3DSA Bulletin nº 13: Expiration of a 3DS Letter of Approval

EMV® 3-D Secure Approval Bulletin No. 13 3rd Edition May 2024 Expiration of a 3DS Letter of Approval

Applicability

This approval bulletin applies to EMV® 3-D Secure (3DS) product approval process. Related specification documents

• EMV 3-D Secure Approval – Administrative Process latest version
• EMV 3-D Secure Approval – Approval Bulletin 25
• EMV 3-D Secure - Implementation Conformance Statement latest version
• EMV 3-D Secure - Protocol and Core Functions Specification version 2.1.0, 2.2.0, 2.3.1
• EMV 3-D Secure - Specification Bulletin No. 255 - EMV 3-D Secure Specification Version Configuration

Effective Date

Immediately

Description

Impact of the Product Expiration As documented in the 3DS Approval Administrative Process, a 3DS Letter of Approval (LOA) is a written statement that documents the decision of EMVCo that a specified 3DS product has demonstrated sufficient compliance to the EMV 3DS Specifications and Specification Bulletins on the date of testing. An LOA includes a unique Approval/Reference Number for the 3DS product. The LOA also references the Implementation Conformance Statement (ICS) that has been submitted at the beginning of the approval process and that uniquely identify the product and its version. As documented in the Protocol and Core 3DS Specifications, DS components check that SDK, ACS or 3DS Server components involved in a transaction have a valid Approval/Reference Number. Otherwise, DS components return an error message. An LOA that is granted to a 3DS product is valid for 2 years. Once the LOA of a product is expired, it is removed from the list of approved 3DS products on the EMVCo website. Directory Server operators are also notified on such change and may reject transactions per 3DS specification. EMVCo does not provide any extension for expiring LOAs except for use cases described in the 3DS Approval Bulletin No. 25. However, it is up to the DS operator or Payment System to determine whether an expired 3DS product can continue to operate without a valid LOA. Note that an email reminder is automatically sent by EMVCo to the product providers 6 months before the expiration of their product. It is the Product providers responsibility to ensure that their contact information is still accurate with EMVCo. Please contact the 3DS Secretariat at 3ds_approval@emvco.com to report any change.

Product Re-Approval and Update of Projects in the Field Before the expiration of a product LOA, EMVCo highly recommends performing a re-approval of the product and to update the deployments in the field with the new version of product to avoid transactions being rejected. During a re-approval, the product will be tested against the latest Test Plan that will implement the latest 3DS Specification Bulletins of the target protocol version. Therefore, at minimum, the expiring product will have to be updated to support the latest 3DS Specification Bulletins. The exact same process as for the approval of the initial product will apply with the existing EMVCo product provider registration. Therefore, pre-compliance testing, submission of the Implementation Conformance Statement (ICS), compliance testing, submission of the Request for Approval (RFA), submission of the test report and payment of the approval fees will apply. The approval process may take time before testing is completed and the LOA can be delivered. For this reason, EMVCo recommends beginning the re-approval of a product at least 2 months before its expiration and to reach out to the applicable DS operator(s) or payment system(s) on the potential gap of validity of the 3DS LOA of the expiring product. For additional questions, please submit a query via EMVCo’s Query System or to our 3DS Secretariat.

Legal Notice

This document summarizes EMVCo’s present plans for evaluation services and related policies and is subject to change by EMVCo at any time. This document does not create any binding obligations upon EMVCo or any third party regarding the subject matter of this document, which obligations will exist, if at all, only to the extent set forth in separate written agreements executed by EMVCo or such third parties. In the absence of such a written agreement, no product provider, test laboratory or any other third party should rely on this document, and EMVCo shall not be liable for any such reliance. No product provider, test laboratory or other third party may refer to a product, service or facility as EMVCo approved, in form or in substance, nor otherwise state or imply that EMVCo (or any agent of EMVCo) has in whole or part approved a product provider, test laboratory or other third party or its products, services, or facilities, except to the extent and subject to the terms, conditions and restrictions expressly set forth in a written agreement with EMVCo, or in an approval letter, compliance certificate or similar document issued by EMVCo. All other references to EMVCo approval are strictly prohibited by EMVCo. Under no circumstances should EMVCo approvals, when granted, be construed to imply any endorsement or warranty regarding the security, functionality, quality, or performance of any particular product or service, and no party shall state or imply anything to the contrary. EMVCo specifically disclaims any and all representations and warranties with respect to products that have received evaluations or approvals, and to the evaluation process generally, including, without limitation, any implied warranties of merchantability, fitness for purpose or non-infringement. All warranties, rights and remedies relating to products and services that have undergone evaluation by EMVCo are provided solely by the parties selling or otherwise providing such products or services, and not by EMVCo, and EMVCo will have no liability whatsoever in connection with such products and services. This document is provided "AS IS" without warranties of any kind, and EMVCo neither assumes nor accepts any liability for any errors or omissions contained in this document. EMVCO DISCLAIMS ALL REPRESENTATIONS AND WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT, AS TO THIS DOCUMENT. EMVCo makes no representations or warranties with respect to intellectual property rights of any third parties in or in relation to this document. EMVCo undertakes no responsibility to determine whether any implementation of this document may violate, infringe, or otherwise exercise the patent, copyright, trademark, trade secret, know-how, or other intellectual property rights of third parties, and thus any person who implements any part of this document should consult an intellectual property attorney before any such implementation. Without limiting the foregoing, this document may provide for the use of public key encryption and other technology, which may be the subject matter of patents in several countries. Any party seeking to implement this document is solely responsible for determining whether its activities require a license to any such technology, including for patents on public key encryption technology. EMVCo shall not be liable under any theory for any party's infringement of any intellectual property rights in connection with this document.