PCI Watch

Tracking changes across the Payment Card Industry

SB n°230 Terminal Information to Enhance Contactless Application Selection

v2.0 Specification Bulletins
ContactlessMobile Acceptance DeviceNFC Consumer Device

EMV<sup>®</sup> Specification Bulletin No. 230 Second Edition February 2022 Terminal Information to Enhance Contactless Application Selection This Specification Bulletin updates the EMV Contactless Specifications for Payment Systems to allow the contactless terminal to provide terminal information to the card, which the card may then use to adjust the list of applications used for Application Selection. The 2nd edition of this Specification Bulletin:

  • Adds the requirement that if the terminal detects the Terminal Categories Supported List or SDOL are incorrectly formatted, the terminal shall discard the incorrectly formatted data object(s) and continue processing the transaction.
  • Clarifies that, in addition to the data objects explicitly listed for the SDOL, the terminal may recognize and be able to provide values for other data objects as requested in the SDOL.
  • Clarifies that construction of the SDOL requested data is performed according to the rules in EMV 4.3 Book 3 Section 5.4, Rules for Using a Data Object List (DOL). Changes made in the 2nd edition of this Specification Bulletin are shown using strikethroughs and red text.

Applicability

This Draft Specification Bulletin applies to:

  • EMV Contactless Specifications for Payment Systems, Book A Architecture and General Requirements, version 2.8, April 2019
  • EMV Contactless Specifications for Payment Systems, Book B Entry Point Specification, version 2.8, April 2019 As the EMV Contactless Specifications for Payment Systems versions 2.9 and version 2.10 already incorporated the changes from the first edition of this Specification Bulletin, only the changes added in this 2nd edition of the Draft Specification Bulletin are applicable to those newer versions of the specifications:
  • EMV Contactless Specifications for Payment Systems, Book A Architecture and General Requirements, version 2.9, March 2020, and version 2.10, March 2021
  • EMV Contactless Specifications for Payment Systems, Book B Entry Point Specification, version 2.9, March 2020, and version 2.10, March 2021

Related Documents

None Effective Date 1st January, 2023

Description

This bulletin updates the EMV Contactless Specifications for Payment Systems, adding optional new functionality allowing the contactless terminal to provide terminal information to the card, which the card may then use to adjust the list of applications used for Application Selection. © 2021

countries.

Specification Changes Book A In Section 5.8.2, after the 2nd paragraph, add the following note: Note: Cards may indicate in the PPSE response via inclusion of the Terminal Categories Supported List (tag '9F3E') and/or Selection Data Object List (tag '9F3F') that additional terminal information be provided by Entry Point. This terminal information may be used by the card to adjust the list of applications used for application selection. Entry Point implementations that support the SEND POI INFORMATION (SPI) command issue the command to send the requested terminal information to the card, and the card response is the list of applications to use for application selection. Book B In Section 3, replace Figure 3-1 with the following figure: © 2021-2022

countries.

In Section 3.3.1, replace Table 3-2 with the following table: '6F' FCI Template '84' DF Name (‘2PAY.SYS.DDF01’) 'A5' FCI Proprietary Template 'BF0C' FCI Issuer Discretionary Data '61' Directory Entry '4F' ADF Name '50' Application Label '87' Application Priority Indicator (see Table 3-3) '9F2A' Kernel Identifier (see Table 3-4 and Table 3-5) '9F29' Extended Selection (see Table A-1on

) ‘9F0A’ Application Selection Registered Proprietary Data (ASRPD, see requirement 3.3.1.2) '61' Directory Entry '4F' ADF Name '50' Application Label '87' Application Priority Indicator '9F2A' Kernel Identifier '9F29' Extended Selection ‘9F0A’ Application Selection Registered Proprietary Data (ASRPD, see requirement 3.3.1.2) '61' Directory Entry '4F' ADF Name '50' Application Label '87' Application Priority Indicator '9F2A' Kernel Identifier '9F29' Extended Selection ‘9F0A’ Application Selection Registered Proprietary Data (ASRPD, see requirement 3.3.1.2) '9F3E' Terminal Categories Supported List '9F3F' Selection Data Object List (SDOL) M O6 M M M M O C7 C8 C9 O O M10 O10 C7,10 C8,10 C9,10 O O M10 O10 C7,10 C8,10 C9,10 O O O © 2021-2022

countries.

After Section 3.3.1, add the following new section: 3.3.1a Terminal Information During Application Selection After the SELECT (PPSE) response is received by Entry Point, an additional phase of the application selection process may be performed where terminal information is provided to the card, allowing the card to send back a different list of supported applications to be used in the application selection process. Entry Point support for this additional phase of the application selection process, including support of the SEND POI INFORMATION command and terminal data objects used, is implementation optional. For example, the FCI of the PPSE returns a list of 3 applications, but after receiving terminal information that indicates the terminal is a transit device, the card may determine that one specific application is preferred for transit use and respond with only that one application for application selection. The card requests terminal information during application selection by including one or more of the following data objects in the FCI Issuer Discretionary Data (tag 'BF0C') of the PPSE response message:

  • Terminal Categories Supported List (tag '9F3E')
  • Selection Data Object List (SDOL, tag '9F3F') If the terminal detects that the Terminal Categories Supported List or the SDOL is incorrectly formatted, the terminal shall discard the incorrectly formatted data object(s) and continue processing. Upon receipt of the SELECT (PPSE) response, Entry Point issues the SEND POI INFORMATION (SPI) command when either of the following occurs:
  • If the Terminal Category (POI Information ID '0001') of the terminal is on the Terminal Categories Supported List.
  • If the SDOL is returned by the card. Entry Point sends the SPI command in order to provide the requested data to the card. The SPI command is defined in Annex C.1. The card responds to the SPI command with an FCI containing the list of applications to use for application selection. The list of applications in this FCI may be the same or may be different from the list of applications previously returned in the FCI of the SELECT (PPSE) response. Card determination of which applications to return in the FCI of the SPI response message is outside the scope of this specification. In Section 3.3.2, add the following bullet as the new fourth bullet:
  • Terminal information may be requested by the card, causing an additional commandresponse message to be sent. © 2021-2022 countries. In Section 3.3.2, replace Figure 3-2 with the following figure: Contactless Card Reader SELECT PPSE List of ADF names + kernel IDs SEND POI INFORMATION (SPI) List of ADF names + kernel IDs SELECT AID FCI Replace requirement 3.3.2.3 with the following new requirements:

3.3.2.3 If Entry Point receives SW1 SW2 = '9000' in response to the SELECT (PPSE) command, then: - If either of the following is true: - the Terminal Category (POI Information ID '0001') of the terminal is on the Terminal Categories Supported List (tag '9F3E') returned in the FCI - or the SDOL (tag '9F3F') is returned in the FCI, then Entry Point shall proceed to Step 1a. Otherwise, Entry Point shall proceed to Step 2. Otherwise, Entry Point shall add no Combinations to the Candidate List and shall proceed to Step 3. Step 1a 3.3.2.3a 3.3.2.3b Entry Point shall send the SPI command to the card. The SPI command is defined in Annex C.1. If Entry Point receives SW1 SW2 = '9000' in response to the SPI command, then Entry Point shall proceed to Step 2 and shall use the FCI returned in the SPI response to perform application selection. Otherwise, Entry Point shall add no Combinations to the Candidate List and shall proceed to Step 3. © 2021-2022

countries.

In Annex A, add the following new entries to Table A-1 Data Elements Dictionary: Name POI Information Description Contains information about the terminal and the acceptance environment. The value field of the POI Information data object has the following format: ID1 L1 V1 ID2 L2 V2… Where:

  • ID is a two-byte identifier whose context is limited to the POI Information data object. The IDs used in the POI Information data object are completely unrelated to IDs used in other data objects, such as the IDs used in the ASRPD.
  • L is the length of the value field coded in 1 byte (0 to 61).
  • V is the value field. Note that:
  • IDs are assigned by EMVCo and may only appear in the POI Information if they have been registered with EMVCo.
  • IDs have no structure. They are not tags according to BERTLV coding. See section A.1 for the list of POI Information IDs defined by EMV and used in this specification. Selection Data Object List (SDOL) Contains a list of terminal resident data objects (tags and lengths) needed by the card in processing the SEND POI INFORMATION (SPI) command. The SDOL can be used to request the following terminal data objects:
  • Amount, Authorised (Numeric) (tag '9F02')
  • POI Information (tag '8B')
  • Terminal Country Code (tag '9F1A')
  • Transaction Currency Code (tag '5F2A') Only the data objects explicitly listed above must be known and correct data object values provided by the terminal for the SDOL. The terminal may recognize and be able to provide the values for other data objects if requested via the SDOL, but that is not required. Source Entry Point Card Format b b Template — 'BF0C' Tag Length '8B' var. up to 64 '9F3F' var. © 2021 countries. Terminal Categories Supported List Contains a list of one or more terminal categories supported by the Card b card. Bytes 1-2: Terminal Category 1 Bytes 3-4: Terminal Category 2 … Plus two bytes for each additional Terminal Category The Terminal Categories supported by this specification are defined in Table A-2, Terminal Category (POI Information ID '0001'). 'BF0C' '9F3E' var. At the end of Annex A, add the following new sub-annex: A.1 EMV Defined POI Information Identifiers This section lists the EMV defined IDs for the POI Information data object. This section does not include any IDs registered with EMVCo but whose contents are not defined by EMV. Table A-2: EMV Defined POI Information Identifiers (IDs) POI Inform ation ID '0001' Name Terminal Category Description Format Length Indicates the terminal category to which the terminal belongs. For terminals that do not belong b 2 to a terminal category listed below, the Terminal Category ID L V is not present in the POI Information data object. '00 01' = Transit gate; the terminal at the entrance or exit to a transit network (e.g., a metro gate) or vehicle (e.g., a bus) that is used to accept cards for transit network access. This category does not include terminals present in transit acceptance environments but that do not control access to the transit network (e.g., unattended ticketing kiosks). '00 02' = Loyalty; the terminal facilitates a loyalty program using POI Information. All other values are RFU for this specification. © 2021-2022 countries. After Annex B, add the following new annex: Annex C Commands This annex lists the new command(s) that are added by this specification. C.1 SEND POI INFORMATION (SPI) Command-Response APDUs C.1.1 Definition and Scope The SPI command sends information about the terminal to the card during the application selection process. Cards may use this terminal information to change the list of applications they return to the terminal, as some applications may be more or less appropriate depending on the terminal to which the card is being presented. Cards indicate support for this functionality by returning either or both the Terminal Categories Supported List (tag '9F3E') and SDOL (tag '9F3F') data objects in the FCI of the SELECT of the PPSE. The response from the card consists of returning an FCI. C.1.2 Command Message The SPI command message is coded according to Table C-1: Table C-1: SPI Command Message Code CLA INS P1 P2 Lc Data Le Value '80' '1A' '00'; all other values are RFU '00'; all other values are RFU Number of data bytes Command template See section C.1.3 for details '00' © 2021 countries. C.1.3 Data Field Sent in the Command Message The data field of the command message is the command template tag ('83') and length, followed by the following data:
  • If the SDOL is provided by the card, data object values according to the SDOL provided by the card. DOL coding is as defined in EMV 4.3 Book 3 Section 5.4 and the construction of the SDOL requested data is performed according to the rules in that section.
  • If the Terminal Category (POI Information ID '0001') of the terminal is on the Terminal Categories Supported List (tag '9F3E') returned by the card in the FCI of the SELECT (PPSE) response, then the POI Information ID, length, and value of the following data objects in the POI Information are returned:
  • (Required) the Terminal Category of the terminal (ID '0001')
  • (Optional) any other IDs in the POI Information IDs*. *In this version of the specification, EMV does not define any additional POI Information IDs returned to supplement the current terminal categories. However, proprietary programs may choose to include supplemental information for specific terminal categories additional POI Information IDs when these IDs are assigned by EMV in the future. Figure C-1 illustrates the SPI command message data field. Solid lines indicate the data is always included in the data field and dashed lines indicate the data is conditionally or optionally included in the data field, as defined above. Figure C-1: SPI Command Message Data Field '83' Length SDOL requested data object values POI Information data objects of Terminal Category '0001 02 xxxx' (ID1 L1 V1) Additional POI Information data objects (ID2 L2 V2 … IDn Ln Vn) C.1.4 Data Field Returned in the Response Message The data field of the response message contains the FCI as shown in Table 3-2, except that the Terminal Categories Supported List (tag '9F3E') and SDOL (tag '9F3F') data objects are not included. Terminals shall ignore these two data objects if they are included in the FCI of the SPI response message. The applications listed in the FCI may be the same as the applications previously returned in the FCI of the SELECT of the PPSE, or may be different applications based on the terminal information received by the card in the SPI command. C.1.5 Processing State Returned in the Response Message '9000' indicates a successful execution of the command. © 2021-2022 countries. © 2021-2022 countries.

Legal Notice

The EMV<sup>®</sup> Specifications are provided "AS IS" without warranties of any kind, and EMVCo neither assumes nor accepts any liability for any errors or omissions contained in these Specifications. EMVCO DISCLAIMS ALL REPRESENTATIONS AND WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT, AS TO THESE SPECIFICATIONS. EMVCo makes no representations or warranties with respect to intellectual property rights of any third parties in or in relation to the Specifications. EMVCo undertakes no responsibility to determine whether any implementation of the EMV<sup>®</sup> Specifications may violate, infringe, or otherwise exercise the patent, copyright, trademark, trade secret, know-how, or other intellectual property rights of third parties, and thus any person who implements any part of the EMV<sup>®</sup> Specifications should consult an intellectual property attorney before any such implementation. Without limiting the foregoing, the Specifications may provide for the use of public key encryption and other technology, which may be the subject matter of patents in several countries. Any party seeking to implement these Specifications is solely responsible for determining whether its activities require a license to any such technology, including for patents on public key encryption technology. EMVCo shall not be liable under any theory for any party’s infringement of any intellectual property rights in connection with the EMV<sup>®</sup> Specifications © 2021-2022

countries.