Industry radar

Payments industry news, mapped to the tools you use

What standards bodies, regulators, card networks and the trade press published this week — with a short PayProbe take on the developments that change how you build, test or certify, and links to the decoders, calculators and guides they affect.

Updated 17 Oct 2026 · 164 headlines from 11 sources · refreshed weekly · nothing is fetched in your browser · RSS feed

PayProbe take

Developments that change something for payment engineers, and where on PayProbe to test the impact.

Kernel 8 gains approved implementations: Castles and ID TECH join Ingenico

EMVCo added two more Book C-8 (Kernel 8) implementations to its approved kernel list this summer: Castles Technology's CBM-EMVCL-K08 v1.0.0 on 9 July 2026 and ID TECH's C8 kernel, built to specification v1.1, on 6 August 2026. Ingenico's AXIUM DX8000 was the first, in October 2024, the month EMVCo opened Kernel 8 type-approval testing. The specification itself is still v1.1; the Q2 2026 bulletin SB 325 corrects it (Service Code removed, a "decryption failed" signal, the First Wire flag length). No card scheme has published a date by which terminals must support Kernel 8, so readers keep running the scheme kernels C-2 to C-7 alongside it — test both paths.

"Zombie Card": expired contactless cards revived through a relay that rewrites the expiry date

At USENIX Security (12–14 August 2026) researchers from the University of Massachusetts Amherst showed expired Visa contactless cards completing in-store purchases: a man-in-the-middle relay between card and terminal rewrites the expiry date the terminal reads, without breaking any cryptography. It needs the expired card (or sustained NFC proximity to it), an account still open under the same PAN — the normal case after a card is replaced — and an issuer that does not re-check the expiry during authorization. Of three banks tested with replaced cards, one approved the revived transactions, one declined every attempt and one ran a different kernel on which the modification failed. The fix sits on the issuer host: check the expiry date in each authorization against the card currently issued for that PAN.

Passed 23 Sep 2026

FedNow starts testing cross-border transaction support

On 23 September 2026 Federal Reserve Financial Services said the FedNow Service will begin supporting cross-border transactions — the first step beyond U.S. borders since FedNow launched in July 2023. FedNow settles only the U.S. domestic leg; the international leg still moves through correspondent banking relationships chosen by each participant. A group of early adopters is now testing enhanced ISO 20022 message formats built for that U.S. leg — flagged use cases include international payroll, corporate payments, treasury management and insurance claims — ahead of wider availability to all FedNow participants. The capability builds on the Federal Reserve Board's 8 April 2026 proposal to amend Regulation J so FedNow participants can route through intermediaries other than Reserve Banks; no date has been set for general availability, and the Regulation J change is still a proposal.

Passed 14 Sep 2026

PCI SSC publishes a standalone Key Management and Operations (KMO) standard

PCI SSC published the Key Management and Operations (KMO) Standard v1.0 on 14 September 2026 — a new document for entities that operate and manage systems using cryptographic keys for account-data security, covering the full key lifecycle from generation to destruction plus the procedures, systems and equipment around it. Its initial scope pulls together the key-management requirements currently spread across the PCI PIN and PCI P2PE standards (the same key types TR-31/TR-34 key blocks carry) into one assessable document, built for an "assess-once, use-many" model so a single KMO assessment can support multiple PCI programs that reference it. It ships as two documents: the KMO Requirements and Test Procedures, and the KMO Program Guide.

CLARITY Act stalls in the Senate; the CFTC moves on crypto market rules under existing authority

The Senate cloture vote on the CLARITY Act failed 49–50 on 15 September 2026, short of the 60 votes needed; the dispute was over ethics provisions on officials' crypto holdings, not the SEC/CFTC market-structure split. On 17 September the CFTC sent a proposed rule, "Regulation Crypto Asset Transactions and Regulation Crypto Asset Markets" (RIN 3038-AF80), to the White House for review. None of this changes payment stablecoins: the GENIUS Act and its implementation dates are unaffected.

Passed 30 Sep 2026

EMVCo opens its card-based agentic payments framework for comment

EMVCo published the draft "EMV Agentic Payments — Framework for Specifications" on 1 September and took feedback until 30 September; as of 1 October it has not announced the next draft or a publication date. The core idea is "Intent Services": a shared, interoperable layer where participants register, reference and manage consumer-authorised intent across a transaction lifecycle — complementing cryptographic schemes such as AP2 mandates and Mastercard Verifiable Intent. EMVCo also flags future Know-Your-Agent capabilities and agentic transaction indicators, which would eventually surface in authorization data.

ISO 20022 structured-address cutover: Fedwire moves to November 2027, Swift and the EPC defer

The 14 November 2026 "unstructured addresses rejected" milestone has fragmented by rail. Federal Reserve Financial Services rescheduled the Fedwire Funds Service release to November 2027 (announced 27 August). Swift accepted a community request to extend the CBPR+ migration and deferred all SR2026 payments changes, promising a new date by December; non-payments SR2026 items (T+1 support) go live in Q1 2027. On 9 September the EPC Payment Scheme Management Board followed suit and delayed the 15 November 2026 end-date for unstructured addresses across all five EPC scheme rulebooks; it reconvenes in October to set a new date. Keep building structured-address support — Swift reports over 60% of traffic still carried unstructured addresses in April.

Passed 20 Sep 2026

Verification of Payee rulebook v1.1, API spec 1.1.1 and API Security Framework 2.1 took effect 20 September

The EPC's March updates to the VOP scheme became effective on 20 September 2026: rulebook v1.1 (urgent change requests from the December 2025 consultation), inter-PSP API specification 1.1.1 (no empty API fields, character-set, timestamp and HTTP-header clarifications) and API Security Framework v2.1, which is now mandatory for VOP, SRTP and SPAA participants using APIs. The v2.0 change-request consultation closed on 30 June; v2.0 is scheduled for publication by the end of November 2026.

Passed 16 Sep 2026

Circle's Arc mainnet is live with Visa and Mastercard among the founding validators

Circle launched Arc mainnet on 16 September 2026. Arc is a USDC-native Layer 1 aimed at institutional settlement: USDC is the gas token, consensus is the Tendermint-derived Malachite engine with sub-500 ms deterministic finality, and execution is an EVM built on Reth, so existing Solidity tooling ports directly. The eleven founding validators include BlackRock, DTCC, Galaxy, Global Payments, ICE, Mastercard, MoneyGram, SBI, Standard Chartered, Sumitomo and Visa. For processors it is one more settlement rail to map alongside Tempo and the public chains — take chain IDs and USDC/EURC contract addresses from Arc's official contract-address reference, not third-party lists.

Key date 18 Jan 2027

Treasury proposes the GENIUS Act issuance rules; only permitted issuers may issue payment stablecoins from 18 January 2027

Treasury's notice of proposed rulemaking (Federal Register, 18 August 2026) implements Section 3 of the GENIUS Act — who may issue, offer and sell payment stablecoins in the US — with a 60-day comment period. The statutory timeline stands: from 18 January 2027 only permitted payment stablecoin issuers (or OCC-registered foreign issuers) may issue for the US market, and from 18 July 2028 digital-asset service providers may not offer non-permitted stablecoins to US persons. A separate FinCEN rule (22 June) sets customer-identification requirements for permitted issuers.

Key date 31 Oct 2026

PCI SPoC and CPoC give way to MPoC; the standalone 3DS SDK standard sunsets 31 October

Two PCI SSC consolidations land this autumn. Software-based PIN Entry on COTS (SPoC) and Contactless Payments on COTS (CPoC) are being retired in favour of Mobile Payments on COTS (MPoC), which covers both PIN entry and contactless acceptance on off-the-shelf devices. Separately, the PCI 3-D Secure SDK Security Standard has a formal sunset from 1 May to 31 October 2026 and becomes a module of the PCI Secure Software Standard. New SoftPOS and 3DS SDK evaluations should target the successor standards.

Agentic payments infrastructure consolidates: Agentic Payments Alliance and AWS AgentCore Payments GA

On 18 August stablecoin-card company Rain announced the Agentic Payments Alliance with Visa, Mastercard, Fiserv, Circle, Solana and Remitly among the founding members — a member-run coalition rather than a spec body. The same day AWS made Amazon Bedrock AgentCore Payments generally available; built with Coinbase and Stripe, it wraps wallet authentication, HTTP-402-style payment execution and spend governance so agents can pay for APIs, MCP servers and content. Together with the x402 Foundation (Linux Foundation, April) and Stripe/Tempo's Machine Payments Protocol, most agent-to-service payments now converge on the 402 handshake PayProbe's decoders already parse.

EMVCo Q2 bulletins: Kernel 2 mag-stripe mode removed, new TRMD bits, EMV 3DS 2.4 and Tokenisation 2.4 drafts

The Q2 2026 EMVCo newsletter lists the specification bulletins that matter for kernel and issuer teams: SB 317 removes the Mag-stripe Mode implementation option from Kernel 2 (Book C-2), SB 314/319 extend Terminal Risk Management Data with Deferred Authorisation and Transit Gate bits plus a payment-system byte, SB 325 corrects Book C-8 (Kernel 8), and GB 60 v3.0 details Phase 1 of the contact-chip feature sunset. Drafts of EMV 3-D Secure 2.4 and Payment Tokenisation 2.4 (PAR use-cases) are with Associates, and TTA Bulletin 293 confirms approved kernels must keep processing after the 2038 date rollover.

Headlines

Aggregated from public RSS feeds and tagged by topic. Each link opens the publisher's article.

  • EMVCoEMVCo Newsletter: Q2 2026

    Message from the Chair of the EMVCo Board of Managers Another busy quarter saw the EMVCo community come together for both our Technical Meeting in Singapore and the annual EMV® User Meeting in Salt Lake The post EMVCo Newsletter: Q2 2026 appeared first on…

    🔓 EMV TLV Decoder📚 EMV Tag Reference

  • EMVCo InsightsDefining an EMV® Digital Payment Credential

    In this post, Sami Tikkala, Chair of the EMVCo Digital Identity and Payments Task Force, provides an introduction to EMVCo’s Digital Payment Credential (DPC) initiative and explains how all industry stakeholders can get involved and The post Defining an EMV®…

    🔑 Token Format Checker🔍 BIN Lookup