slow to update; attestation, monitoring and software protection let a phone reach an acceptable risk level.

What changes for engineers

  • Security moves from tamper-evident hardware to attestation and monitoring back ends.
  • Kernel certification and brand device-eligibility rules apply to apps, not devices.
  • PIN on glass and contactless limits follow the MPoC validation scope.

Milestones

  1. 2018-01PCI SPoC standard published
  2. 2019-12PCI CPoC standard published
  3. 2022-02Apple Tap to Pay on iPhone launches
  4. 2022-11PCI MPoC v1.0 published, consolidating SPoC and CPoC
  5. 2024MPoC v1.1; SoftPOS acceptance of PIN at contactless limits widens
POS and SoftPOS compliance guideKernel 8 and the kernel family
AnnouncedVersion upgrade2023–2028

PSD2 and the E-Money DirectivePSD3 and the Payment Services Regulation

Indicative progress of the installed base: 10%

The EU replaces its payments rulebook with a directive for licensing and a directly applicable regulation for conduct, open banking and SCA. Final texts were settled in April 2026; application follows roughly eighteen to twenty-one months after publication.

Why it is happening

PSD2 transposition varied by country and left gaps in fraud liability, open-banking performance and e-money licensing. A regulation removes national variation.

What changes for engineers

  • Dedicated open-banking interfaces with performance obligations and user permission dashboards.
  • IBAN-name verification for all credit transfers; fraud-data sharing between PSPs.
  • One licence for payment and e-money institutions; SCA rules clarified for MIT and accessibility.

Milestones

  1. 2023-06European Commission proposes PSD3 and the PSR
  2. 2025-11Political agreement reached
  3. 2026-04Final compromise texts settled
  4. 2028Core PSR obligations apply
What PSD3 and the PSR changeVerification of Payee simulator
Table view of all 27 migrations
DomainFromToKindStatusYearsProgress
Cards & EMVMagnetic stripeEMV chip and contactlessReplacement In progress2014–203390%
Cards & EMVRSA offline data authentication and 3DES cryptogramsElliptic-curve ODA and AES session keys (EMV 4.4, Kernel 8)Version upgrade Announced2022–20355%
Cards & EMV6-digit BIN8-digit BIN (ISO/IEC 7812-1:2017)Version upgrade Completed2017–202675%
Cards & EMVPAN stored on fileNetwork tokens (EMV Payment Tokenisation)Replacement In progress2014–203060%
Authentication & Identity3-D Secure 1.0EMV 3-D Secure 2.x (2.2 → 2.3.1 → 2.4)Version upgrade In progress2016–202785%
Authentication & IdentityPasswords and SMS one-time codesApp-based SCA, FIDO passkeys and identity walletsReplacement In progress2019–203045%
Authentication & IdentityeIDAS 1.0 national eIDs and certificateseIDAS 2.0 EU Digital Identity WalletVersion upgrade Announced2024–202810%
API Security & Open BankingScreen scraping with shared credentialsRegulated open-banking APIs with consentReplacement In progress2016–202880%
API Security & Open BankingFAPI 1.0 Advanced with bearer-style risksFAPI 2.0 Security Profile (PAR, PKCE, sender-constrained tokens)Version upgrade In progress2021–202925%
API Security & Open BankingProprietary HMAC webhook and API signaturesHTTP Message Signatures (RFC 9421) and Web Bot AuthReplacement Horizon2024–20325%
API Security & Open BankingHuman-driven checkoutAgent-initiated payments with mandates (AP2, ACP, x402, TAP)Coexistence Horizon2025–20325%
Cryptography & KeysVariant and proprietary key wrappingKey blocks (TR-31 → ANSI X9.143)Replacement Completed2014–202595%
Cryptography & Keys3DES PIN encryption, DUKPT and master keysAES (AES DUKPT, ISO 9564 format 4 PIN blocks, AES key blocks)Replacement In progress2017–203035%
Cryptography & KeysRSA and elliptic-curve public-key cryptographyPost-quantum algorithms (ML-KEM, ML-DSA, SLH-DSA) and hybridsReplacement Announced2024–20353%
Cryptography & KeysSSL and early TLS (1.0 / 1.1)TLS 1.2 with modern cipher suites, and TLS 1.3Version upgrade Completed2015–202198%
Messaging & RailsSWIFT MT and proprietary high-value formatsISO 20022 MX messages (CBPR+, HVPS+)Replacement In progress2018–202780%
Messaging & RailsISO 8583 card messagesISO 20022 for cards (nexo, ATICA)Coexistence Horizon2014–20355%
Messaging & RailsBatch credit transfers and ACHInstant payments, 24/7 with payee verificationReplacement In progress2016–202755%
Messaging & RailsCard rails at checkoutAccount-to-account pay-by-bankCoexistence In progress2018–203020%
Digital MoneyFiat correspondent settlement for card schemesStablecoin settlement on public blockchainsCoexistence Announced2021–20305%
Digital MoneyUnregulated stablecoinsLicensed e-money and payment stablecoins (MiCA, GENIUS Act)Replacement In progress2023–202760%
Digital MoneyCorrespondent banking and batch interbank settlementTokenised deposits on shared ledgersCoexistence Horizon2023–20323%
Digital MoneyCash and commercial bank money onlyRetail central bank digital currencyCoexistence Horizon2020–20305%
Compliance & StandardsPCI DSS v3.2.1PCI DSS v4.0.1Version upgrade Completed2022–2025100%
Compliance & StandardsPA-DSS payment application validationPCI Software Security Framework (Secure Software and Secure SLC)Replacement Completed2019–2022100%
Compliance & StandardsDedicated PCI PTS PIN padsSoftPOS on commercial devices (SPoC and CPoC → MPoC)Coexistence In progress2018–203020%
Compliance & StandardsPSD2 and the E-Money DirectivePSD3 and the Payment Services RegulationVersion upgrade Announced2023–202810%

Status and progress are editorial estimates as of October 2026, checked against the standards bodies' and schemes' own dates where published. For the primary sources behind a migration follow its linked guide. Something moved? The news radar tracks the announcements week by week.

Common questions

Which payment technology migrations are mandatory right now?

As of 2026 the ones with regulatory or scheme deadlines in force are ISO 20022 for high-value and cross-border payments, instant payments with Verification of Payee under the EU Instant Payments Regulation, PCI DSS v4.0.1 including its March 2025 requirements, key blocks for all PIN-key exchange under PCI PIN, and 3-D Secure 2.2 or later. Magnetic-stripe removal, 3DES retirement, FAPI 2.0 and the EUDI Wallet have dates but longer runways.

What is the difference between a replacement and a coexistence migration?

A replacement retires the old technology, as EMV chip retires the magnetic stripe or key blocks retire variant key wrapping. A coexistence migration adds a new rail or model that takes share without a sunset for the old one, as account-to-account payments do next to cards or stablecoin settlement does next to fiat settlement.

How are progress and status estimated?

Status follows published mandates and sunsets: completed when the old technology is retired or the new one is mandatory wherever it matters, in progress when mandates are in force and both generations run side by side, announced when dates are set but deployments are few, and horizon when only standards or pilots exist. Progress is an indicative estimate of how much of the installed base has moved.