PCI Watch

Tracking changes across the Payment Card Industry

SB n° 260: Terminal Risk Management Clarification

v1.0 Specification Bulletins
Contact Acceptance Device

EMV<sup>®</sup> Specification Bulletin No. 260 First Edition September 2021 Terminal Risk Management Clarification This Specification Bulletin clarifies the Conditions of Execution for Terminal Risk Management.

Applicability

This Specification Bulletin applies to:

  • EMV Integrated Circuit Card Specifications for Payment Systems, Book 3 – Application Specification, Version 4.3, November 2011

Related Documents

  • EMV Integrated Circuit Card Specifications for Payment Systems, Book 4 – Cardholder, Attendant, and Acquirer Interface Requirements, Version 4.3, November 2011

Effective Date

  • Immediately

Description

EMV ICC Book 3 states that "Terminal risk management shall always be performed regardless of the setting of the ‘Terminal risk management is to be performed’ bit in the Application Interchange Profile." However, EMV ICC Book 4 defines some types of terminals that need not support some or all of terminal risk management. This bulletin updates the Conditions of Execution for Terminal Risk Management in Book 3 to reflect those exceptions. Specification Changes In EMV Book 3, Section 10.6 Terminal Risk Management, revise the "Conditions of Execution" paragraph as shown below: Terminal risk management shall always be performed regardless of the setting of the ‘Terminal risk management is to be performed’ bit in the Application Interchange Profile. Random transaction selection need not be performed by a terminal with no online capability. The following exceptions from Book 4 apply:

  • An offline-only terminal and an online-only terminal need not support random transaction selection.
  • An online-only terminal need not support any of the terminal risk management functions.
  • A cardholder-controlled terminal (Terminal Type = '3x') need not support terminal risk management. countries.

Legal Notice

The EMV<sup>®</sup> Specifications are provided "AS IS" without warranties of any kind, and EMVCo neither assumes nor accepts any liability for any errors or omissions contained in these Specifications. EMVCO DISCLAIMS ALL REPRESENTATIONS AND WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT, AS TO THESE SPECIFICATIONS. EMVCo makes no representations or warranties with respect to intellectual property rights of any third parties in or in relation to the Specifications. EMVCo undertakes no responsibility to determine whether any implementation of the EMV<sup>®</sup> Specifications may violate, infringe, or otherwise exercise the patent, copyright, trademark, trade secret, know-how, or other intellectual property rights of third parties, and thus any person who implements any part of the EMV<sup>®</sup> Specifications should consult an intellectual property attorney before any such implementation. Without limiting the foregoing, the Specifications may provide for the use of public key encryption and other technology, which may be the subject matter of patents in several countries. Any party seeking to implement these Specifications is solely responsible for determining whether its activities require a license to any such technology, including for patents on public key encryption technology. EMVCo shall not be liable under any theory for any party’s infringement of any intellectual property rights in connection with the EMV<sup>®</sup> Specifications

countries.