Payment Certification Levels
A practical guide to EMVCo L1 / L2 / L3 terminal certifications, PCI DSS merchant compliance tiers, and the standards that govern every card-present transaction.
PCI PTS & Software Security Framework
PCI PTS and PCI SSF govern the hardware and software side of the payment security stack independently from merchant compliance tiers.
PCI PTS
PIN Transaction Security
Governs all devices that enter, process, or transmit PINs and sensitive authentication data. Applies to POS terminals, PIN pads, and unattended payment terminals.
Device classes
- POI — Point of Interaction (POS terminals, PIN pads)
- HSM — Hardware Security Modules
- PED — PIN Entry Devices (tested under POI since PTS 5.x)
Security levels (POI)
Key requirements
- Tamper-evident / tamper-responsive enclosure
- Secure key loading and key management
- Isolated cryptographic module for PIN encryption
- All PINs encrypted immediately upon entry (DUKPT or Master/Session)
- Display and keypad integrity verification
PCI SSF
Software Security Framework
Replaced PA-DSS (Payment Application Data Security Standard) in 2022. Covers software security for payment applications across two programmes.
Two standards
- Secure Software Standard (S3) — for payment software running on commercial off-the-shelf environments (COTS). Covers secure development lifecycle, vulnerability management, and sensitive data handling.
- Secure Software Lifecycle Standard (Secure SLC) — for vendors who want to demonstrate a mature, repeatable security development process. Provides a vendor-level certification rather than a per-product one.
Key differences from PA-DSS
- Broader scope: covers SaaS and cloud payment apps (PA-DSS was limited to COTS)
- Lifecycle focus: secure design, not just point-in-time assessment
- Modular: S3 and Secure SLC can be used independently
PCI P2PE
Point-to-Point Encryption
A validated P2PE solution encrypts cardholder data from the point of swipe/dip/tap all the way to the decryption environment, keeping the merchant's POS system out of PCI DSS scope.
- Merchants using a validated P2PE solution can use SAQ P2PE (~35 questions)
- Decryption must occur in a PCI-compliant HSM
- Key management must follow PCI PTS HSM requirements
- Solution providers are listed on the PCI SSC P2PE Solutions List
PCI 3DS
3-D Secure Core Security Standard
Governs security requirements for entities that provide 3DS services: Access Control Servers (ACS), 3DS Servers, and Directory Servers.
- Applies to: ACS vendors, 3DS service providers, DS operators
- Covers: Cardholder data protection, cryptographic key management, audit logging
- Assessment: Annual assessment by a PCI 3DS Assessor
- 3DS SDK standard sunset: the standalone PCI 3DS SDK Security Standard has a formal sunset period from 1 May to 31 October 2026 and becomes a module of the PCI Secure Software Standard — target the SSF module for new SDK evaluations
PCI MPoC
Mobile Payments on COTS
The single standard for accepting contactless payments and PINs on off-the-shelf phones and tablets (SoftPOS / Tap to Phone). It replaces the two earlier COTS standards.
- SPoC (Software-based PIN Entry on COTS) and CPoC (Contactless Payments on COTS) sunset between May and October 2026; new solutions should validate against MPoC
- Modular: attestation & monitoring, software protection, back-end and PIN-entry modules can be evaluated separately
- Sits alongside EMVCo L1/L2 kernel approval and scheme SoftPOS programs
PCI KMO
Key Management and Operations — new, published Sep 2026
Published 14 September 2026, KMO is a new standalone standard for entities that operate and manage systems using cryptographic keys for account-data security — the full key lifecycle from generation to destruction, plus the procedures, systems, and equipment around it.
- Initial scope targets the key-management requirements currently spread across the PCI PIN and PCI P2PE standards, pulled into one assessable document
- Covers keys used to protect PINs, account data, and other cryptographic keys (storage, transport, or derivation keys) — the same key types TR-31 / TR-34 key blocks carry
- Built for an assess-once, use-many model: one KMO assessment can support multiple PCI programs that reference it, instead of re-assessing key management under each standard separately
- Ships as two documents: the KMO Requirements and Test Procedures, and the KMO Program Guide
Related Tools
Use these tools to work with the cryptographic primitives that underpin terminal and card security.
Common questions
What is PCI PTS?
PCI PIN Transaction Security: the PCI SSC standards and approval programme for devices that accept or protect PINs — POI terminals and PIN pads under PTS POI, and hardware security modules under PTS HSM. Devices are evaluated by approved labs and listed with an approval expiry date.
What is the difference between PCI PTS and PCI DSS?
PTS approves a device model (its hardware and firmware) and is the vendor’s responsibility. PCI DSS covers the environment of every organisation that stores, processes or transmits card data, including how approved devices are deployed and managed.
What happens when a PTS approval expires?
The device can no longer be bought for new deployments as a PTS-approved device, but units already in the field can usually keep running; card brand and acquirer rules decide when they must be replaced.