FAQ: 3-D Secure – Testing Questions

EMV® 3-D Secure—Testing FAQs General Questions 1. Is there a testing program for EMV 3-D Secure Product approvals? Yes. EMVCo supports the functional testing of EMV 3-D Secure (3DS) Products to confirm that they are compliant to the EMV 3-D Secure Protocol and Core Functions Specification. A detailed description of the EMVCo 3DS Approval Process can be found within the following URL: EMV 3-D Secure Approval Processes | EMVCo. Additionally, the PCI Security Standards Council will use the 3DS functional specification created by EMVCo, to deliver data security requirements, testing procedures, assessor training and reporting templates to address the environmental security. A list of PCI 3DS security documents can be found within the following URL (use filter by “3DS”): https://www.pcisecuritystandards.org/document_library 2. What Products are supported by the EMVCo 3DS Product Approval Process? The EMVCo 3DS Approval Process applies to the 3DS Product components listed below: - 3DS SDK, 3DS Default-SDK, 3DS Split-SDK - 3DS Access Control Server (ACS) - 3DS Server - 3DS Directory Server (DS) 3. Where can I find information about EMVCo 3DS Testing? The complete EMVCo 3DS approval process can be found in the EMVCo 3-D Secure Approval Administrative Process document. This document is available for download on the EMVCo website by selecting the 3-D Secure Admin Process link found within the following URL: EMV 3-D Secure Approval Processes | EMVCo. 4. What does the EMV 3DS Approval Administrative Process describe? The EMV 3-D Secure Approval - Administrative Process, describes the 3-D Secure Approval process and also describes the forms to be completed by all parties involved in the process. 5. Where can I locate the forms described in the EMV 3DS Approval Administrative Process document? The forms described in the EMV 3-D Secure Approval - Administrative Process document can be found on the EMVCo website by following each link (Registration form, Implementation Conformance Statement [ICS] form and Request for Approval form) found within the following URL: EMV 3-D Secure Approval Processes | EMVCo. © 2022-2025 EMVCo, LLC. All rights reserved Page 1 6. Where can I ask questions about EMVCo 3DS Testing? There are several communication channels available for inquiries. The ‘EMVCo public queries’ is the preferred channel. A link can be found within the following URL: Contact EMVCo | EMVCo. For more detailed questions we recommend that you become an EMVCo Subscriber or an EMVCo Associate. Subscriber or Associate registration can be made from the following URL: Ways to Participate | EMVCo. For any questions during the 3DS testing phase, please contact your 3DS Test Laboratory and/or 3DS Test Platform Provider. 7. How do I register for 3DS Testing? Please visit the following URL for a quick start guide on how to begin the registration process: EMV 3-D Secure Approval Processes | EMVCo. The online Registration Form can be accessed within the following URL: https://www.emvco.com/product-provider-registration/. 8. Do the fees described in the EMV 3DS Product Approval Fees bulletin include 3DS Test Laboratory or 3DS Test Platform fees? No. The EMV 3-D Secure Approval Bulletin No. 001 (Product Approval Fees) available here describes EMVCo’s fees for the EMV 3DS Approval Administrative Process for Product Providers. Other fees would be described by the 3DS Test Laboratory and/or 3DS Test Platform Provider of your choice. EMVCo does not regulate or publish these fees. Please contact your preferred 3DS Test Laboratory and/or 3DS Test Platform Provider for more details regarding their fees and services. Any other cost(s) associated with the 3DS Product Providers development of their 3DS Product is out of scope for EMVCo. 9. What happens after my EMVCo 3DS Testing is done? When 3DS Compliance Testing is performed successfully, the 3DS Product Provider requests the approval of the 3DS Product(s) and at that time pays the corresponding fees for the approval to EMVCo. The 3DS Laboratory, on behalf of the 3DS Product Provider, then submits the Test Report to the EMVCo 3DS Approval Secretariat for review and subsequent approval. EMVCo will then issue a 3DS Letter of Approval (3DS LOA) to the 3DS Product Provider, and adds the 3DS Product Provider’s Product to the EMVCo 3DS Approved Product List. The List is available by selecting the Search Approved Products link found within the following URL: EMV 3-D Secure Approval Processes | EMVCo. 10. What is the 3DS LOA and what is its benefit? 3DS LOA (Letter of Approval) is a written statement that documents the decision of EMVCo that a specified 3DS Product component has demonstrated sufficient compliance to the EMV® 3DS Specifications on the date of testing. Having a 3DS LOA demonstrates interoperability between a 3DS Product component and the 3DS ecosystem. An EMVCo Approval fee applies to the 3DS Product Providers. Refer to question 8 for the details of the Approval fee. © 2022-2025 EMVCo, LLC. All rights reserved Page 2 11. What is an EMVCo Approval / Reference Number and how can I get one? The EMVCo Reference Number is a field element described in the EMV 3DS Specification, and is used in 3DS message exchanges. The EMVCo Approval / Reference Number is granted when a 3DS Product receives an LOA. This number is unique for the Product Provider’s 3DS Product. The EMVCo Reference Number is updated each time the 3DS Product Provider submits their Product for 3DS testing. 12. What is an EMVCo Product Provider Registration Number and how can I get one? To test with EMVCo’s 3DS Test Process a 3DS Product Provider needs an EMVCo Product Provider Registration Number. An EMVCo Product Provider Registration Number is assigned by EMVCo to a Product Provider as part of EMVCo’s Product Provider registration process, described under the 3-D Secure Approval Process found here: EMV 3-D Secure Approval Processes | EMVCo. The online Registration Form can be accessed within the following URL: https://www.emvco.com/product-provider-registration/. 3DS Product Providers with a valid EMVCo Product Provider Registration Number can use that ID for EMVCo’s 3DS Test Process. 13. Once I have completed EMVCo 3DS Testing for my 3DS Product when do I need to retest my 3DS Product? Product Providers may test either based on their business priorities (changes, specification bulletins…) or closer to the expiration of their existing LOA. More detailed information is available in the EMV 3-D Secure Approval - Administrative Process document. This document is available for download on the EMVCo website by selecting the 3-D Secure Admin Process link found within the following URL: EMV 3-D Secure Approval Processes | EMVCo. EMVCo reserves the right to require 3DS Products with LOAs be tested again when needed (e.g. when there are 3DS security or interoperability changes). 14. What are 3DS Specification Bulletins and 3DS Approval Bulletins? 3DS Specification Bulletins are EMVCo communications on updates to the EMV 3DS specifications. 3DS Specification Bulletins can be found here on EMVCo’s Search website. 3DS Approval Bulletins are EMVCo communications on updates on the 3DS Approval Process regarding EMVCo’s 3DS testing or EMVCo’s 3DS approval process. 3DS Approval Bulletins can be found here on EMVCo’s Search website. 15. I am a 3DS Product Provider with multiple 3DS components, do I need multiple registrations with EMVCo? EMVCo’s 3DS testing process recognizes that 3DS Product Providers may develop or offer multiple 3DS Product components, or have different business units or lines of business that support different 3DS Product components. A 3DS Product Provider may want to list all their 3DS Products under one business, in this case, a single EMVCo Product Provider Registration is needed. © 2022-2025 EMVCo, LLC. All rights reserved Page 3 A 3DS Product Provider may want to list their 3DS Products under different lines of business with different business names, in this case a separate EMVCo Product Provider Registration is needed for each business name. Each separate registration will be assigned a different EMVCo Product Provider Registration Number. 16. Where can I find a list of the bulletins that my 3DS Product must support? All 3DS bulletins are available here on the EMVCo Document Search website. 17. How can I find out which 3DS Protocol Versions a 3DS Product supports? The EMVCo Reference or Approval Number of a 3DS approved Product indicates the highest version of 3DS protocol, a 3DS Product has been certified against. To obtain the format of this number, please refer to the 3DS Approval Bulletin 20 available here. The list of the approved 3DS Products can be found by selecting the Search Approved Products link found within the following URL: EMV 3-D Secure Approval Processes | EMVCo. © 2022-2025 EMVCo, LLC. All rights reserved Page 4 3DS Testing Process 18. How do I become 3DS Test Laboratory? You can access the 3DS Test Laboratory Requirement document to become the 3DS Test Laboratory. 3DS Test Laboratory Requirement document is available here. 19. How do I become 3DS Test Platform provider? You can access the 3DS Test Platform Requirement document to become the 3DS Test Platform Provider. 3DS Test Platform Requirement document is available here 20. How can we get the Test Plan/Test Cases? Test Plan and Test Cases can be accessed and used on the 3DS Test Platform after Product Provider registration is completed but they are not available to 3DS Product Providers outside the 3DS testing environment. 21. How can I find EMVCo-qualified Service Providers that offer 3DS Testing? Service Providers that have successfully completed EMVCo’s qualification and recognition process for providing 3DS Test Platform can be found by selecting the List of Test Platform Providers link found within the following URL (Step 2, Pre-Compliance): EMV 3-D Secure Approval Processes | EMVCo. 22. How can I find EMVCo-qualified Service Providers that offer 3DS Laboratory services? 3DS Laboratories that have successfully completed EMVCo’s recognition process for providing 3DS Laboratory services can be found by selecting the List of Laboratories link found within the following URL (Step 2, Pre-Compliance): EMV 3-D Secure Approval Processes | EMVCo. 23. What is the difference between 3DS Pre-Compliance and Compliance testing? 3DS Pre-Compliance testing consists of the execution on a 3DS Test Platform of a set of tests against requirements described in a version of 3DS specification. Pre-Compliance is outside control of EMVCo. Pre-Compliance allows Product Providers to debug, analyze and review the compliance with 3DS specification(s). 3DS Compliance testing is the formal phase where 3DS Product Providers execute a specific set of tests to determine official compliance with a version of 3DS specification. On successful execution of compliance testing, a Letter of Approval will be granted for the 3DS Product according to the EMVCo 3DS Approval process. 24. What is an Implementation Conformance Statement (ICS) form? An Implementation Conformance Statement (ICS) form is a form completed by the 3DS Product Provider which identifies the 3DS Protocol Version supported and listing all optional functions supported by the 3DS Product to be approved. The ICS form can be found can be found by selecting the ICS form link found within the following URL (Step 3, Compliance): EMV® 3-D Secure Approval Processes | EMVCo. © 2022-2025 EMVCo, LLC. All rights reserved Page 5 25. When can we submit a 3DS ICS form to EMVCo? The 3DS ICS form can be submitted only after your 3DS Pre-Compliance testing is complete. Compliance phase starts when the Laboratory submits the ICS Form to EMVCo according to the EMVCo 3DS Approval process. 26. What does “multi-protocol version support” mean when referring to 3DS Product testing? A 3DS Product shall support all "Active Protocols" that precede the 3DS Protocol Version selected by the 3DS Product Provider. During the Approval Process, the 3DS Product will be tested against all these active 3DS Protocol Versions and against the 3DS Protocol Version selected by the 3DS Product Provider. Active 3DS Protocol Versions are defined here. The deactivation of a protocol will be announced by EMVCo. 27. What is the process to renew the 3DS LOA after the 2 year period? Before a 3DS Product’s LOA expires, 3DS Product Providers can submit their 3DS Products for 3DS testing and approval process utilizing the available 3DS Protocol Versions. The 3DS testing and approval process shall use the same process followed to receive the prior 3DS LOA. 28. How long does it take to complete the testing and get a 3DS LOA? The time it takes to receive a 3DS LOA from EMVCo can vary for 3DS Product Providers and includes the following process steps: EMVCo vendor registration, connectivity setup to the 3DS Test Platform including test harness setup to this 3DS Test Platform, 3DS Pre-Compliance and 3DS Compliance testing. Details about each process step can be found on the EMVCo website by selecting the 3-D Secure Admin Process link found within the following URL: EMV 3-D Secure Approval Processes | EMVCo. 29. How do I complete the onboarding Compliance test (with Payment System)? For onboarding your 3DS component with a DS, please contact your Payment System or the DS operator. 30. How long is an ICS valid once approved by EMVCo? An approved ICS is valid for 90 calendar days. A Request For Approval must be submitted and the invoice must be paid within that period. Otherwise, all related documents to this approval process are no longer valid (ICS, RFA, report) and the 3DS Product Provider needs to restart a new approval process from the beginning by submitting a new ICS. 31. I have a 3DS product with an EMV 3DS LoA and I have made changes to my software under the same 3DS Protocol Version. What do I need to do? Please see question 13. 32. What happen to my previous 3DS LOA after I have obtained a new LOA for the same 3DS Product? The previous LOA will expire and will be removed from the EMVCo website. In order to ease the transition from the expiring LOA to the new LOA, it is possible to request a one-time six-month extension of the expiring LOA upon approval of the new LOA. The eligibility rules and the detailed © 2022-2025 EMVCo, LLC. All rights reserved Page 6 process to benefit from this extension is described in the EMVCo 3-D Secure Approval Administrative Process document. This document is available for download on the EMVCo website by selecting the 3-D Secure Admin Process link found within the following URL: EMV 3-D Secure Approval Processes | EMVCo. 33. Is testing of Bridging Message Extension required during an approval? Testing of the Bridging Message Extension is optional. If the Product Provider wants to have it tested, it shall be selected in the ICS form that is submitted to EMVCo (see question 24 for the submission of an ICS form). The Bridging Message Extension compliance will be documented in the LOA of the 3DS Product. It is also possible to test the Bridging Message Extension after a 3DS Product Provider has obtained an LOA. In that case, the existing LOA is updated to indicate the compliance (but the LOA Reference Number and the LOA expiration date do not change). Adding the testing of the Bridging Message Extension after a LOA has been granted is subject to a fee. The detailed process to test the Bridging Message Extension is described in the EMVCo 3-D Secure Approval - Administrative Process document. This document is available for download on the EMVCo website by selecting the 3-D Secure Admin Process link found within the following URL: EMV 3-D Secure Approval Processes | EMVCo. © 2022-2025 EMVCo, LLC. All rights reserved Page 7 3DS Compliance Testing 34. Which 3DS protocols can be selected for EMVCo’s 3DS Approval Testing? 3DS 2.2.0 and 2.3.1 Protocol Versions can be selected during a 3DS Approval Process. See the Approval Bulletin 19 available here for more details. 35. My 3DS Product has already received an EMV 3DS 2.2.0 3DS Letter of Approval (3DS LOA), why do I need to go through 3DS 2.2.0 testing again when testing for 3DS 2.3.1 ? Your product is a new implementation for a new 3DS Protocol Version and it requires regression testing against previous version as mentioned in question 26. 36. If my 3DS Product has already received an EMV 3DS 2.1.0 3DS Letter of Approval (3DS LOA), do I need to obtain a 3DS LOA for 3DS 2.2.0 before obtaining a LOA for 3DS 2.3.1? No, you can directly start the approval process for 3DS 2.3.1. As a reminder, your product will also be tested against all the active 3DS Protocol Versions below 2.3.1 as mentioned in question 26 but the LOA will only be issued for 3DS 2.3.1 with a two years expiration date and a new EMVCo approval number. 37. How to determine the 3DS Protocol Version supported by a product listed on the EMVCo website? Please see question 17. 38. Will EMVCo certified Products work with Products approved against a previous version of the specification? Yes. Note: some features/enhancements that are specific to a 3DS Protocol Version are only available if all 3DS components are supporting the same 3DS Protocol Version. 39. Do I need to develop all features supported by a 3DS Protocol Version even though I do not plan to use these features in production? Yes, a 3DS Product must be able to successfully process all fields described in the 3DS specification for a 3DS Protocol Version, in order to receive a 3DS Letter of Approval (3DS LOA) from EMVCo for that 3DS Protocol Version. 40. What Native UI and HTML UI Device Rendering Options does my 3DS SDK and ACS Products need to support? The 3DS SDK must support all Device Rendering Options (Native and HTML). The ACS must support all ACS Rendering Types for the ACS supported authentication methods, at a minimum at least one ACS UI Template for each ACS interface (Native UI and HTML UI) must be used during the approval process. © 2022-2025 EMVCo, LLC. All rights reserved Page 8 41. The expiration date of the EMV 3DS LoA for my 3DS product is approaching and I do not wish to continue offering my 3DS product for use. What do I need to do? No specific action is required. The LoA will automatically expire and will be removed from the EMVCo website. 42. What is the coverage of the tests performed during EMVCo’s 3DS Approval Testing? The objective of the compliance testing is to check the sufficient compliance with the EMV 3DS Specifications. However, 3DS Testing does not include the extensive check of compliance to all the RFC referred to in the EMV 3DS Specifications. Nevertheless, this is the responsibility of the product provider to comply with these RFCs. © 2022-2025 EMVCo, LLC. All rights reserved Page 9