WIXLIB

EMV Terminal Type ApprovalLevel 2 Administrative Process1Page 1 / 62IntroductionEMVCo, LLC (“EMVCo”) manages and maintains the EMV Integrated Circuit Card (ICC)Specifications for Payment Systems, hereinafter called the EMV Specifications.EMVCo established the terminal type approval process to create a limited mechanism to testcompliance with the EMV Specifications. Type Approval provides an increased level ofconfidence that interoperability and consistent logical behavior between compliantapplications have been achieved.EMVCo type approval testing is divided into two levels. The Level 1 type approval processtests compliance with electromechanical characteristics, logical interface, and transmissionprotocol requirements defined in part I of the EMV Specifications. Level 2 type approvaltests compliance with debit/credit application requirements defined in the remainder of theEMV Specifications.This document describes the administrative process used to have card acceptance devices(terminals) tested for compliance with EMV level 2 requirements. The document outlines thefundamental concepts upon which EMV type approval is based, provides a summary ofparticipating entities and their respective roles, and the detailed procedures by which asoftware provider can obtain EMVCo terminal level 2 type approval.1.1 AudienceThe target audience of this document is: Application Providers Laboratory Auditors(qualified to verify that laboratories comply with the EMVCo processesand procedures)(accredited to perform the type approval tests)Readers are reminded that type approval, when granted by EMVCo, shall not be construedas a warranty or representation of any sort, nor may it be relied upon by any party as anassurance of quality or functionality of any product or service. Please note the details of thelegal notice incorporated in the front of this document for important limitations on the scopeof type approval.1.2 Normative ReferencesThe following standards contain provisions that are referenced in this specification. Thelatest version including all published amendments shall apply unless a publication date isexplicitly stated. 2017 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV is aregistered trademark or trademark of EMVCo, LLC in the United States and other countries.

EMV Terminal Type ApprovalLevel 2 Administrative ProcessPage 2 / 621.2.1 Normative referencesRef.:DocumentIdentityDocument TitleVersionDoc.DateISO 9001/2ISO 9001/2QualityRequirements2ndedition1994ISO 10011ISO 10011Guidelines for Auditing QualitySystems — Part 1: Auditing1993August1993ISO/IECISO/IECGuide 2General Terms and TheirDefinitionsConcerningStandardization and RelatedActivities6thedition1991ISO DIS tories/GeneralRequirementsfortheCompetence of Testing andCalibration LaboratoriesAssurance1.2.2 EMV SpecificationsEMVCo, LLC (EMVCo) manages and maintains the EMV Integrated Circuit Card (ICC)Specifications for Payment Systems and related specifications. As used in this document,“EMV Specifications” denotes all documents listed in Table 2 1.EMV Specifications are publicly available on the EMVCo website: www.emvco.com.Table 1-2: EMV SpecificationsDocument TitleVersionEMV 4.2 ICC Specification for Payment SystemsCard SpecificationVersion 4.3, June 2011Terminal SpecificationVersion 4.3, June 2011Application SpecificationVersion 4.3, June 2011All applicable Specification Updates and ApplicationNotes to the documents above as published on theEMVCo websiteAs identified on the EMVCowebsiteEMVCo Type Approval – Terminal Level 2Test CasesLatest version availableEMV Terminal Type Approval Bulletin 185Latest version available 2017 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV is aregistered trademark or trademark of EMVCo, LLC in the United States and other countries.

EMV Terminal Type ApprovalLevel 2 Administrative ProcessPage 3 / 621.3 DefinitionsThe following terms are used in this specification:Table 1.4: List of termsAccreditationAnswer(ATR):toformal recognition by EMVCo that an auditor or testing laboratory iscompetent to carry out specific functions defined as defined byEMVCo type approval procedures.reset string of bytes sent by the ICC in response to the reset by theterminal. These bytes convey information to the terminal that definescertain characteristics of the communication to be establishedbetween the ICC and the terminal.Applicationa message sent from the IFD to the card or conversely. It mayprotocol data unit contain either a command message or a response message.(APDU):Auditor:independent, impartial entity that verifies test laboratory conformanceto EMVCo-defined type approval procedures.Baseline:For kernels capable of supporting multiple configurations, thebaseline is the primary configuration that will be fully tested during thetype approval process. The baseline shall be the configuration withthe most options enabled by default.Card:a payment card as defined by a payment system.Checksum:A vendor-generated value (minimum 4 bytes) for each applicationkernel, and configuration. The checksum must be a unique value foreach application kernel, , derived from the entire application kerneland any files associated. Another checksum must be also unique foreach configuration (in case of multiple configuration kernel) with theconfiguration features. The method or algorithm used for generatingthe checksum is left to the discretion of the vendor. For example, avendor may choose to implement SHA-1 or CRC. These values shallbe retrievable for each Applications Kernels, Software Modules orExternal Libraries when used by the Application kernel and this forcomparative purposes. Refer to annex B for more detail onChecksum defined rules.This checksum requirement applies to static kernels, configurablekernels, and the PIN pad change process. EMVCo expects thechecksum will provide a validation that a kernel application remainsunchanged from the test state through deployment.Command:a message that is sent by the terminal to the ICC to initiate an actionand solicit a response from the ICC.Compliance:see conformanceConformance:meeting all therequirementsDelta Testing:the difference between the test plan versions the product wasapproved against versus the current version of the test plan when theproduct is reaching its Renewal daterequirementsincludingimplementedoptional 2017 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV is aregistered trademark or trademark of EMVCo, LLC in the United States and other countries.

EMV Terminal Type ApprovalLevel 2 Administrative ProcessPage 4 / 62Device under test system, module, part, or component actually tested or to be tested.(DUT):Embossing:characters raised in relation to the front surface of a card.EMVCo:a Limited Liability Company established to maintain the EMVspecifications and administer type approval against thosespecifications.EMVapplication a software module, core, or library, forming part of an overall terminalkernel:application architecture, developed for exclusive support of the EMVdebit/credit functions and application requirements.Function:a process accomplished by one or more commands and resultantactions that are used to perform all or part of a transaction.Implementationconformancestatement (ICS):a form completed by the EMV application provider listing all optionalfunctions - as specified in the reference specification - supported inthe EMV application kernel.Implementationunder test (IUT):a virtual or abstract device, implementing the EMV specification, tobe submitted for testingIntegratedcard (ICC):circuit a card into which one or more integrated circuits are inserted toperform processing and memory functions.Integratedcircuit(s):electronic component(s) designed to perform processing and/ormemory functions.Interface(IFD):device part of a terminal into which the ICC is inserted, including suchmechanical and electrical devices that may be considered part of it.Interface(IFM):module a virtual or abstract device that contains the necessary hardware andsoftware to power the ICC and to support communication betweenthe terminal and the ICC up to the transport layer. The three mainfunctional components are the mechanical, electrical and logical ICCinterfacesIFMinteroperability:The minimum requirements as defined in EMV Specificationpermitting the ICC and the IFM to communicate with each other in apredictable and consistent manner.Internationalan international body that provides standards for financialOrganizationfor transactions and telecommunication messages. ISO works inStandardizationconjunction with the International Telecommunication Union (ITU) for(ISO):standards that affect telecommunications. ISO supports specifictechnical committees and work groups to promulgate and maintainfinancial service industry standardsLaboratory:Letteraccreditation:a facility that performs type approval testing in compliance withEMVCo defined requirements and procedures.of written statement that confirms a testing laboratory is performing typeapproval tests in conformance with the rules defined by EMVCo.Letter of approval:written statement that documents the decision of EMVCo that aspecified product type has demonstrated sufficient conformance tothe EMV Specification on the date of it being tested.Level 1 test:the execution of a defined set of electrical, mechanical, andcommunication protocol tests versus requirements described in part 1of the EMV 2000 Integrated Circuit Card Specification for Payment 2017 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV is aregistered trademark or trademark of EMVCo, LLC in the United States and other countries.

EMV Terminal Type ApprovalLevel 2 Administrative ProcessPage 5 / 62Systems.Magnetic stripe:the stripe on the physical card containing magnetically encodedinformation.Majormodification:technical change to or addition to the EMV application kernel thatimplies that the application provider cannot guarantee continuedconformance of the modified EMV application kernel with therequirements of the EMV specifications.Message:a string of bytes sent by the terminal to the card or vice versa,excluding transmission-control characters.Minormodification:technical change to the functionality of the EMV application kernelthat does not affect the functionality of the application kernel withrespect to the requirements of the EMV specifications.MultipleConfigurationKernel:an application kernel capable of supporting multiple pre-definedfunctional configurations without requiring major modifications

2.5.3 Clarification that Baseline configuration is the configuration with the most activated options - Renewal testing limited to delta testing (no more regression testing) 2.7.6 Clarification of Internal PIN Pad submission 2.11.1 Test Template usage clarification for MCK submission 4.2.3 Sample Management