Reference

Payment Certification Levels

A practical guide to EMVCo L1 / L2 / L3 terminal certifications, PCI DSS merchant compliance tiers, and the standards that govern every card-present transaction.

Network & Scheme Certification Programs

Beyond PCI and EMVCo, each card network runs its own approval programs for terminal vendors, payment facilitators, and technology providers. Approval from one scheme does not imply approval from another.

Visa Ready

  • Program for technology partners building Visa-enabled products
  • Covers: POS hardware, mPOS, SoftPOS (Tap to Phone), tokenization
  • Visa Token Service — mandatory for tokenization integrations
  • Visa Secure (3DS) — ACS, 3DS Server provider approval
  • VIS (Visa Integrated Circuit Card Specifications) — L2 kernel approval

Mastercard Engage

  • Mastercard's partner program for technology vendors
  • TQM (Terminal Quality Management) — L2 kernel testing
  • Digital Enablement Service — tokenization provider approval
  • Mastercard Identity Check — 3DS ACS provider certification
  • Mastercard Cloud-Based Payments (MCBP) — SoftPOS approval

American Express

  • OptBlue — payment facilitator / aggregator program
  • ExpressPay — contactless kernel L2 approval
  • American Express SafeKey — 3DS / ACS integration
  • Network authorization testing required per processor

UnionPay International

  • QuickPass — contactless kernel and terminal certification
  • Separate certification for China Domestic vs. International
  • UPI terminal requirements differ from EMVCo standard in some areas
  • Mandatory for acceptance in mainland China

JCB

  • J/Smart — contact chip specification and certification
  • J/Speedy — contactless kernel approval
  • Required for acceptance in Japan and JCB-issuing markets

EMVCo 3DS

  • EMV 3-D Secure specification (EMV 3DS 2.x)
  • Defines the protocol between 3DS Server, ACS, and DS
  • Each scheme adopts EMV 3DS but adds brand-specific fields
  • EMVCo maintains the core specification; schemes certify their own ACS/DS vendors
SoftPOS (Tap to Phone): Turning a commercial smartphone into a payment terminal adds a new certification layer. Requires PCI CPoC (Contactless Payments on COTS) or PCI MPoC (Mobile Payments on COTS) validation in addition to EMVCo L1/L2 and scheme approvals. CPoC is for contactless acceptance only; MPoC additionally covers PIN entry on the device.

Related Tools

Use these tools to work with the cryptographic primitives that underpin terminal and card security.

🗝️ DUKPT Key Derivation🔢 PIN Block Encoder🧮 ARQC Calculator🔓 EMV TLV Decoder🏷️ MAC Calculator🔐 DES / 3DES Calculator