PCI Watch

Tracking changes across the Payment Card Industry

3DSA Bulletin nº 25: Update of the 3DS Approval Process when Re-Approving a 3DS Product

v2.0 Type Approval Bulletins
3-D Secure

EMV® 3-D Secure Approval Bulletin No. 25 Second Edition May 2025 Update of the 3DS Approval Process when Re-Approving a 3DS Product

Applicability

This approval bulletin applies to the approval process for the EMV® 3-D Secure (3DS) Products.

Related Documents

  • EMV 3-D Secure Approval – Administrative Process – Latest version
  • EMV 3-D Secure Request For Approval Form - Version 1.6 or higher
  • EMV 3-D Secure Implementation Conformance Statement - Latest version
  • EMV 3-D Secure Approval Bulletin No 01 - 6th Edition
  • EMV 3-D Secure Approval Bulletin No 15 - All editions
  • EMV 3-D Secure Approval Bulletin No 05 - Latest edition
  • EMV 3-D Secure Specification Bulletin No. 255 - EMV 3-D Secure Specification Version Configuration - Latest Edition
  • EMV 3-D Secure Version Number Management Protocol Version 2.3.0 & above - Latest version

Effective Date

June 2nd 2025

Description

Transitioning from an expiring Letter of Approval (LOA) Reference Number to a new one requires distributing the LOA Reference Numbers to multiple parties and managing the re-approval with Payment Systems. This can be complex and time-consuming for Product Providers especially when transitioning to the most recent Protocol Version. In order to ease this transition, the 3DS approval process has introduced in 2024 the possibility to obtain a one-time 6-month extension for the LOA Reference Number of an expiring 3DS Product when the new replacement 3DS Product has obtained a LOA. This applies:

  • If the expiring LOA is 2.2 and the new LOA is 2.2.
  • If the expiring LOA is 2.3 and the new LOA is 2.3.
  • If the expiring LOA is 2.2 and the new LOA is 2.3. The LOA Reference Number 6-month extension described above was initially subject to a fee, but EMVCo will no longer charge a fee. Conditions of Eligibility The LOA Reference Number extension process only applies if the new replacement 3DS Product:
  • Is for the same 3DS component as the expiring 3DS Product.
  • Is from the same Product Provider as the expiring 3DS Product.
  • Supports the same or more Implementation Conformance Statement (ICS) options and features as the expiring 3DS Product.
  • Not applicable for a 3DS Product LOA that has expired before the issuance of the new LOA. Applicable Process The process to obtain a LOA Reference Number extension is described below:
  • The Product Provider shall select the option to extend the expiring LOA Reference Number in the Request for Approval (RFA) submitted for the new 3DS Product and shall indicate the Reference Number of the expiring LOA. Note: It will be the responsibility of the Product Provider to ensure that their current 3DS Product LOA will not expire before the issuance of their new LOA.
  • EMVCo will prepare the invoice for the approval fee of the new 3DS Product.
  • Upon payment of the approval fee and successful review of the submitted test report for the new 3DS Product (expiring 3DS Product doesn’t require any document (re)submission), the LOA of the expiring 3DS Product will benefit from a 6-month extension.
  • An updated Letter of Approval will be released for the expiring 3DS Product (In addition to the LOA for the new Product) and the EMVCo website will be updated accordingly for both products. The above process will be documented in the next version of 3DS Approval Administrative Process, but it applies immediately. For additional information on the LOA Reference Number extension process, please contact EMVCo 3DS Secretariat.

Legal Notice

This document summarizes EMVCo’s present plans for evaluation services and related policies and is subject to change by EMVCo at any time. This document does not create any binding obligations upon EMVCo or any third party regarding the subject matter of this document, which obligations will exist, if at all, only to the extent set forth in separate written agreements executed by EMVCo or such third parties. In the absence of such a written agreement, no product provider, test laboratory or any other third party should rely on this document, and EMVCo shall not be liable for any such reliance. No product provider, test laboratory or other third party may refer to a product, service or facility as EMVCo approved, in form or in substance, nor otherwise state or imply that EMVCo (or any agent of EMVCo) has in whole or part approved a product provider, test laboratory or other third party or its products, services, or facilities, except to the extent and subject to the terms, conditions and restrictions expressly set forth in a written agreement with EMVCo, or in an approval letter, compliance certificate or similar document issued by EMVCo. All other references to EMVCo approval are strictly prohibited by EMVCo. Under no circumstances should EMVCo approvals, when granted, be construed to imply any endorsement or warranty regarding the security, functionality, quality, or performance of any particular product or service, and no party shall state or imply anything to the contrary. EMVCo specifically disclaims any and all representations and warranties with respect to products that have received evaluations or approvals, and to the evaluation process generally, including, without limitation, any implied warranties of merchantability, fitness for purpose or non-infringement. All warranties, rights and remedies relating to products and services that have undergone evaluation by EMVCo are provided solely by the parties selling or otherwise providing such products or services, and not by EMVCo, and EMVCo will have no liability whatsoever in connection with such products and services. This document is provided "AS IS" without warranties of any kind, and EMVCo neither assumes nor accepts any liability for any errors or omissions contained in this document. EMVCO DISCLAIMS ALL REPRESENTATIONS AND WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT, AS TO THIS DOCUMENT. EMVCo makes no representations or warranties with respect to intellectual property rights of any third parties in or in relation to this document. EMVCo undertakes no responsibility to determine whether any implementation of this document may violate, infringe, or otherwise exercise the patent, copyright, trademark, trade secret, know-how, or other intellectual property rights of third parties, and thus any person who implements any part of this document should consult an intellectual property attorney before any such implementation. Without limiting the foregoing, this document may provide for the use of public key encryption and other technology, which may be the subject matter of patents in several countries. Any party seeking to implement this document is solely responsible for determining whether its activities require a license to any such technology, including for patents on public key encryption technology. EMVCo shall not be liable under any theory for any party's infringement of any intellectual property rights in connection with this document.