Reference
Payment Certification Levels
A practical guide to EMVCo L1 / L2 / L3 terminal certifications, PCI DSS merchant compliance tiers, and the standards that govern every card-present transaction.
APDU Protocol & Interaction Specification
Application Protocol Data Units (APDUs) are the message format used between a terminal (or reader) and an ICC (or SE). Defined in ISO 7816-4, they underpin every EMV command from SELECT through GENERATE AC. This reference covers structure, protocol layer differences (T=0 / T=1), every EMV command, the full contact transaction APDU sequence, and all ISO 7816 status words.
APDU Message Structure
Command APDU (C-APDU) — Terminal → Card
1 B
CLA
Class byte
1 B
INS
Instruction
1 B
P1
Parameter 1
1 B
P2
Parameter 2
1 B
Lc
Data length
0–255 B
Command Data
Request payload
1 B
Le
Expected resp. length (00 = any)
CLA · INS · P1 · P2 always present (4 mandatory bytes). Lc / Data / Le conditional by case.
Response APDU (R-APDU) — Card → Terminal
0–256 B
Response Data
Optional payload (TLV encoded)
1 B
SW1
Status byte 1
1 B
SW2
Status byte 2
Minimum response is 2 bytes (SW1 SW2). Success = 90 00.
APDU Command Cases
Case 1
CLA · INS · P1 · P2
No data in, no data out
Response: SW1 SW2 only
e.g. internal card reset
Case 2
CLA · INS · P1 · P2 · Le
No data in, data expected from card
Response: Data + SW1 SW2
e.g. READ RECORD, GET DATA
Case 3
CLA · INS · P1 · P2 · Lc · Data
Data sent to card, no data expected back
Response: SW1 SW2 only
e.g. VERIFY (PIN), EXTERNAL AUTH
Case 4
CLA · INS · P1 · P2 · Lc · Data · Le
Data in AND data expected back
Response: Data + SW1 SW2
e.g. SELECT, GPO, GENERATE AC — most EMV commands
CLA Byte Breakdown (ISO 7816-4)
b8 b7Channel class
00 = ISO/IEC · 01 = Future · 10 = Future · 11 = Proprietary
00 = ISO/IEC · 01 = Future · 10 = Future · 11 = Proprietary
b6Secure msg
0 = No SM · 1 = SM
0 = No SM · 1 = SM
b5Chaining
0 = Last/only · 1 = More C-APDUs
0 = Last/only · 1 = More C-APDUs
b4 b3 b2 b1Channel number
0000–0011
0000–0011
00 Standard EMV — no secure messaging (most EMV commands)
80 Proprietary — card-specific commands (GPO, GENERATE AC, PIN CHANGE)
04 ISO 7816-4 with Secure Messaging (header not authenticated)
0C ISO 7816-4 with Secure Messaging (header authenticated)
84 Proprietary + Secure Messaging (issuer scripts: PUT DATA, PIN CHANGE, APP BLOCK)
Protocol Layers — T=0 vs T=1
T=0Half-Duplex Character Protocol
- Level: Character-oriented (byte-at-a-time). Each byte is individually acknowledged.
- APDU Case 4: Not natively supported. Card sends SW1=61 xx after command data, terminal must issue GET RESPONSE (INS C0) to retrieve response data.
- Error detection: Single-byte parity. Repeat transmission on error.
- Guard time: Extra inter-byte gap defined by TC1 in ATR.
- ATR TA1: Encodes clock rate conversion (Fi/Di) factor.
- Usage: Most EMV contact cards. Mandated by Visa, Mastercard chip specs.
- Max speed: Typically 9.6–115 Kbps depending on Fi/Di factors.
T=1Half-Duplex Block Protocol
- Level: Block-oriented. Each block = Prologue (NAD PCB LEN) + Information field + Epilogue (LRC or CRC).
- APDU Case 4: Native support — full APDU in a single round-trip.
- Error detection: LRC (XOR of bytes) or CRC-16 per block.
- Chaining: Large APDUs split across multiple I-blocks using PCB chain bit.
- Supervision blocks: R-block (ready/error), S-block (resync, abort, WTX request).
- Usage: SIM cards, newer high-security chips, some EMV cards for contactless bridging.
- Max block size: Up to 254 bytes information field (IFSC negotiated via ATR TA3).
ATR — Answer to Reset
The card's first response after reset. Conveys protocol parameters, supported protocols, and historical bytes.
TS
3B / 3F
Initial character. 3B = direct convention (LSB first, positive logic). 3F = inverse convention.
T0
Format byte
High nibble: presence indicators for TA1, TB1, TC1, TD1. Low nibble: number of historical bytes (0–15).
TAi TBi TCi TDi
Interface bytes
TA1 = clock rate (Fi/Di). TB1 = programming voltage (deprecated). TC1 = extra guard time. TD1 = next protocol indicator (T=0 / T=1). TA2 = specific mode. TA3 = IFSC (T=1 block size).
Historical bytes
0–15 bytes
Proprietary card info — chip OS, app indicator, issuer country. EMV cards typically encode category indicator (tag 80, 00, or 10) and optional COMPACT-TLV objects.
TCK
XOR checksum
XOR of all bytes from T0 to last byte. Absent for T=0-only cards. Present when T=1 is offered.
EMV Command Reference
| Command | CLA | INS | P1 / P2 | Data / Le | Response data | Purpose |
|---|---|---|---|---|---|---|
| Application Selection | ||||||
| SELECT | 00 | A4 | 04 00 | Data = AID bytes (5–16 B); Le = 00 | FCI template (6F): label (50), PDOL (9F38), language (5F2D), AID (84) | Select payment application or PSE/PPSE by AID or name |
| GET RESPONSE | 00 | C0 | 00 00 | Le = SW2 from preceding 61 xx | Buffered response data from T=0 Case 4 command | T=0 only: retrieve data card held after responding with 61 xx |
| Transaction Initiation | ||||||
| GET PROCESSING OPTIONS | 80 | A8 | 00 00 | PDOL response data (terminal data matching PDOL template); Le = 00 | Tag 77 (or 80 simplified): AIP (82) + AFL (94) | Initiate transaction; card returns Application Interchange Profile and Application File Locator |
| READ RECORD | 00 | B2 | Rec# / (SFI<<3)|04 | No data; Le = 00 | Tag 70 with record contents (PAN, expiry, CVM List, CDOL, certs…) | Read a record from an EF referenced by AFL (SFI encoded in P2 bits 7–3) |
| GET DATA | 80 | CA | Tag high / Tag low | No data; Le = 00 | Requested tag value (e.g. ATC 9F36, PIN try counter 9F17, log entry 9F4D) | Retrieve a single data object not returned by READ RECORD (ATC, log format, counters) |
| Offline Data Authentication | ||||||
| INTERNAL AUTHENTICATE | 00 | 88 | 00 00 | Lc = len; Data = DDOL response (UN 9F37 + optional other data) | Tag 77: Signed Dynamic Auth Data (9F4B) — ICC private key signature | DDA: card signs UN with ICC private key; terminal verifies with ICC public key |
| PIN Verification | ||||||
| VERIFY | 00 | 20 | 00 / PIN format | Lc = 08; Data = PIN block (Fmt 0 plaintext, Fmt 01 encrypted with ICC PK) | No data; SW=9000 or 63Cx (x = remaining tries) or 6983 (blocked) | Offline PIN verification — plaintext or enciphered PIN block compared against stored reference |
| GET CHALLENGE | 00 | 84 | 00 00 | No data; Le = 08 | 8-byte Unpredictable Number — used as challenge for DDA, online PIN, and GENERATE AC | Obtain 8-byte card-generated random challenge (replaces terminal UN in some flows) |
| Cryptogram Generation | ||||||
| GENERATE AC | 80 | AE | P1: 80=ARQC 40=TC 00=AAC / 00 | CDOL1 (1st GAC) or CDOL2 (2nd GAC) response data; Le = 00 | Tag 77: CID (9F27), AC (9F26), ATC (9F36), IAD (9F10). CDA: also SDAD (9F4B). | Request ARQC (online), TC (offline approve), or AAC (decline). Second call for script confirmation. |
| Issuer Authentication | ||||||
| EXTERNAL AUTHENTICATE | 00 | 82 | 00 00 | Lc = 08; Data = ARPC (8 bytes from issuer) | No data; SW=9000 (ARPC valid) or 6988 (ARPC failed) | Card verifies ARPC using SK-AC; confirms issuer authenticated the transaction |
| Issuer Scripts (CLA=84, Secure Messaging) | ||||||
| PIN CHANGE / UNBLOCK | 84 | 24 | P1: 00=unblock 01=change 03=both | New PIN block (SK-SMC encrypted) + MAC (SK-SMI); Le absent | No data; SW=9000 | Change PIN reference, reset PIN try counter, or both — PIN encrypted with SK-SMC |
| APPLICATION BLOCK | 84 | 1E | 00 00 | MAC (SK-SMI, 8 bytes) | No data; SW=9000 | Block specific application on card; card refuses future transactions for this AID |
| APPLICATION UNBLOCK | 84 | 18 | 00 00 | MAC (SK-SMI, 8 bytes) | No data; SW=9000 | Re-enable a previously blocked application |
| CARD BLOCK | 84 | 16 | 00 00 | MAC (SK-SMI, 8 bytes) | No data; SW=9000 | Permanently block the entire card — cannot be reversed |
| PUT DATA | 84 | DA | Tag high / Tag low | New data value (MAC or SM-protected per tag); Le absent | No data; SW=9000 | Write a single data element — update limits, counters, or application data |
Contact EMV Transaction — Full APDU Sequence
Exact APDU exchange for a typical online-authorized contact transaction with issuer script processing. Arrow direction shows sender.
1
Application Selection — SELECT PSE
T→C00 A4 04 00 0E 31 50 41 59 2E 53 59 53 2E 44 44 46 30 31 00
C→T6F xx 84 0E 31 50 41 59 2E 53 59 53 2E 44 44 46 30 31 A5 xx 88 01 01 ... 90 00
Response contains FCI with SFI of EF.DIR (tag 88). If PSE not found → try direct AID selection.
2
Read EF.DIR — READ RECORD SFI 1 Record 1
T→C00 B2 01 0C 00
C→T70 xx 61 xx 4F 07 A0 00 00 00 03 10 10 50 04 56 49 53 41 87 01 01 ... 90 00
Tag 61 entries: AID (4F), label (50), priority (87). Terminal picks highest-priority matching AID.
3
SELECT AID — Final Application Selection
T→C00 A4 04 00 07 A0 00 00 00 03 10 10 00
C→T6F xx 84 07 A0 00 00 00 03 10 10 A5 xx 9F 38 [PDOL] 50 04 56 49 53 41 ... 90 00
PDOL (9F38) tells terminal which data elements to include in GET PROCESSING OPTIONS.
4
GET PROCESSING OPTIONS — initiate transaction
T→C80 A8 00 00 [Lc] 83 [len][PDOL data: amount, currency, date, type, UN…] 00
C→T77 xx 82 02 [AIP] 94 xx [AFL entries] ... 90 00
AIP (82) declares card capabilities. AFL (94) lists records to READ RECORD: SFI · first rec · last rec · offline-auth records.
5
READ RECORD — per AFL entry (repeated for each record)
T→C00 B2 [RecNum][(SFI<<3)|04] 00
C→T70 xx 5A [PAN] 5F 24 [Expiry] 57 [Track2] 8E [CVM List] 8F 4D [CDOL1] 90 [Issuer PK Cert] 9F 46 [ICC PK Cert] ... 90 00
Records covering the ODA range (first record through ODA count) are hashed during SDA / DDA processing.
6
INTERNAL AUTHENTICATE — DDA dynamic signature (if AIP bit set)
T→C00 88 00 00 04 [UN: 4 bytes] 00
C→T77 xx 9F 4B [Signed Dynamic Auth Data — ICC private key signature over UN + hash]90 00
Terminal verifies 9F4B signature using ICC public key recovered from ICC PK Certificate. Confirms card is genuine.
7
VERIFY — offline PIN (if CVM list requires offline PIN)
T→C00 20 00 80 08 [PIN block — format 0 plaintext or format 01 encrypted]
C→T90 00 — PIN correct · 63 C2 — wrong PIN, 2 tries left · 69 83 — PIN blocked
63 Cx: low nibble x = remaining tries. Card sets TVR bit "PIN try limit exceeded" when x=0.
8
GENERATE AC (1st) — terminal requests ARQC for online authorization
T→C80 AE 80 00 [Lc][CDOL1 data: amount, currency, TVR, AIP, ATC, UN…] 00
C→T77 xx 9F 27 01 80 9F 26 08 [ARQC 8 bytes] 9F 36 02 [ATC] 9F 10 [IAD] ... 90 00
9F27=80 means ARQC (online). Card may also return 40 (TC, offline approve) or 00 (AAC, decline) based on its risk management.
↑↓
Online Authorization — ISO 8583 0100/0110 via acquirer → issuer
NetworkDE55 carries ARQC (9F26) · ATC (9F36) · IAD (9F10) · TVR (95) · AIP (82) · AUC (9F07)
NetworkIssuer returns ARPC in DE55 (method 1: ARQC XOR RC · method 2: MAC over CDOL) + auth code / decline code + optional issuer scripts in DE55 tags 71/72
9
EXTERNAL AUTHENTICATE — card verifies issuer ARPC
T→C00 82 00 00 08 [ARPC — 8 bytes from issuer DE55]
C→T90 00 — issuer authenticated · 69 88 — ARPC MAC failed
Card sets "issuer authentication successful" flag in TSI (9B). Failure sets TVR bit and may cause card to decline second GENERATE AC.
10
Issuer Script Processing — tag 71 (before 2nd GAC) / tag 72 (after)
T→C84 [INS][P1 P2][Lc][data (SM-protected: MAC via SK-SMI, cipher via SK-SMC)]
C→T90 00 per command
Card verifies MAC before applying each script command. Sensitive data (new PIN block) decrypted with SK-SMC. Script failure recorded in TSI.
11
GENERATE AC (2nd) — final authorization decision confirmation
T→C80 AE 40 00 [Lc][CDOL2 data: response code, script results, updated TVR…] 00
C→T77 xx 9F 27 01 40 9F 26 08 [TC — transaction complete] ... 90 00
9F27=40 = TC (approved and complete). If card decides to decline after online auth: 9F27=00 (AAC). Terminal prints receipt and closes transaction.
ISO 7816 Status Words (SW1 SW2)
9x — Normal Processing
SW1 SW2
Meaning
Common context
90 00
Success — no further information
All commands on success
61 xx
Success — xx bytes of response available
T=0 Case 4: issue GET RESPONSE with Le=xx
6x — Warnings
SW1 SW2
Meaning
Common context
62 00
Warning — no information given
Non-volatile memory unchanged
62 81
Warning — part of returned data may be corrupted
Partial read possible
62 82
Warning — end of file/record before Le bytes
READ RECORD Le too large
62 83
Warning — selected file invalidated or blocked
Application blocked by issuer script
62 85
Warning — selected file in termination state
Card lifecycle ended
63 00
Warning — no information, state of NVM changed
General write warning
63 C0
PIN verification failed — 0 retries remaining (PIN blocked)
VERIFY — card will block on next wrong entry
63 C1
PIN verification failed — 1 retry remaining
VERIFY — warn cardholder
63 C2
PIN verification failed — 2 retries remaining
VERIFY — typical first wrong PIN
63 Cx
PIN verification failed — x retries remaining (general form)
VERIFY — low nibble = remaining count
6x — Errors
SW1 SW2
Meaning
Common context
64 00
Execution error — no precise diagnosis
NVM write failed without state change
65 00
Execution error — no precise diagnosis (NVM changed)
Memory error during write
65 81
Memory failure — NVM write failed
EEPROM wear-out or fault
67 00
Wrong length — Lc or Le incorrect
GENERATE AC / SELECT with wrong data length
68 81
Logical channel not supported
Multi-channel command on single-channel card
68 82
Secure messaging not supported
Script command with SM to card that does not support it
69 81
Command incompatible with file structure
READ RECORD on transparent EF
69 82
Security status not satisfied
Script command without prior EXTERNAL AUTH; PIN required first
69 83
Authentication method blocked
PIN blocked — VERIFY after 63 C0
69 84
Referenced data invalidated
Key or cert object marked invalid
69 85
Conditions of use not satisfied
GENERATE AC before GPO; EXTERNAL AUTH without GENERATE AC
69 86
Command not allowed — no current EF selected
READ RECORD without prior SELECT of SFI context
69 87
Expected secure messaging DOs missing
Script without required MAC tag
69 88
Incorrect secure messaging DOs — MAC verification failed
EXTERNAL AUTHENTICATE with wrong ARPC; PUT DATA with bad MAC
6A 80
Incorrect parameters in data field
GPO with PDOL data length mismatch
6A 81
Function not supported
INTERNAL AUTHENTICATE when card does not support DDA
6A 82
File not found
SELECT AID not on card; READ RECORD wrong SFI
6A 83
Record not found
READ RECORD record number beyond file end
6A 84
Not enough memory space in file
PUT DATA when EF is full
6A 86
Incorrect P1-P2 parameters
GENERATE AC with undefined P1 AC type
6A 88
Referenced data not found
GET DATA for tag not present in card
6B 00
Wrong parameters P1-P2
READ RECORD with invalid SFI or record number encoding
6C xx
Wrong Le — actual length is xx bytes
Card returns correct Le; retry with Le=xx
6D 00
Instruction code (INS) not supported or invalid
Sending INTERNAL AUTHENTICATE to card supporting only SDA
6E 00
Class (CLA) not supported
Proprietary command (84) to standard-only card
6F 00
No precise diagnosis — internal card error
Unexpected card condition; retry or replace card
The table above covers the status words you hit most often in EMV flows. For the full ISO 7816 / EMV list (200+ codes) with an instant SW1 SW2 decoder, see the APDU Response Codes tool.
APDU Command Builder
Select a command, fill in the parameters, and get the formatted hex string to use in your terminal or test harness.
00 A4Select application by AID
P1=04 selects by ADF name (AID). P2=00 first/only occurrence.
C-APDU 16 bytes
00 A4 04 00 07 A0000000031010 00
Related Tools
Use these tools to work with the cryptographic primitives that underpin terminal and card security.