Terminal Type Approval

 

  1. What does the EMVCo approval activity cover?
  2. How are IC card applications tested and approved?
  3. Where is a list of terminals which have been approved by EMVCo for EMV Level 1 and Level 2?
  4. What is an 'Application Kernel'?
  5. What does ‘kernel testing’ mean?
  6. If I am interested in purchasing a previously approved IFM or Application Kernel from a vendor, how can I know that it will be compatible with my device?
  7. What are the definitions of 'terminal' and 'interface module' in the context of a fully integrated POS system?
  8. How are other terminal types e.g. mobile phones, set-top boxes, unattended payment terminals etc approved?
  9. How can I be registered for EMV level 1 or 2 Type Approval?
  10. Do I need the support of an acquirer to submit a terminal for type approval?
  11. Is it possible to ‘self-certify’ an EMVCo compliant terminal?
  12. Where can I find a list of EMVCo approved type accredited laboratories?
  13. How can I obtain test tools to assist in development of either an IFM or Application Kernel?
  14. Which laboratory should I use for Type Approval testing?
  15. How do I establish myself as a type approval laboratory?
  16. How can I obtain an editable electronic copy of the Approval Request Form? Will it be possible to obtain an editable electronic copy of the Application Form?
  17. Could you please advise the usual turnaround time for obtaining approval after the submission of official Type Approval test result?
  18. Please identify the steps required for Level 2 type approval.
  19. I am a developer of POS terminals and I would like to get approval from EMV. Besides getting Terminal approval can I get Card approval too?
  20. What is the cost of Type Approval testing?
  21. How do I know if my device can become Level 1 or 2 compliant?
  22. Is it possible to combine different IFMs and Application Kernels?
  23. Is it possible to combine components developed to different versions of the specification?
  24. Can IFMs and Application Kernels be ported to new platforms?
  25. Can I reconfigure previously approved application kernels?
  26. Is it possible to modify the EMVCo contract?
  27. What fees do EMVCo assess for the approval process and how are these payments made?
  28. What does EMVCo want when requesting that the vendor identify the IFM or application "as tested in"?
  29. How should I assign my IFM or application kernel an Identifier?
  30. Can you clarify the Test Report Validity Policy?
  31. How do I indicate the Terminal Type Description?
  32. How is approval extended to other terminals not tested by EMVCo?
  33. When does EMVCo plan to officially begin testing of devices based upon the EMV Contactless specification?
  34. What is the process to obtain EMV compliance on a new product? What are the cost and time frames involved?
  1. What does the EMVCo approval activity cover?

    EMVCo has written and published test requirements and test cases for the terminal chip card interface (Level 1) and for the payment application (Level 2). EMVCo has furthermore accredited testing laboratories to deliver testing services to terminal vendors and application providers. Finally EMVCo issues a Letter of Approval for approved products.

  2. How are IC card applications tested and approved?

    See the Card Type Approval FAQs for more information about testing of Common Core Definitions (CCD) and Common Payment Application (CPA) application. Other card applications are to be tested and approved by the individual Payment Systems. Please contact the Payment Systems directly for further information.

  3. Where is a list of terminals which have been approved by EMVCo for EMV Level 1 and Level 2?

    A regularly updated list of Level 1-approved Interface Modules and Level 2-approved application kernels can be obtained from the EMVCo website in the Type Approval section.

  4. What is an 'Application Kernel'?

    An application kernel is a software module, core, or library, forming part of a complete terminal application architecture that is developed for exclusive support of the EMV debit/credit functions and application requirements. Since application kernels are functionally tested and approved by EMVCo as standalone components, they may be ported to other hardware platforms under certain conditions.

  5. What does ‘kernel testing’ mean?

    Kernel testing means testing of the Application Kernel in an EMVCo accredited laboratory. The application kernel is the part of the terminal payment application that deals with EMV specific functions. Testing of payment scheme specific brand settings is the responsibility of the payment systems themselves.

  6. If I am interested in purchasing a previously approved IFM or Application Kernel from a vendor, how can I know that it will be compatible with my device?

    Those interested in purchasing approved components should contact the appropriate equipment provider directly to discuss price and compatibility. Previously approved components can be integrated into new hardware platforms provided there are no changes made that could potentially have a negative affect upon the functionality of the component. Type Approval Bulletin #11 provides guidelines concerning the conditions under which a previously approved component can be integrated without requiring retesting by an EMVCo laboratory.

  7. What are the definitions of ‘terminal’ and ‘interface module’ in the context of a fully integrated POS system?

    The interface module (IFM) is defined in Book 1 of EMV 4.0 while the terminal definition is given in Book 3. These specifications are applicable to integrated POS, stand-alone POS or ATMs. Integrated POS systems may differ from other POS systems regarding software modularity. Some independent software modules may require association with other hardware or software modules before EMV compliance testing may begin.

  8. How are other terminal types e.g. mobile phones, set-top boxes, unattended payment terminals etc approved?

    The interface module (IFM) for these special devices can be approved in the same way as standard terminals or ATMs. However, it is for the vendor to determine whether a particular device has the capabilities necessary to fulfill the technical requirements as outlined in the EMV specifications.

  9. How can I be registered for EMV level 1 or 2 Type Approval?

    The administrative process, available at the EMVCo website provides registration forms for level 1 and 2.

    All documents are available in the Type Approval section under EMVCo Level 1 & 2 documentation and Type Approval Vendor Forms sub-sections.The Type Approval procedure is explained in the EMVCo Type Approval Terminal Level 1 & 2 Administrative Process documents.

    All forms are to be filled in and submitted electronically to: terminal_approval@emvco.com

  10. Do I need the support of an acquirer to submit a terminal for type approval?

    No, Terminal Application Kernel testing can be performed independently from the acquirer infrastructure. Payment scheme testing is separate from the EMVCo testing.

  11. Is it possible to ‘self-certify’ an EMVCo compliant terminal?

    EMVCo does not recognize in-house approval testing. A vendor can nevertheless purchase test tools to perform in-house debug testing before being submitted to an EMVCo laboratory for formal testing. Some testing laboratories offer preliminary testing to debug the interface module or the terminal application.

  12. Where can I find a list of EMVCo approved type accredited laboratories?

    A list of accredited laboratories can be obtained from the EMVCo website by selecting 'Type Approval' and then 'Laboratories' from the main menu. Please note that some testing laboratories perform both Level 1 and Level 2 testing while others provide only one of the services.

  13. How can I obtain test tools to assist in development of either an IFM or Application Kernel?

    Please contact the testing laboratories directly concerning the availability of test tools. A listing of laboratories can be obtained from the EMVCo website.

  14. Which laboratory should I use for Type Approval testing?

    Vendors are free to select any laboratory of their choosing. Since the services and associated costs of each laboratory will vary, the vendor is encouraged to contact multiple laboratories to discuss fees and availability of testing.

  15. How do I establish myself as a type approval laboratory?

    EMVCo has not yet finalized a process for becoming an accredited laboratory. In the interim, the individual payment schemes have assumed responsibility for this process by sponsoring entities to become officially accredited EMVCo laboratories. If you are interested in becoming an accredited laboratory, we suggest that you contact your representative at the payment scheme directly.

  16. How can I obtain an editable electronic copy of the Approval Request Form? Will it be possible to obtain an editable electronic copy of the Application Form?

    An editable version of both the Registration and Approval Request Form can be downloaded from the EMVCo website.

  17. Could you please advise the usual turnaround time for obtaining approval after the submission of official Type Approval test result?

    EMVCo strives for a 2-week turnaround for approval requests after all pre-requisites (contract, approval requests, and payment) have been satisfied. Test result evaluation and approval notification will take longer if test result evaluation identifies questions, incomplete tests, or test failures.

  18. Please identify the steps required for Level 2 type approval.

    Please review section 8 in the administrative process documentation for the steps necessary for Type Approval. The general process is as follows: Registration, Contract, Testing, Approval Request, Invoice & Payment, Test Result Evaluation, and Approval or Decline notification.

  19. I am a developer of POS terminals and I would like to get approval from EMV. Besides getting Terminal approval can I get Card approval too?

    EMVCo only manages terminal type approval and is not involved with type approval services for cards. Card manufacture, card personalization, and bureau certification requirements are determined by the individual payment schemes.

  20. What is the cost of Type Approval testing?

    While EMVCo assesses certain administrative costs associated with the type approval process, the actual cost of the testing will vary depending upon the laboratory used. Since the laboratories assess different fees for the services they provide, the vendor is encouraged to contact multiple laboratories. The geographic location of the laboratory may also be a consideration.

  21. How do I know if my device can become Level 1 or 2 compliant?

    EMVCo cannot review or make recommendations concerning the compliance of your products. It is the responsibility of the vendor to review the appropriate technical specifications to ensure they meet all the requirements set by EMV. Any vendor should then be able to submit a product for testing and approval consideration with relative ease provided they meet all the requirements set by EMV.

  22. Is it possible to combine different IFMs and Application Kernels?

    IFMs and Application Kernels are approved as independent functional components, it may be a minor change to combine previously approved components that may never have been used in combination before -- including components that may have been developed according to different versions of the EMV specification. For example, it is possible to use an EMV 3.1.1-compliant IFM in conjunction with an EMV 4.0-compliant application kernel, provided that the combining of components did not require additional modifications that could negatively impact the functionality of either component. If an IFM and application kernel can be combined without requiring any of the modifications categorized as major for either component, then the process of combining the components could be considered a minor change.

  23. Is it possible to combine components developed to different versions of the specification?

    Yes. You may use or submit for type approval testing components that have been developed to different versions of the specification. For example, it is possible to submit an application kernel for EMV2000 Level 2 approval using an IFM that was previously approved to EMV96. There is no requirement that you upgrade your EMV96 IFM to be EMV2000 compliant.

  24. Can IFMs and Application Kernels be ported to new platforms?

    IFMs and application kernels are functionally tested and approved as stand-alone components. If components can be ported to other platforms without negatively impacting the functionality of either the IFM or application kernel, then retesting by an EMVCo laboratory should not be necessary. However, if porting the application has the potential of negatively impacting the functionality of the IFM or application kernel, then retesting is required. In addition, if components are to be run on a new operating system, the change would be considered major in nature and the component (with new operating system) would require retesting. EMVCo has published a bulletin that provides guidelines to the vendor to assist them in making this determination, please see bulletin 11. Major changes require retesting, minor changes do not.

  25. Can I reconfigure previously approved application kernels?

    EMVCo laboratories test only pre-defined configurations. An application kernel can be tested for one or more configurations; however, application kernels can be used only with configurations that have been previously tested by an EMVCo laboratory. The number of potential configurations that can be supported depends upon whether the kernel was tested for single or multiple configurations.

  26. Is it possible to modify the EMVCo contract?

    EMVCo policy requires all vendors interested in EMVCo type approval to sign the same standard contract. Contract modification for a single vendor is not possible. However, comments will be forwarded to EMVCo legal representatives for review and possible inclusion in any future contract revision.

  27. What fees do EMVCo assess for the approval process and how are these payments made?

    Registration is free of charge with EMVCo. However, each request for approval is subject to a Type Approval fee.

    EMVCo currently charges a US$4,000 administrative fee for test result evaluation services; however, this amount may change depending upon whether single or multiple configurations are being submitted for approval. Further, this fee is subject to change without notice.

    EMVCo will provide you with an invoice when receiving your completed Request For Approval form. Your invoice will contain payment details such as account number and payment description to be used.

    EMVCo only accepts payments containing the correct payment description as mentioned on your invoice.

  28. What does EMVCo want when requesting that the vendor identify the IFM or application "as tested in"?

    This designation is not part of the IFM or Kernel identification. \"As Tested In\" provides linkage to the marketing name of the product within which the IFM or Kernel was actually tested. Note that when completing an Approval Request, or Implementation Conformance Statement (ICS), the product name must not specify a series or range of terminals. If the components can be used in a series of devices, it is the responsibility of the vendor to maintain the necessary documentation linking additional devices to a previously approved component.

    It is mandatory that the specific model used during testing be identified on these forms. Not doing so may result in a delay of approval. All laboratories are required to report the specific terminal the IFM or application kernel sample was tested in. This information should be presented within the test report, usually noted in Section III - Product Description, before the test case summary.

  29. How should I assign my IFM or application kernel an Identifier?

    Vendors should note that when assigning an ID to an IFM or Kernel, characters that imply a range, series, or family of IFMs or Kernels are not allowed. This also extends to the \"Version\" description, as well. For example:

    Level 1 - IFM and Terminal Identification (EXAMPLE ONLY)

    Commercial Model # and IFM Name: Rocket 2xxx Version 1.x (Not Acceptable)

    Terminal Identification: Cool 1xxx Family (Not Acceptable)

    --------------------------------------------------------------------

    Commercial Model # and IFM Name: Rocket 2100 Version 1.0 (Acceptable)

    Terminal Identification: Cool 1100 (Acceptable)

    Note: Here the Terminal Identification is what will be noted in the \"As Tested In\" field.

    ==========================================

    Level 2 - EMV Application Kernel Identification (EXAMPLE ONLY)

    Terminal Name and Model Number: Slider 3xxx Series (Not Acceptable)

    Application Name and Version: KillerApp WR** Version 2.x (Not Acceptable)

    --------------------------------------------------------------------

    Terminal Name and Model Number: Slider 3000 (Acceptable)

    Application Name and Version: KillerApp WR1B Version 2.2 (Acceptable)

    Note: Here the Terminal Name and Model Number is what will be noted in the \"As Tested In\" field.

    Vendors should ensure that the approval request matches the description in the Implementation Conformance Statement (ICS ). When in doubt, the data presented in the ICS is used as the primary source of information for what will be published on the EMVCo website, as well as in the approval.

  30. Can you clarify the Test Report Validity Policy?

    Test results can be submitted to EMVCo for evaluation up to 90 days from the date they are generated by the laboratory. Please note the first day for this validity period is the completion date of the testing, not when the report is printed by the laboratory, or when the Vendor receives the report. Test results that exceed the 90-day validity period is considered expired and may not be submitted. Re-testing for the IFM or Kernel is required to create a current test report if the validity period is exceeded and EMVCo evaluation is desired.

  31. How do I indicate the Terminal Type Description?

    The correct description should be according the following:Heading: Terminal Type

    Found under: Part III - Terminal Resident Data Objects on the 4.0 Level 2 ICS.Description: This field should contain only one value from the list below. Note that this value should correspond to those details selected in the ICS under Part V - Terminal Details, which describes the type of terminal configuration being tested. Multiple values are permitted if the application kernel is being tested for multiple configurations.

    Operational Control (Environment) Provided by:
    Financial Institution / Merchant / Cardholder

    Attended:
    Online only : - 11 / 21 / --

    Offline with online capabilities : - 12 / 22 / --

    Offline only : - 13 / 23 / --

    Unattended:

    Online only : - 14 / 24 / 34

    Offline with online capabilities : - 15 / 25 / 35

    Offline only : - 16 / 26 / 36

  32. How is approval extended to other terminals not tested by EMVCo?

    EMVCo does not \"extend\" approvals to other terminals beyond the terminal, the IFM or application kernel was tested in. Please be advised that EMVCo does not approve terminals, only IFMs (Level 1) and Application Kernels (Level 2). It is a vendor’s responsibility to provide proof to the acquiring community that their approved Kernel or IFM is portable to other terminals. If a vendor finds it necessary to complete the approval process only to list another terminal, they may do so. Please note, that in this case a new Application Kernel or IFM ID must be assigned, as we do not allow the same ID to be used for a subsequent request for approval.

    EMVCo does not list a formal process of how the Vendor may \"extend the usage of an EMVCo approved Kernel\" outside of the normal EMVCo approval process.

  33. When does EMVCo plan to officially begin testing of devices based upon the EMV Contactless specification?

    Please note that EMVCo is currently developing requirements to test Contactless devices.

    Please continue to check the EMVCo website for specific details on Contactless device testing and the related processes and requirements for obtaining test tools or information on recognized laboratories.

  34. What is the process to obtain EMV compliance on a new product? What are the cost and time frames involved?

    Please review Section 8 of the Administrative process documentation for the steps necessary for Type Approval. The general process is as follows: Registration, Contract, Testing, Approval Request, Invoice & Payment, Test Result Evaluation, and Approval or Decline notification.

    While EMVCo assesses certain administrative costs associated with the type approval process, the actual cost of the testing will vary depending upon the laboratory used. Since the laboratories assess different fees for the services they provide, the vendor is encouraged to contact multiple laboratories. The geographic location of the laboratory may also be a consideration.

    Registration is free of charge with EMVCo. However, each request for approval is subject to a Type Approval fee.

    EMVCo currently charges a US$4,000 administrative fee for test result evaluation and Letter of Approval issuing services independently of Level 1 and Level 2; however, this amount for Level 2 may change depending upon whether single or multiple configurations are being submitted for approval. Further, this fee is subject to change without notice. Please refer to Type Approval Bulletin No. 63 for information on our latest fee structure.

    EMVCo strives for a two-week turnaround for both Level 1 and Level 2 approval requests after all pre-requisites (contract, approval requests, and payment) have been satisfied. Together with the report submitted by the lab, you will need to complete and submit a Request for Approval form and pay the administrative fee. The Request for Approval form can be downloaded from our website.

    Test result evaluation and approval notification will take longer if test result evaluation identifies questions, incomplete tests, or test failures. Please contact your respective lab if you have not received a response within 1 week after all necessary forms and fees have been submitted.

    Please also refer to the following sections of the EMVCo website for specific details on the terminal approval process for EMV Level 1 and EMV Level 2 application kernels:

    • The FAQ section, which provides general information on EMVCo and the Terminal Type Approval process
    • The Type Approval Process Documentation section in the Terminal Type Approval section, which contains the EMVCo Type Approval Terminal Level 1 and Level 2 Process documents