EMV® 3-D Secure Approval – Directory Server Weekly File Format

EMV® 3-D Secure Approval Directory Server Weekly File Format Version 1.2 October 2025 © 2019-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® 3-D Secure Approval Directory Server Weekly File Format v1.2 Page i / iii Legal Notice This document is subject to change by EMVCo at any time. This document does not create any binding obligations upon EMVCo or any third party regarding the subject matter of this document, which obligations will exist, if at all, only to the extent set forth in separate written agreements executed by EMVCo or such third parties. In the absence of such a written agreement, no product provider, test laboratory or any other third party should rely on this document, and EMVCo shall not be liable for any such reliance. No product provider, test laboratory or other third party may refer to a product, service or facility as EMVCo approved, in form or in substance, nor otherwise state or imply that EMVCo (or any agent of EMVCo) has in whole or part approved a product provider, test laboratory or other third party or its products, services, or facilities, except to the extent and subject to the terms, conditions and restrictions expressly set forth in a written agreement with EMVCo, or in an approval letter, compliance certificate or similar document issued by EMVCo. All other references to EMVCo approval are strictly prohibited by EMVCo. Under no circumstances should EMVCo approvals, when granted, be construed to imply any endorsement or warranty regarding the security, functionality, quality, or performance of any particular product or service, and no party shall state or imply anything to the contrary. EMVCo specifically disclaims any and all representations and warranties with respect to products that have received evaluations or approvals, and to the evaluation process generally, including, without limitation, any implied warranties of merchantability, fitness for purpose or noninfringement. All warranties, rights and remedies relating to products and services that have undergone evaluation by EMVCo are provided solely by the parties selling or otherwise providing such products or services, and not by EMVCo, and EMVCo will have no liability whatsoever in connection with such products and services. This document is provided "AS IS" without warranties of any kind, and EMVCo neither assumes nor accepts any liability for any errors or omissions contained in this document. EMVCO DISCLAIMS ALL REPRESENTATIONS AND WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NONINFRINGEMENT, AS TO THIS DOCUMENT. EMVCo makes no representations or warranties with respect to intellectual property rights of any third parties in or in relation to this document. EMVCo undertakes no responsibility to determine whether any implementation of this document may violate, infringe, or otherwise exercise the patent, copyright, trademark, trade secret, know-how, or other intellectual property rights of third parties, and thus any person who implements any part of this document should consult an intellectual property attorney before any such implementation. Without limiting the foregoing, this document may provide for the use of public key encryption and other technology, which may be the subject matter of patents in several countries. Any party seeking to implement this document is solely responsible for determining whether its activities require a license to any such technology, including for patents on public key encryption technology. EMVCo shall not be liable under any theory for any party's infringement of any intellectual property rights in connection with this document. © 2019-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® 3-D Secure Approval Directory Server Weekly File Format v1.2 Page ii / iii Revision Log – Version 1.2 The following changes have been made to the document since the publication of Version 1.1b. Some of the numbering and cross references in this version have been updated to reflect changes introduced by the published bulletins. The numbering of existing requirements did not change, unless explicitly stated otherwise. Incorporated changes described in the following Specification and Administrative Updates: • Clarification of the impact to the DS file when a LOA is extended Other editorial changes: • Editorial Updates. © 2019-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® 3-D Secure Approval Directory Server Weekly File Format v1.2 Page iii / iii Contents 1 INTRODUCTION................................................................................................................... 1 1.1 Purpose..................................................................................................................... 1 1.2 Audience ................................................................................................................... 1 1.3 Normative Reference................................................................................................. 1 1.4 Definitions ................................................................................................................. 2 1.5 Notational Conventions ............................................................................................. 3 1.5.1 Abbreviations ................................................................................................. 3 2 PROCESS OVERVIEW ......................................................................................................... 4 2.1 Terminology............................................................................................................... 4 2.2 Eligible Recipients ..................................................................................................... 4 2.3 Directory Servers’s File Format ................................................................................ 4 3 APPENDIX .......................................................................................................................... 7 3.1 Detailed Description of the Fields .............................................................................. 7 3.2 Sample Files.............................................................................................................. 9 Tables Table 1-1: 3-D Secure Specifications .................................................................................... 1 Table 1-2: 3-D Secure Approval Documents ......................................................................... 2 Table 1.3: Definitions ............................................................................................................ 2 Table 1.4: Abbreviations ....................................................................................................... 3 © 2019-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® 3-D Secure Approval Directory Server Weekly File Format v1.2 1 Introduction Page 1 / 10 1.1 Purpose Product providers that successfully complete the EMV® 3-D Secure Approval process will receive a Letter of Approval (LOA). Product providers that are issued LOA will also have a corresponding reference number stored by the EMVCo Approval Secretariat. The process of distributing a weekly file with the list of all EMV 3DS Approved Products by the EMVCo Approval Secretariat to the Directory Server (DS) Product Providers or Directory Server operators is described in this document. 1.2 Audience This document is intended for DS providers and DS operators. 1.3 Normative Reference Ref. [PCF 3DS] [SDK 3DS] [SPLIT 3DS] [BRI_EXT] [VER 3DS] [SB 3DS] [SB 3DS 255] Table 1-1: 3-D Secure Specifications Document Title EMV® 3-D Secure Protocol and Core Functions Specification EMV® 3-D Secure SDK Specification EMV® 3-D Secure Split-SDK Specification EMV® 3-D Secure Bridging Message Extension EMV® 3DS Version Number Management - Protocol Version 2.3.0 & above EMV® 3-D Secure Specification Bulletins (SB Bulletins) EMV® 3-D Secure Specification Bulletins 255 – 3DS Specification Version Configuration Version Latest Available per Protocol Version Latest Available per Protocol Version Latest Available All Latest Available All Latest Available Distribution Publicly Available Publicly Available Publicly Available Publicly Available Publicly Available Publicly Available Publicly Available © 2019-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® 3-D Secure Approval Directory Server Weekly File Format v1.2 Page 2 / 10 Ref. [AP 3DS] [AB 3DS 20] Table 1-2: 3-D Secure Approval Documents Document Title EMV® 3-D Secure Approval Administrative Process EMV® 3-D Secure Approval Bulletin n°20 – LOA Reference Numbers Version Latest Available Distribution Publicly Available Latest Available Publicly Available 1.4 Definitions Table 1.3 defines selected terms used in this document. Term 3DS Approval Bulletin 3DS Component Active/Activation Approval EMVCo EMVCo 3DS Approval Secretariat Letter of Approval Product Product Provider Table 1.3: Definitions Definition Public notification released to communicate updates to the 3-D Secure Approval Process (Test Plan activation date or process updates). A 3-D Secure Component that will be approved. There are four 3DS components: • 3DS SDK (Default-SDK or Split-SDK variants) • 3DS Server • Directory Server (DS) • Access Control Server (ACS) Refers to the condition that a Protocol Version, Test Plan version or a specific Test Plan Implementation is deployed on an EMVCo Recognised Test Platform and becomes available for Product Provider to execute. Acknowledgment by EMVCo that the specified Product has demonstrated sufficient compliance to the EMV Specifications for its stated purpose. The organization that manages, maintains, and enhances the EMV Specifications. The EMVCo entity that manages the 3-D Secure Approval process defined in [AP 3DS] and related documents. Written statement that documents the decision of EMVCo that a specified Product has demonstrated sufficient compliance to the applicable EMV specifications on the date of testing. A 3-D Secure component submitted for approval Entity submitting a 3-D Secure component for Approval. © 2019-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® 3-D Secure Approval Directory Server Weekly File Format v1.2 Page 3 / 10 Protocol Version Specification Bulletin Test Platform (or 3DS Test Platform) Protocol Version defines the interoperability between the 3DS Secure components. Protocol Version format is MAJOR.MINOR.PATCH and it is defined in [VER 3DS]. Notification released to communicate updates to the EMV specifications. An online test system that has been EMVCo recognised for 3DS testing. The Test Platform executes 3-D Secure test plans and test cases which System Under Test use for 3DS compliance approval. 1.5 Notational Conventions 1.5.1 Abbreviations The abbreviations listed in Table 1.4 are used in this document. Table 1.4: Abbreviations Abbreviation Description 3DS EMV 3-D Secure 3DSS 3DS Server DS Directory Server ACS Access Control Server ICS Implementation Conformance Statement LOA Letter of Approval SDK Software Development Kit © 2019-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® 3-D Secure Approval Directory Server Weekly File Format v1.2 2 Process Overview Page 4 / 10 2.1 Terminology A product can have multiple statuses and they are defined below: • Granted—A product granted a Letter of Approval • Revoked—A product where the Letter of Approval has been revoked • Expired—A product with an expired Letter of Approval • Declined—A product that was declined a Letter of Approval at the end of the Approval process 2.2 Eligible Recipients The EMVCo Secretariat provides the list of the EMV 3DS Approved Products to the Product Providers with a non-expired Letter of Approval for a Directory Server or to the operators of a Directory Server. Directory Servers Product Providers or Directory Servers operators shall subscribe to receive the list of approved EMV 3DS products on a weekly basis, by sending an email to 3DS_approval@emvco.com. The mail shall include the email addresses that will receive the list. Note: The list of approved EMV 3DS products is also available on the EMVCo website. 2.3 Directory Servers’s File Format This section describes the detailed contents of the file(s) that is provided to Directory Servers (DS). • File Contents o The file(s) contains list of products that have completed the EMV 3DS Approval process. It includes products that have been declined or approved for a Letter of Approval (LOA). It also includes products where the Letter of Approval is expired or revoked. o Only one record per LOA Reference number is included. If a LOA has been extended or has been updated to add the testing of a Message Extension for instance, the LOA record remains, and it is updated with the most recent information. o The file(s) contains the company name, contact details, product name, EMVCo LOA reference number, LOA validity (approval date and expiration date), current status of the LOA of the product, tested message extensions and Split-SDK variant. Note: Products with ongoing approval process are not included. © 2019-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® 3-D Secure Approval Directory Server Weekly File Format v1.2 Page 5 / 10 o All files include a column named “Weekly Status” indicating whether a record has been modified or added since the last file was received. Each week every product on the list has a status of: − N—Indicates a new product added to the list. Note that LOA extensions will be marked N since a new LOA is generated (with same LOA Approval Number). − C—Indicates if approval status has changed or typos have been corrected for an existing product. The typo changes concern: product name, product version, EMVCo Approval Number, LOA expiration date, LOA filename, tested message extensions. Any company and contact detail changes are out of scope − Blank otherwise—Indicates product present in last week’s file with no updates • File structure—There are four files provided in CSV format as listed below: o SDK products with status of Granted, Declined, Expired and Revoked (includes Default-SDK and Split-SDK variants) o 3DS Server products with status of Granted, Declined, Expired and Revoked o Access Control Servers (ACS) products with status of Granted, Declined, Expired and Revoked o DS products with status of Granted, Declined, Expired and Revoked Note: If there are no records present for a particular file then no file is sent for that 3DS component. • File Naming Convention—Format is 3DS_DIS_NNN _YYMMDD where: o 3DS = 3-D Secure o DIS = List recipient: Directory Server o NNN = Type of 3DS Component − SDK = 3DS Default-SDK or Split-SDK − SER = 3DS Server − DIS = Directory Server − ACS = 3DS Access Control Server o YYMMDD = Date list is created − Changes each week the list is distributed For example, a file named 3DS_DIS_SDK_230428 is a list of SDKs/Split-SDKs that were approved, expired, revoked or declined as of 28 April 2023. • File Format o Csv file o Separator is coma (‘,’) o Field value format: string (between "") o A field value that is not filled can either be represented by an empty string ("") or can be empty © 2019-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® 3-D Secure Approval Directory Server Weekly File Format v1.2 Page 6 / 10 • Delivery schedule — The DS file is provided by email to Directory Servers that subscribe to this list every Friday COB CET. © 2019-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® 3-D Secure Approval Directory Server Weekly File Format v1.2 3 Appendix 3.1 Detailed Description of the Fields Page 7 / 10 Field Name Company Primary contact Primary contact email Primary contact phone Address1 Address2 Address3 City ZipCode State Country Product details Approval Nb Valid from (*) Valid to (*) Filename Approval Status Weekly Status Field Description Company Name Name of the primary contact Email of the primary contact Phone number of the primary contact Product name and version as documented by the Product Provider in ICS LOA Reference Number (format defined in 3DSTG Approval Bulletin No 20 Effective Date of the LOA (DD-Mmm-YYYY) - Example: 21-Apr-2022 - Mmm codes: Jan, Feb, Mar, Apr, May, Jun, Jul, Aug, Sep, Oct, Nov, Dec Expiration Date of the LOA (DD-Mmm-YYYY) - Example: 13-Dec-2021 - Mmm codes: Jan, Feb, Mar, Apr, May, Jun, Jul, Aug, Sep, Oct, Nov, Dec File Name of the LOA pdf document available on EMVCo website Possible Values: Granted / Declined / Expired / Revoked (see 2.3) Possible Values: N / C / empty (see 2.3) © 2019-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® 3-D Secure Approval Directory Server Weekly File Format v1.2 Page 8 / 10 SPLIT-SDK Variant Possible Values: Shell / Native / Browser / empty Note: This field is only relevant for SDK file (3DS_DIS_SDK _YYMMDD file) when the 3DS component is a Split-SDK. For other 3DS components (ACS, 3DSS, DS, Default-SDK), this field is empty SPLIT-SDK Limited Possible Values: Yes / No / empty - Value set to Yes if the implementation is Limited - Value set to No if the implementation is Standard Note: This field is only relevant for SDK file (3DS_DIS_SDK _YYMMDD file) when the 3DS component is a SplitSDK/Native. For other 3DS components (ACS, 3DSS, DS, Default-SDK, Split-SDK/Shell, Split-SDK/Browser), this field is empty EXT Bridging/Recurring (**) Indicate if the component has been tested for Bridging Message Extension / Recurring data (see [BRI EXT] Possible Values: No / any combination of version(s) (v1.0|v2.0|…) - Example: v2.0|v3.0 EXT Bridging/Challenge (**) Indicate if the component has been tested for Bridging Message Extension / Challenge data (see [BRI EXT] Possible Values: No / any combination of version(s) (v1.0|v2.0|…) - Example: v3.0 EXT Bridging/Additional Indicate if the component has been tested for Bridging (**) Message Extension / Additional data (see [BRI EXT] Possible Values: No / any combination of version(s) (v1.0|v2.0|…) - Example: v2.0 EXT Bridging/fileURL (**) Indicate if the component has been tested for Bridging Message Extension / file URL data (see [BRI EXT] Possible Values: No / any combination of version(s) (v1.0|v2.0|…) - Example: v2.0|v3.0|v4.0 (*) In case of LOA extension (Per Approval Bulletin 25 for instance), the Effective Date of the LOA remains the same but the Expiration Date of the LOA is updated to the revised Expiration Date. (**) EXT Bridging / xxx fields will only be filled in the DS file when the testing of the Bridging Message Extension will be activated. Initially, they will be present but empty. Activation of the testing of the Bridging Message Extension will be communicated with specific Approval Bulletin. Note that the same format will be used in the future when the testing of other Message Extensions is supported. © 2019-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® 3-D Secure Approval Directory Server Weekly File Format v1.2 Page 9 / 10 3.2 Sample Files Two-records presented in the 3DS Server File (3DS_DIS_SER _YYMMDD file) "Company","Primary contact","Primary contact email","Primary contact phone","Address1","Address2","Address3","City","ZipCode","State","Country","Product details","Approval Nb","Valid from","Valid to","Filename","Approval Status","Weekly Status","SPLIT-SDK Variant","SPLIT-SDK Limited","EXT Bridging/Recurring","EXT Bridging/Challenge","EXT Bridging/Additional","EXT Bridging/fileURL" "Company A, Inc.","John Smith","jsmith@mycompanyA.com","1231234567","10 Street A","Suite 1",,"MyCityA","12345","MyStateA","MyCountryA","My 3DS Server A Version 1","3DS_LOA_SER_COMA_020200_00123","16-Oct-2022","10-Oct2024","3DS_LOA_SER_COMA_020200_00123_16Oct22.pdf","Granted","",,,,,, "Company B, Inc.","John Smith","jsmith@mycompanyB.com","9879876543","10 Street B","Suite 2",,"MyCityB","98765","MyStateB","MyCountryB","My 3DS Server B Version 1","3DS_LOA_SER_COMB_020301_00456","09-Mar-2023","02-Mar2025","3DS_LOA_SER_COMB_020301_00456_09Oct23.pdf","Granted","N",,,,,, Two-records presented in the SDK File (3DS_DIS_SDK _YYMMDD file) "Company","Primary contact","Primary contact email","Primary contact phone","Address1","Address2","Address3","City","ZipCode","State","Country","Product details","Approval Nb","Valid from","Valid to","Filename","Approval Status","Weekly Status","SPLIT-SDK Variant","SPLIT-SDK Limited","EXT Bridging/Recurring","EXT Bridging/Challenge","EXT Bridging/Additional","EXT Bridging/fileURL" "Company C, Inc.","John Smith","jsmith@mycompanyC.com","1234567890","10 Street C",,,"MyCityC","67890","MyStateC","MyCountryC","My 3DS SDK C Version 1","3DS_LOA_SDK_COMC_020301_00789","24-jan-2024","16-Jan2026","3DS_LOA_SDK_COMC_020301_00789_24Jan24.pdf","Granted","",,,"v2.0","v2.0","N o","No" "Company D, Inc.","John Smith","jsmith@mycompanyD.com","9876543210","10 Street D","Suite 3",,"MyCityD","43210","MyStateD","MyCountryD","My 3DS Split-SDK D Version 1","3DS_LOA_SPL_COMD_020301_00987","09-Sep-2024","08-Sep2026","3DS_LOA_SPL_COMD_020301_00987_09Sep24.pdf","Granted","N","Shell","Yes"," No","v2.0|v3.0","No","v2.0" © 2019-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® 3-D Secure Approval Directory Server Weekly File Format v1.2 Page 10 / 10 *** END OF DOCUMENT *** © 2019-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries.