CTQ Decoder
Decode the Card Transaction Qualifiers (tag 9F6C) — the 2-byte bitmap the card returns instructing the terminal on its contactless requirements. Tag 9F6C is kernel-specific: pick Visa (Kernel 3) or UnionPay (Kernel 7).
Tag 9F6C is kernel-specific. Visa contactless (Kernel 3) layout per EMVCo Book C-3 Annex A.2. Amex, JCB and Discover do not use 9F6C. In Kernel 2 (Mastercard) data, 9F6C is the Mag-stripe Application Version Number (Card), typically 0001 — not a CTQ.
What the Card Transaction Qualifiers (9F6C) do
The Card Transaction Qualifiers (CTQ), EMV tag 9F6C, is the card's reply to the terminal's TTQ. Where the TTQ says what the reader can and will do, the 2-byte CTQ tells the reader what the card requires for this specific tap: whether online PIN or signature must be collected, whether the transaction should go online if offline data authentication fails, and whether a consumer-device CVM (a phone unlock or biometric) was already performed.
The card returns the CTQ in the GPO response during a Visa qVSDC transaction. The reader then reconciles it with its own TTQ capabilities — if the CTQ demands a CVM the terminal cannot perform, the tap either falls back or declines.
Reading the two bytes
Byte 1 carries the actionable requirements — "Online PIN required", "Signature required", "Go online if ODA fails", "Switch interface if ODA fails", "Go online if application expired" and the cash / cashback interface switches; bit 1 is RFU in Book C-3 (Visa's VCPS Supplemental Requirements 2.2 use it for "Not valid for contactless ATM transactions" — single source). Byte 2 is largely reserved: bit 8 is "Consumer device CVM performed" and bit 7 "Card supports issuer update processing"; the rest is RFU and is flagged if set. For UnionPay (Kernel 7), the only source we have (openemv/emv-utils, citing Book C-7 Annex A) gives every bit the same meaning as Book C-3. In Kernel 2 (Mastercard) data, tag 9F6C is not a CTQ at all but the Mag-stripe Application Version Number (Card), typically 0001.
Common questions
The phone was unlocked with Face ID — why no PIN prompt?
The card sets the "CDCVM performed" bit in the CTQ, telling the terminal cardholder verification already happened on the device, so no further CVM is requested.
How is the CTQ different from the TTQ?
They are a request/response pair: the terminal offers capabilities in the TTQ (9F66); the card answers with its requirements in the CTQ (9F6C). Decode both together to understand a contactless decision.
Bit definitions follow EMVCo Book C-3 Annex A.2 (Visa/Kernel 3) and Book C-7 Annex A (UnionPay/Kernel 7). Decoding runs entirely in your browser.