Reference
Payment Certification Levels
A practical guide to EMVCo L1 / L2 / L3 terminal certifications, PCI DSS merchant compliance tiers, and the standards that govern every card-present transaction.
EMV Chip Structure & Scheme Specifications
Physical chip architecture, logical file system, memory map, and a side-by-side comparison of how Visa, Mastercard, Amex, Discover, JCB, and UnionPay implement and extend the EMV specification — AID, kernel, ODA, CVM, CVN, and script differences in one view.
Physical Chip Architecture
ISO 7816 Contact Module
C1VCC
C5GND
C2RST
C6VPP†
C3CLK
C7I/O
C4RFU
C8RFU
† VPP deprecated ISO 7816-3:1997
→
Secure Element IC
CPU Core8 / 16 / 32-bit RISC
ROMOS + App code (~256 KB)
EEPROM / FlashKeys + Data (~128 KB, persistent)
RAMWorking memory (~8 KB, volatile)
Crypto Engine3DES · AES · RSA · ECC · RNG
Contact I/FISO 7816 T=0 / T=1
RF InterfaceISO 14443 (dual-interface only)
↔
RF
Embedded copper coil
13.56 MHz · ISO 14443
Dual-interface only
ROM~256 KB · read-only after manufacturing
- Card OS — Java Card JCOP, Multos, or native proprietary
- EMV application bytecode / native compiled code
- Cryptographic subroutine library (DES, AES, RSA, hash)
- Communication protocol handlers — T=0, T=1, ISO 14443
EEPROM / Flash~64–256 KB · persistent across power-off
- PAN (5A), Expiry (5F24), CVV seed, Track 2 Equivalent (57)
- UDK-AC, UDK-SMI, UDK-SMC — symmetric personalization keys
- ICC RSA private key + ICC Public Key Certificate (9F46)
- Issuer Public Key Certificate (90), CA PK reference (8F)
- CVM List (8E), CDOL1/2, AIP (82), Application counters
- ATC (9F36), PIN try counter, offline floor limits, AUC (9F07)
- IAD template, risk management parameters, script counters
RAM~4–16 KB · cleared on every power-off
- Session keys SK-AC / SK-SMI / SK-SMC — never stored permanently
- APDU command and response working buffer
- Cryptographic intermediate values — hash state, RSA exponentiation scratch
- Transaction working data — TVR build, ODA scratch, CDOL data
EMV Logical File System
ISO 7816-4 hierarchical file system. Each payment application lives in its own ADF, identified by its AID. Multiple AIDs (Visa + Mastercard, or credit + debit) can coexist on one chip.
🗂️MF — Master FileRoot of the ISO 7816 card file system
📁PSE — 1PAY.SYS.DDF01Contact Payment System Environment — directory of available payment AIDs with priority
📄EF.DIR (SFI 1)Records list ADF entries: AID (4F) · App label (50) · App priority indicator (87)
📡PPSE — 2PAY.SYS.DDF01Contactless Payment System Environment — AID list returned inline in SELECT FCI, no separate EF
📄FCI (tag 6F → A5 → BF0C)AID list embedded in response: BF0C → 61 entries each with 4F (AID), 50 (label), 87 (priority), 9F2A (kernel ID)
💳ADF — A0 00 00 00 03 10 10 (Visa Credit)Application Dedicated File — one per payment AID. Terminal SELECTs by AID, receives FCI with PDOL.
📄EF.FCI (SELECT AID response, tag 6F)App label (50) · PDOL (9F38) · Language pref (5F2D) · App preferred name (9F12) · Issuer code table (9F11)
📄EF.APPL Records (per AFL 94 entries)Rec 1: PAN (5A) · Expiry (5F24) · Track 2 (57) · Cardholder name (5F20) — Rec 2: CVM List (8E) · CDOL1 (8F4D) · CDOL2 (8F4E) · AIP (82) · AFL (94) — Rec 3: Issuer PK Cert (90) · ICC PK Cert (9F46) · Issuer PK exponent (9F32) · ICC PK exponent (9F47)
🔒EF.ICC — internal, not readable over APDUICC Private Key · UDK-AC / UDK-SMI / UDK-SMC · ATC counter · PIN reference value · offline counters · script sequence counter
Chip Interface Categories
Contact-Only
ISO 7816 · T=0 / T=1
- 6 active contacts (C1–C3, C5–C7); C4 and C8 as RFU
- Full EMV transaction including second GENERATE AC
- ATM cards, older credit cards pre-2015
- Lower chip cost, no RF antenna in card body
Dual-Interface
ISO 7816 + ISO 14443 · single SE
- Contact and RF share one secure element IC
- Copper RF coil embedded in PVC card body (not chip)
- Same UDK keys serve both interfaces
- Separate AIDs can be enabled or disabled per interface
- Standard for all modern issued cards (2015+)
- Voltage switch: 3 V contact ↔ RF energy harvesting
Mobile SE / HCE
eSE · UICC · Cloud token
- eSE — embedded SE in phone motherboard (Apple Pay, Google Pay hardware path)
- UICC — SIM card hosts payment applet (carrier wallets)
- HCE — NFC handled by Android OS, keys in cloud tokenization vault, no physical SE
- CDCVM (biometric / device PIN) replaces card CVM
Wearable / Token
NFC-only · embedded SE or tokenized
- Smartwatches, rings, wristbands, payment stickers
- Uses tokenized PAN (DPAN) — Visa VTS, MC MDES
- No PIN pad — low-CVM or CDCVM on paired phone
- Same EMV contactless kernel as phone wallet (K2–K3)
EMV Specification Books
Contact (EMVCo Books 1–4)
Book 1
ICC to Terminal Interface
Physical layer, T=0 / T=1 protocols, ATR / ATS, logical channel APDU transport, card activation and deactivation sequence
Book 2
Security & Key Management
SDA / DDA / CDA offline data authentication, RSA key recovery, PIN processing, application cryptogram generation, session key derivation (CVN)
Book 3
Application Specification
Transaction flow commands (SELECT, GPO, READ RECORD, GENERATE AC), CVM processing, terminal and card action analysis, issuer script execution
Book 4
Cardholder & Terminal Interface
PIN entry UX, receipt format, error message display, attendant prompts, terminal capability requirements for L3 acquirer integration
Contactless (EMVCo Books A–E)
Book A
Architecture & General
System architecture, entry point, kernel selection, PPSE flow, protocol management
Book B
Entry Point
Terminal entry point, pre-processing, field detection, outcome reporting, restart/retry, kernel activation routing
Book C
Kernel Specs (K1–K6)
K1 Interac, K2 Mastercard, K3 Visa, K4 Amex, K5 JCB, K6 Discover/UnionPay — TTQ, CTQ, CDOL, fDDA flows per kernel
Book D
Device Specification
RF interface requirements, ISO 14443 electrical compliance, analog signal specs, PCD antenna test criteria
Book E
Proprietary Kernel Guidelines
Guidelines for kernels beyond K1–K6, entry point compatibility rules, interoperability requirements for scheme-proprietary kernels
Payment Scheme EMV Implementation Comparison
How each major scheme implements and extends the core EMV specification.
| Feature | Visa | Mastercard | Amex | Discover | JCB | UnionPay |
|---|---|---|---|---|---|---|
| Contact Chip | ||||||
| Contact specification | Visa EMV v1.4 (VIS) | M/Chip Advance · M/Chip Select | AEIPS v2.x | D-PAS | J/Smart v3.x | PBOC 3.0 / EMV hybrid |
| AID — Credit | A0 00 00 00 03 10 10 | A0 00 00 00 04 10 10 | A0 00 00 00 25 01 04 02 | A0 00 00 01 52 30 10 | A0 00 00 00 65 10 10 | A0 00 00 03 33 01 01 01 |
| AID — Debit / National | A0 00 00 00 03 20 20 (V PAY) | A0 00 00 00 04 30 60 (Maestro) | A0 00 00 00 25 01 07 01 | A0 00 00 01 52 40 10 | — (credit only) | A0 00 00 03 33 01 01 02 |
| ODA — contact | SDA · DDA · CDA (CDA preferred) | DDA required (M/Chip Advance); SDA legacy only | DDA required | DDA · SDA (legacy) | DDA · CDA | DDA · SDA |
| CVN versions | CVN10 · CVN18 | M/Chip CVN 0x10 · 0x18 | AEIPS CVN 1 · 3 · 5 | D-PAS CVN | J/Smart method | PBOC 3DES · SM4 |
| AC algorithm | 3DES (session key MAC) | 3DES (session key MAC) | 3DES | 3DES | 3DES | 3DES · SM4 (domestic China) |
| ARPC method | Method 1 (ARQC XOR RC) · Method 2 | Method 1 · Method 2 | Method 2 (AEIPS-specific) | Method 1 · 2 | Method 1 | PBOC method |
| CVM — contact | Offline Enc PIN · Online PIN · Signature · No CVM | Offline Enc PIN · Online PIN · Signature · No CVM | Online PIN · Signature · No CVM | Offline PIN · Online PIN · Signature | Offline PIN · Online PIN · Signature | Online PIN · Offline PIN · No CVM |
| Script processing | Yes — tags 71 / 72 (SMI + SMC) | Yes — tags 71 / 72 | Yes | Yes | Yes | Yes (PBOC scripts) |
| Contactless | ||||||
| Contactless spec | Visa payWave / Visa Contactless | Mastercard PayPass / Tap & Go | ExpressPay 3.x | Discover Zip / D-PAS CL | J/Speedy | QuickPass (qPBOC) |
| EMV CL Kernel | Kernel 3 (K3) | Kernel 2 (K2) | Kernel 4 (K4) | Kernel 6 (K6) | Kernel 5 (K5) | Kernel 6 (UP) / Proprietary |
| ODA — contactless | fDDA (combined in GENERATE AC) | fDDA / CDA | ODA optional (K4) | fDDA | fDDA / CDA | qSDA (PBOC style) |
| TTQ / CTQ negotiation | TTQ (9F66) in PDOL — no CTQ from card | TTQ (9F66) · CTQ (9F6C) card response | Terminal Capabilities (9F33) | TTQ (9F66) | TTQ (9F66) | QPBOC-specific fields |
| CL mag-stripe mode | Yes — qVSDC | Yes — PayPass mag-stripe | No — EMV mode only | Yes — D-PAS mag mode | No | No — qPBOC EMV only |
| CL CVM above limit | Online PIN · CDCVM (mobile) | Online PIN · CDCVM | Online PIN · Signature | Online PIN · Signature | Online PIN · Signature | Online PIN |
| Second GENERATE AC | Optional — skipped in typical NFC tap | Optional | Not in standard flow | Optional | Optional | Typically skipped |
| Digital & Tokenization | ||||||
| Tokenization service | Visa Token Service (VTS) | MDES | Amex Token Service | Discover Token Service | JCB Tokenization | UnionPay Token Service |
| 3DS brand | Visa Secure (3DS 2.x) | Identity Check (3DS 2.x) | SafeKey 2.x | ProtectBuy | J/Secure 2.x | SecurePlus |
| Processing network | VisaNet | Banknet | AmexNet | Discover / PULSE | JCB / CAFIS | CUP / UnionPay International |
EMV L2 Contactless Kernel Reference
K1
Interac
Interac Flash (Canada)
Domestic Canadian debit. Contactless debit transactions under CAD $250. Interac AID A0 00 00 02 77 10 00. Defined in EMVCo Book C-1.
K2
Mastercard
PayPass · Tap & Go · M/Chip CL
Most widely deployed kernel. Full TTQ + CTQ capability negotiation. Supports both EMV mode and mag-stripe mode. Book C-2.
K3
Visa
payWave · Visa Contactless
TTQ in PDOL. Supports qVSDC mag-stripe fallback, EMV Mode, and fDDA. No CTQ from card — terminal-driven negotiation. Book C-3.
K4
American Express
ExpressPay 3.x
EMV mode only — no mag-stripe mode. Uses terminal capabilities (9F33) rather than TTQ for negotiation. Book C-4.
K5
JCB
J/Speedy
Deployed primarily in Japan and JCB-issuing markets. Shares TTQ negotiation model with Visa. EMV mode only. Book C-5.
K6
Discover / UnionPay
Discover Zip · QuickPass (qPBOC)
Shared kernel slot. Discover uses D-PAS contactless profile; UnionPay uses qPBOC with SM4 option for domestic China transactions. Book C-6.
Related Tools
Use these tools to work with the cryptographic primitives that underpin terminal and card security.