AUC Decoder
Decode the EMV Application Usage Control (tag 9F07) bitfield — the issuer's rules for where and how the card may be used.
Follows EMV 4.4 Book 3 Annex C2Application Usage Control (tag 9F07)·verified Oct 2026· double-checked Oct 2026— every bit checked against openemv/emv-utils, proxmark3 and binaryfoo
What the Application Usage Control (9F07) restricts
The Application Usage Control (AUC), EMV tag 9F07, is a 2-byte bitmap of issuer rules describing where and how a card may be used. The issuer personalises it onto the card, and the terminal checks it during processing to decide whether the transaction type and location are permitted — for example, blocking an ATM withdrawal on a card issued for purchases only, or refusing an international transaction on a domestic-only product.
Reading the flags
Byte 1 holds three "domestic / international" pairs — cash, goods and services — then "valid at ATMs" and "valid at terminals other than ATMs". Byte 2 holds domestic and international cashback; its other six bits are reserved. The terminal checks the AUC during processing restrictions (EMV Book 3 §10.4.2): the ATM bits against its own terminal type, and, when the card carries an Issuer Country Code, the domestic or international bit for the transaction type depending on whether the issuer and terminal countries match. A mismatch — say, the AUC permits domestic cash only while the terminal country differs from the issuer country — sets "Requested service not allowed for card product" in the TVR (byte 2 bit 5), which is a frequent root cause of otherwise puzzling declines.
Common questions
A cash withdrawal was declined but purchases work — why?
Check the AUC first: with the cash bits (or "valid at ATMs") clear, the card is not allowed cash access whatever the balance or limits. The terminal records that as "Requested service not allowed for card product" in the TVR; if that bit is clear, the decline came from somewhere else.
Does the AUC stop a transaction on its own?
Indirectly. The AUC drives a TVR flag; the actual accept/decline then comes from comparing the TVR against the terminal and issuer action codes.
Bit definitions follow EMV 4.4 Book 3 Annex C2. All checks run locally in your browser.