EMV® Card and Terminal Type Approval Laboratory Recognition Requirements

EMV® Card and Terminal Type Approval ________________________________________________________ Laboratory Recognition Requirements Version 2.9 December 2025 © 2014-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.9 Page i / vii Legal Notice This document is subject to change by EMVCo at any time. This document does not create any binding obligations upon EMVCo or any third party regarding the subject matter of this document, which obligations will exist, if at all, only to the extent set forth in separate written agreements executed by EMVCo or such third parties. In the absence of such a written agreement, no product provider, test laboratory or any other third party should rely on this document, and EMVCo shall not be liable for any such reliance. No product provider, test laboratory or other third party may refer to a product, service or facility as EMVCo approved, in form or in substance, nor otherwise state or imply that EMVCo (or any agent of EMVCo) has in whole or part approved a product provider, test laboratory or other third party or its products, services, or facilities, except to the extent and subject to the terms, conditions and restrictions expressly set forth in a written agreement with EMVCo, or in an approval letter, compliance certificate or similar document issued by EMVCo. All other references to EMVCo approval are strictly prohibited by EMVCo. Under no circumstances should EMVCo approvals, when granted, be construed to imply any endorsement or warranty regarding the security, functionality, quality, or performance of any particular product or service, and no party shall state or imply anything to the contrary. EMVCo specifically disclaims any and all representations and warranties with respect to products that have received evaluations or approvals, and to the evaluation process generally, including, without limitation, any implied warranties of merchantability, fitness for purpose or noninfringement. All warranties, rights and remedies relating to products and services that have undergone evaluation by EMVCo are provided solely by the parties selling or otherwise providing such products or services, and not by EMVCo, and EMVCo will have no liability whatsoever in connection with such products and services. This document is provided "AS IS" without warranties of any kind, and EMVCo neither assumes nor accepts any liability for any errors or omissions contained in this document. EMVCO DISCLAIMS ALL REPRESENTATIONS AND WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NONINFRINGEMENT, AS TO THIS DOCUMENT. EMVCo makes no representations or warranties with respect to intellectual property rights of any third parties in or in relation to this document. EMVCo undertakes no responsibility to determine whether any implementation of this document may violate, infringe, or otherwise exercise the patent, copyright, trademark, trade secret, know-how, or other intellectual property rights of third parties, and thus any person who implements any part of this document should consult an intellectual property attorney before any such implementation. Without limiting the foregoing, this document may provide for the use of public key encryption and other technology, which may be the subject matter of patents in several countries. Any party seeking to implement this document is solely responsible for determining whether its activities require a license to any such technology, including for patents on public key encryption technology. EMVCo shall not be liable under any theory for any party's infringement of any intellectual property rights in connection with this document © 2014-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.9 Page ii / vii Revision Log – Version 2.9 The following changes have been made to the document since the publication of Version 2.8: • Section 8.1.4: Independence requirements updated to indicate that it is 25% of EMVCo testing revenues. • Section 8.5.7 updated for clarification and to authorize a Laboratory to subcontract the sales/project activity to another Laboratory that is recognised or not recognised for the concerned evaluation service. • Editorial Updates © 2014-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.9 Page iii / vii Contents 1 INTRODUCTION................................................................................................................... 1 1.1 Purpose and Audience .............................................................................................. 2 1.2 Scope ........................................................................................................................ 2 2 NORMATIVE REFERENCES .................................................................................................. 3 3 GLOSSARY......................................................................................................................... 4 4 TYPES OF RECOGNITION AUDITS......................................................................................... 6 4.1 Initial Recognition Audit ............................................................................................. 6 4.2 Recognition Renewal Audit........................................................................................ 6 4.3 Incremental Recognition Audit ................................................................................... 7 4.4 Interim Proficiency Audit ............................................................................................ 7 5 RECOGNITION PROCESSES ................................................................................................. 8 5.1 Initial Recognition Process ........................................................................................ 8 5.1.1 Two Phases Initial Recognition Audit........................................................... 10 5.1.2 Single Phase Initial Recognition Audit ......................................................... 18 5.2 Recognition Renewal Process ................................................................................. 25 5.3 Incremental Recognition Process ............................................................................ 29 5.4 Interim Proficiency Audit Process ............................................................................ 34 6 NONCONFORMANCE INVESTIGATION .................................................................................. 37 6.1 Retesting at an Recognised Laboratory................................................................... 37 6.2 Interlaboratory Comparison between Recognised Laboratories............................... 37 6.3 Corrective Action for Nonconformance .................................................................... 37 7 MODIFICATION OR TERMINATION OF RECOGNITION ............................................................. 38 7.1 Change in Testing Services Offered......................................................................... 38 7.2 Termination of Recognition ...................................................................................... 38 7.3 Suspension of Recognition ...................................................................................... 39 7.4 Revocation of Recognition....................................................................................... 39 8 LABORATORY REQUIREMENTS........................................................................................... 40 8.1 Business Requirements........................................................................................... 40 8.1.1 Financial...................................................................................................... 40 8.1.2 Legal Entity ................................................................................................. 40 8.1.3 Public Communications ............................................................................... 41 8.1.4 Independence.............................................................................................. 41 8.1.5 Consistent Business Practices .................................................................... 42 8.1.6 Impartiality ................................................................................................... 42 8.1.7 Confidentiality.............................................................................................. 42 8.1.8 Not Transferrable ........................................................................................ 43 © 2014-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.9 Page iv / vii 8.2 Security Requirements ............................................................................................ 44 8.2.1 Physical....................................................................................................... 44 8.2.1.1 Physical Layout ............................................................................. 44 8.2.1.2 Evaluation Areas ........................................................................... 44 8.2.1.3 Storage ......................................................................................... 44 8.2.2 Logical Security ........................................................................................... 44 8.2.2.1 Confidential Materials and Information .......................................... 44 8.2.2.2 Test Reports.................................................................................. 45 8.2.2.3 Test Tool Access........................................................................... 45 8.2.2.4 EMV Test Case Update and Implementation................................. 45 8.2.2.5 Networks ....................................................................................... 45 8.3 Administrative Requirements ................................................................................... 46 8.3.1 Quality Assurance ....................................................................................... 46 8.3.2 Personnel Management .............................................................................. 46 8.3.2.1 Personnel Information ................................................................... 46 8.3.2.2 Technical Expertise ....................................................................... 47 8.3.3 Experience .................................................................................................. 47 8.3.4 Language .................................................................................................... 48 8.4 Test Tool Requirements ........................................................................................... 49 8.4.1 General requirements.................................................................................. 49 8.4.1.1 Test Tool Hardware Maintenance.................................................. 49 8.4.1.2 Test Tool Software Maintenance ................................................... 49 8.4.2 Specific Requirements for Online Tools....................................................... 50 8.4.2.1 Additional Requirements Applying to Online Tools ........................ 50 8.4.2.2 Process to Obtain Authorization to Use Online Tool ...................... 51 8.5 Process Requirements ............................................................................................ 53 8.5.1 ICS review................................................................................................... 53 8.5.2 Test report ................................................................................................... 53 8.5.3 Management of the Samples ....................................................................... 53 8.5.4 EMVCo Repository of Information ............................................................... 54 8.5.5 EMVCo Laboratory Type Approval Communications ................................... 54 8.5.6 Communication with EMVCo ....................................................................... 55 8.5.7 Subcontracting ............................................................................................ 55 8.5.7.1 Testing .......................................................................................... 55 8.5.7.2 Local Sales/Project Interface ......................................................... 56 8.5.8 Remote Testing ........................................................................................... 56 8.5.9 Laboratory Fees .......................................................................................... 57 9 AUDIT REQUIREMENTS ..................................................................................................... 58 9.1 Written Evidence ..................................................................................................... 59 9.1.1 Business Conformance ............................................................................... 59 9.1.2 Security Conformance ................................................................................. 59 9.1.3 Administrative Conformance........................................................................ 60 © 2014-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.9 Page v / vii 9.2 Site Visit .................................................................................................................. 60 9.3 Demonstration of Testing Capabilities ...................................................................... 61 9.4 Corrective Action Plan ............................................................................................. 61 10 ANNEX 1 - LABORATORY CORRECTIVE ACTION PLAN .......................................................... 62 © 2014-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.9 Page vi / vii Tables Table 1: Normative References ....................................................................................................... 3 Table 2: Two Phases Initial Recognition Audit Process ................................................................. 10 Table 3: Single Phase Initial Recognition Audit Process ............................................................... 18 Table 4: Recognition Renewal Audit Process ............................................................................... 25 Table 5: Incremental Recognition Audit Process ........................................................................... 29 Table 6: Interim Proficiency Audit Process .................................................................................... 34 © 2014-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.9 Page vii / vii Figures Figure 1: Initial Recognition: Two Phases Approach vs. Single Phase Approach .......................... 9 Figure 2: Two Phases Initial Recognition Audit Process ............................................................... 15 Figure 3: Single Phase Initial Recognition Audit Process.............................................................. 22 Figure 4: Recognition Renewal Audit Process .............................................................................. 27 Figure 5: Incremental Recognition Audit Process ......................................................................... 32 Figure 6: Interim Proficiency Audit Process................................................................................... 36 © 2014-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.9 Page 1 / 63 1 Introduction EMVCo recognises independent laboratories throughout the world to conduct evaluations for card, mobile and terminal products, hereafter referred to as “type approval”: • Card Type Approval (for Card Consumer devices) o Common Core Definition (CCD) Level 1 and 2 o Common Payment Application (CPA) Level 1 and 2 • Mobile Type Approval (for NFC Consumer devices) o Mobile Product Level 1 o Contactless Mobile Payment (evaluations for Proximity Payment System Environment and Application Management for Secure Element CMP/PPSE) • Terminal Type Approval (for Acceptance devices) o IFM Level 1 (contact Level 1) o Contact Level 2 (EMV® Kernel) o PCD Level 1 (contactless Level 1) o Reduced Range PCD Level 1 (RR Level 1) o Contactless Product (Contactless C-x) o Terminal ESD Evaluation A laboratory may choose to be recognised for functional evaluations and may choose to be recognised for one or more of the following: • Card Type Approval o Contact - Level 1 (Electrical and Protocol) - CCD Level 2 - CPA Level 2 o Contactless - Level 1 (Analog and Digital) Note: Although Card Contactless Level 1 (Analog and Digital) testing capability of a laboratory may be assessed by the EMVCo auditor during the lab recognition process, there is no EMVCo Card Contactless Approval and the formal recognition process for Card Contactless Level 1 (Analog and Digital) is managed by Payment Systems. Refer to them for further information. • Mobile Type Approval o Contactless - CMP/PPSE © 2014-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.9 Page 2 / 63 - Level 1 (Analog, Digital, Validation, Interoperability) • Terminal Type Approval o Contact - Level 1 - IFM (Electrical and Protocol) - Level 2 - EMV Kernel o Contactless - Level 1 – PCD (Analog, Digital, Interoperability) and RR PCD - C-x (Contactless Product) Note: EMVCo recognises laboratories for Terminal Contactless Products and may grant LOAs. But Terminal Contactless Product testing capability of a laboratory is only partly verified by the EMVCo auditor during the lab recognition process and the formal and complete laboratory recognition process for Terminal Contactless product is managed by Payment Systems. Refer to them for further information. o ESD Evaluation A laboratory is recognised for a specific site location and the supported functional evaluations are documented in the Letter of Recognition of the laboratory. 1.1 Purpose and Audience This document describes the EMV laboratory recognition process for functional evaluations and outlines a set of requirements that an EMVCo Qualified Auditor will use along with the standard [ISO17025] requirements to assess a laboratory’s capabilities. The resulting audit report will enable EMVCo to judge whether a laboratory has the proper competencies and the proper administrative structure to perform type approval functional evaluations on behalf of EMVCo. This document is intended for laboratories that are seeking EMV recognition, for EMVCo Recognised Laboratories, and for EMVCo Qualified Auditors that will perform recognition audits on behalf of EMVCo. 1.2 Scope This document covers the EMV laboratory recognition process and requirements for functional evaluations. It does not cover the EMV laboratory recognition process and requirements for security. For the role and responsibilities of an EMVCo Recognised Laboratory in the type approval process, please refer to [AP CCD], [AP CPA], [AP ML1], [AP CMP] [AP IFM], [AP CTN], [AP PCD], [AP RR], [AP CLS] and [AP ESD].1 1 The normative references are listed in section 2. © 2014-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.9 Page 3 / 63 2 Normative References Ref. [AP CCD] [AP CPA] [AP CMP] [AP ML1] [AP IFM] [AP CTN] [AP PCD] [AP RR] [AP CLS] [AP ESD] [ISO17021] [ISO17025] Document Title EMV Card Type Approval Administrative Process for CCD EMV Card Type Approval Administrative Process for CPA EMV Contactless Mobile Product Type Approval Administrative Process EMV Mobile Product Level 1 Type Approval Administrative Process EMVCo Terminal Type Approval Administrative Process for Contact Terminal Level 1 (IFM) EMVCo Terminal Type Approval Administrative Process for Contact Terminal Level 2 (EMV Kernel) EMVCo Terminal Type Approval Administrative Process for Contactless Terminal Level 1 (PCD) EMVCo Terminal Type Approval Administrative Process for Reduced Range PCD Level 1 EMVCo Terminal Type Approval Administrative Process for Contactless product EMVCo Terminal Type Approval Administrative Process for ESD Evaluation ISO/IEC 17021 - Conformity assessment -- Requirements for bodies providing audit and certification of management systems ISO/IEC 17025 - General requirements for the competence of testing and calibration laboratories Version Latest Available Latest Available Latest Available Latest Available Latest Available Latest Available Latest Available Latest Available Latest Available Latest Available Latest Available Latest Available Table 1: Normative References Distribution Publicly Available Publicly Available Publicly Available Publicly Available Publicly Available Publicly Available Publicly Available Publicly Available Publicly Available Publicly Available Publicly Available Publicly Available © 2014-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.9 3 Glossary This appendix defines selected terms used in this document. Page 4 / 63 Action plan Corrective action plan EMVCo EMVCo Qualified Auditor EMVCo Recognised Laboratory Evaluation area See “Corrective action plan”. A set of deliverables and due dates defined by the laboratory, then reviewed and validated by the EMVCo Qualified Auditor, to enable a laboratory to fully meet EMV requirements. A Limited Liability Company established to maintain the EMV specifications and administer Type Approval against those specifications. An independent, impartial entity that has received a Letter of Qualification from EMVCo, entitling it to verify conformance to EMV-defined Type Approval procedures. Note: The auditor reviewing the first approval test reports during the initial recognition is usually not the same as the auditor performing the onsite audit. An independent, impartial entity that has been audited by an EMVCo Qualified Auditor for compliance with the requirements outlined in this document and has received a Letter of Recognition from EMVCo, entitling it to perform testing for Type Approval. An area in a laboratory facility in which chip products, components, or data are tested or stored. Impartiality Freedom from conflicts of interest, from bias, and from prejudice, neutrality, fairness, openmindedness, even-handedness detachment and balance. Ability to ensure that conflict of interest do not exist or are resolved so as not to adversely influence the activities of the Laboratory. © 2014-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.9 Letter of Recognition Letter of Approval Letter of Compliance Online Tool Provider Parent laboratory Product Provider Recognition Registration Number Type Approval Page 5 / 63 Written statement that documents the decision of EMVCo that a laboratory is an EMVCo Recognised Laboratory and performs testing for Type Approval in conformance with the rules defined by EMVCo. Written statement that documents the decision of EMVCo that a specified product has demonstrated sufficient conformance to the applicable EMV specifications as of its test date. Written statement that documents the decision of EMVCo that a specified CMP Secure Element (SE) product or CMP PPSE product has demonstrated sufficient conformance to the applicable EMV specifications as of its test date. Developer and operator of an online test tool used during the EMVCo approvals. In the context of this document, no distinction is made between the two roles. Head laboratory of a group of laboratories (subsidiaries) belonging to the same entity. The entity that submits a card, mobile or terminal product to EMVCo for Type Approval. Formal recognition by EMVCo that a test laboratory is competent to perform one or more categories of testing defined by EMV Card, Mobile or Terminal Type Approval procedures. Unique identification number that EMVCo assigns to an EMVCo Recognised Laboratory, to be used on all communication and reports sent to EMVCo. Verification by EMVCo that a specific card, mobile or terminal product has demonstrated sufficient conformance to the applicable EMV specifications. © 2014-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.9 Page 6 / 63 4 Types of Recognition Audits A laboratory shall obtain and maintain current EMV recognition. Therefore, several types of audits may be required during a laboratory’s relationship agreement with EMVCo: • Initial Recognition Audit • Recognition Renewal Audit • Incremental Recognition Audit • Interim Proficiency Audit Note: Payment of fees for audit tasks undertaken by EMVCo Qualified Auditors is the responsibility of the laboratory requesting EMVCo’s recognition. EMVCo is not responsible for auditor fees. 4.1 Initial Recognition Audit A laboratory shall be recognised by EMVCo to perform approval for cards, mobiles or terminals. The Initial Recognition Audit is the first audit that a candidate laboratory shall pass. When a laboratory requests the EMV Initial Recognition, EMVCo adds this request to the EMVCo waiting list. After EMVCo confirmation to proceed with the request, the laboratory supplies EMVCo with documentation about the laboratory which includes an overview of its abilities to meet EMV recognition requirements. Once EMVCo has reviewed the documents supplied and has accepted the laboratory for potential recognition, a full recognition audit is required. This audit consists of items identified in sections 8 and 9. 4.2 Recognition Renewal Audit A laboratory shall be audited as specified in the Letter of Recognition to renew its EMV recognition. The requirements for the Recognition Renewal Audit are determined by EMVCo at the time of renewal. The audit may include all items identified in sections 8 and 9 or EMVCo may select specific items for the auditor to cover. The audit shall be completed before the expiration date of the laboratory’s recognition. If a laboratory wishes to renew its recognition with EMVCo, the laboratory should contact EMVCo at least four months prior to the expiration date of the laboratory’s recognition. It is the responsibility of the laboratory to renew its recognition before it expires. If a laboratory does not renew its recognition, EMVCo may revoke its recognition. See section 7.3. If the recognition renewal has not been granted by EMVCo before the expiration date, The Approval Secretariat will stop reviewing any Test Report from the concerned Laboratory. © 2014-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.9 Page 7 / 63 4.3 Incremental Recognition Audit If a laboratory requests to add a new type of testing or a new site to its recognition, an Incremental Recognition Audit is required. The existing renewal date for the laboratory’s recognition does not change. The requirements for an Incremental Recognition Audit are determined by EMVCo at the time of the audit. The scope of the audit is a subset of the items identified in sections 8 and 9. 4.4 Interim Proficiency Audit At any time, at the discretion of EMVCo, an Interim Proficiency Audit may be required. For instance, it may happen if: • A previous audit required a corrective action plan, • Deviations are not fixed appropriately or in the expected timeline, • Repetitive issues are noticed, • A laboratory performs a low number of approvals a year, • A laboratory requests to use an EMV qualified online tool for testing. Refer to section 8.4 for more details, • Or for any other reason that EMVCo deems relevant In this case, EMVCo will: • Inform the laboratory that an Interim Proficiency Audit must be performed and the date by which the audit must be completed • Inform the laboratory of the audit requirements (which will be based upon the issues or changes identified) The scope of the audit will primarily include a laboratory’s testing procedures and capabilities. This scope and the date of the interim proficiency audit are usually determined by the list of corrective actions, which have been issued during the previous audit performed but it is at the discretion of the auditor to extend the scope. If a laboratory does not complete the audit to the satisfaction of EMVCo by the required date, EMVCo may suspend or revoke its recognition. See sections 7.3 and 7.4. Note: Interim Proficiency audits requested during the period of the Initial Letter of Recognition (see 5.1.1 and 5.1.2) or requested in a Letter of Recognition (see 5.2) have to be organized and planned by the laboratory and EMVCo does not inform or remind the laboratory to do it. © 2014-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.9 Page 8 / 63 5 Recognition Processes The following sections describe the processes involved in the various types of audits. 5.1 Initial Recognition Process The Initial Recognition Process is performed by each new laboratory that wants to be recognised by EMVCo. • A laboratory that has a parent laboratory already recognised by EMVCo may complete the initial recognition process in two phases or in a single phase. The laboratory may choose the Two Phases Initial Recognition Audit if it wishes to start the recognition process before purchasing or developing the necessary EMVCo-qualified test tools. • Any other laboratory (new) shall follow the two phases process. Figure 1 provides an overview of the differences between the two phases and the single phase approaches. © 2014-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.9 Laboratory applies to EMVCo to begin recognition process Page 9 / 63 Two Phases Audit Laboratory selects EMVCo Qualified Auditor to begin two phases audit Auditor completes first phase of audit First phase N passed? Y Laboratory purchases or develops test tools Auditor completes second phase of audit EMVCo authorizes N laboratory to begin? Y End Single Phase Audit Laboratory purchases or develops test tools Laboratory selects EMVCo Qualified Auditor to begin single phase audit Auditor completes entire audit Second N N phase passed? End Y EMVCo provides Letter of Recognition Audit passed? Y Figure 1: Initial Recognition: Two Phases Approach vs. Single Phase Approach2 2 Figure 1 indicates that the laboratory purchases or develops test tools only after the first phase of the Two Phases Audit is complete. There is an alternative, as described in the note on page 16. © 2014-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.9 Page 10 / 63 5.1.1 Two Phases Initial Recognition Audit Table 2 outlines the steps in the Two Phases Initial Recognition Audit process. (Section 5.1.2 describes the Single Phase Initial Recognition Audit process.) Laboratory EMVCo EMVCo Laboratory EMVCo Sends EMVCo a request for recognition using the EMV Terminal/Card/Mobile Type Approval Request for Registration form (available at www.emvco.com) • Register the laboratory Request for Registration • Acknowledge that this registration is formally added in EMVCo waiting list. • When ready to process the request, EMVCo confirms to the laboratory that the present recognition process can be initiated Note 1: The time between the previous step and this one, depends on various factors such as other projects managed by EMVCo Note 2: This confirmation is mandatory to start the process Note 3: In case multiple functional evaluations are requested by the laboratory, EMVCo may propose to split the recognition with different time frames After EMVCo confirmation to proceed with the request, the laboratory sends documentation to EMVCo to begin the recognition process: • Executive and financial summary • Technical expertise summary, including experience with EMV Specifications • Laboratory background • Desired audit approach: Two Phases Audit • Evaluates whether laboratory qualifies to be accepted for consideration as a potential EMVCo Recognised Laboratory • Informs laboratory if it may proceed with recognition Note: EMVCo reserves the right, at its own discretion and without providing a detailed explanation, to deny a laboratory the right to proceed through the recognition process. • Provides laboratory with: o The EMVCo Functional Evaluation Relationship Agreement for signature Laboratory o The EMVCo Test Document License Agreement for signature Table 2: Two Phases Initial Recognition Audit Process © 2014-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.9 Page 11 / 63 Laboratory EMVCo Laboratory EMVCo Qualified Auditor Laboratory EMVCo Qualified Auditor • Signs the Relationship Agreement with EMVCo and returns two signed copies to EMVCo. Note: The laboratory may proceed with the audit once the Relationship Agreement has been received by EMVCo. • Signs the Test Document License Agreement and returns two signed copies to EMVCo • Signs the Relationship Agreement and returns one signed copy to the laboratory. • Signs the Test Document License Agreement and returns one signed copy to the laboratory. • Returns a Letter of Registration including a Registration Number, to be used on all communication and reports sent to EMVCo. • Provides the laboratory access to the EMVCo repository of information. • Selects an auditor from the list of EMVCo Qualified Auditors and makes financial and legal arrangements with the auditor for the laboratory to be audited. • Informs EMVCo of selected auditor • Provides to the auditor the information required to meet the audit requirements defined in section 9.1 • Performs audit covering [ISO17025] and EMVCo requirements (in accordance with [ISO17021]) • Ensures laboratory meets all requirements detailed in sections 8.1 and 9.1 • Provides audit findings to the laboratory • If a corrective action plan (as described in section 9.4) is NOT necessary: provides audit report to EMVCo Note: Decision to have an onsite audit or a remote audit for phase 1 is at the discretion of the EMVCo Qualified Auditor and EMVCo. If a corrective action plan (as described in section 9.4) is necessary: • Defines the action plan with deliverables and due dates to meet all EMV requirements • Provides action plan to EMVCo Qualified Auditor If a corrective action plan is necessary: • Reviews and validates the action plan defined by the laboratory • Provides a copy of the validated laboratory action plan in its audit report to EMVCo Table 2: Two Phases Initial Recognition Audit Process, continued © 2014-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.9 Page 12 / 63 EMVCo Laboratory EMVCo Qualified Auditor Laboratory EMVCo Qualified Auditor Reviews audit report (and action plan, if any) and determines whether the second phase of the audit may begin; if so: • Requests a site audit and a demonstration of testing capabilities as described in section 9.3 Note: EMVCo reserves the right, at its own discretion and without providing a detailed explanation, to deny a laboratory the right to continue through the recognition process. • Purchases necessary EMVCo-qualified test tools or develops necessary test tools and applies for EMV qualification for the tools • Obtains adequate training on EMV test cases and test tools Note: Training is not the responsibility of EMVCo. • Demonstrates testing capabilities as described in section 9.3 for the supported functional evaluations • Performs audit covering [ISO17025] and EMVCo requirements (in accordance with [ISO17021]) • Ensures laboratory meets all requirements detailed in sections 8.1 through 0 and 9.1.2 through 9.3 • Audits the laboratory’s testing capabilities • Provides audit findings to the laboratory • If a corrective action plan (as described in section 9.4) is NOT necessary: provides audit report to EMVCo. If a corrective action plan is necessary: • Defines the action plan with deliverables and due dates to meet all EMV requirements • Provides action plan to EMVCo Qualified Auditor If a corrective action plan is necessary: • Reviews and validates the action plan defined by the laboratory • Provides a copy of the validated laboratory action plan in its audit report to EMVCo Table 2: Two Phases Initial Recognition Audit Process, continued © 2014-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.9 Page 13 / 63 EMVCo Laboratory • Reviews audit report (and action plan, if any) and determines whether the laboratory may be recognised or whether followup action is required Note: EMVCo reserves the right to deny recognition at its own discretion and without detailed explanation. • If audit report is acceptable to EMVCo, sends the laboratory an Initial Letter of Recognition with a validity of typically 9 months • If audit report is acceptable but the laboratory’s action items are pending , o May grant recognition on a provisional basis with pending corrective actions, o Sends the laboratory a Provisional Letter of Recognition with conditions: The letter will include the requirements for an Interim Proficiency Audit (as described in section 4.4) and a date by which it must be completed (with a validity of 9 months maximum). • Adds the laboratory to the list of recognised laboratories on the EMVCo website During the validity of the Initial Letter of Recognition: • If the laboratory has a Parent Laboratory (for example the laboratory is a subsidiary of an already EMVCo Recognised Laboratory): At least 5 reports issued (with at a minimum one report per product type for which the laboratory seeks for recognition) shall be reviewed and controlled by the Parent Laboratory to ensure integrity of these reports. Parent Laboratory shall report to EMVCo the result of these reviews. Failure to complete testing on 5 products in the allotted time, or poor quality audit results may trigger further interim proficiency audits and/or loss of recognition. • If the laboratory does not have a Parent Laboratory: the first 3 reports issued (per product type for which the laboratory seeks for recognition) shall be fully reviewed and controlled by an EMVCo Qualified Auditor to ensure correctness of these reports. The laboratory shall be responsible for all fees associated with such activity. The EMVCo Qualified Auditor shall report to EMVCo the result of these reviews. Failure to complete testing on 3 products per type approval in the allotted time, or poor quality audit results may trigger further interim proficiency audits and/or loss of recognition • Before the expiration of the Initial Letter of Recognition, the laboratory shall organize an Interim Proficiency Audit (as described in section 4.4.). Table 2: Two Phases Initial Recognition Audit Process, continued © 2014-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.9 Page 14 / 63 EMVCo Qualified Auditor EMVCo • Performs Interim Proficiency Audit on the laboratory’s operational testing activities during the period of the Initial Letter of Recognition • Performs Interim Proficiency Audit on the results of the action plan if a Provisional Letter of Recognition had been requested during the initial audit. Note: Additional check points will be organized remotely by the EMVCo qualified auditor before the Interim Proficiency audit to follow up the implementation of the action plan (see details in section 9.4) • Provides audit report to EMVCo. If no major issues have been detected during the review by EMVCo of the reports from the Parent Laboratory or from the EMVCo Qualified Auditor and if no corrective action items have been identified during the Interim Proficiency Audit, then the laboratory’s recognition is extended to three years from the initial recognition date. If issues and/or corrective action items have been identified, depending on the severity and number of deviations, a new interim proficiency audit may be required and the extension of the laboratory recognition may be reduced to one to two years at EMVCo discretion. Table 2: Two Phases Initial Recognition Audit Process, continued © 2014-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.9 Laboratory sends Request for Registration to EMVCo EMVCo acknowledges registration and add the laboratory to the waiting list EMVCo confirms to the laboratory that its recognition can be initiated Laboratory sends documentation to EMVCo to begin recognition process EMVCo authorizes N laboratory to begin? Y EMVCo sends: Relationship Agreement Test Document License Agreement Laboratory signs and returns: The Relationship Agreement Test Document License Agreement EMVCo signs and returns: The Relationship Agreement Test Document License Agreement Letter of Registration including Registration Number Laboratory selects an EMVCo qualified auditor Auditor: Performs audit as per ISO 17025 Provides audit findings to laboratory Page 15 / 63 Laboratory request rejected End Corrective action Y plan needed? N Laboratory defines action plan Auditor reviews and validates action plan Auditor sends audit report to EMVCo A Figure 2: Two Phases Initial Recognition Audit Process © 2014-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.9 A Page 16 / 63 EMVCo reviews audit report phase 1 EMVCo authorizes N second phase? Y Laboratory request rejected End Laboratory purchases: EMVCo-qualified test tools Laboratory: Develops test tools Applies for EMVCo qualification for tools Note: A laboratory may purchase or develop test tools in parallel with the first phase of the audit, at the laboratory s own risk. EMVCo reserves the right to accept or deny such request. Laboratory demonstrates testing capabilities Auditor: Performs audit as per ISO 17025 Provides audit findings to the laboratory Corrective action Y plan needed? N Laboratory defines action plan Auditor reviews and validates action plan B Figure 2: Two Phases Initial Recognition Audit Process, continued © 2014-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.9 B Auditor sends audit report to EMVCo Page 17 / 63 Y EMVCo: Sends laboratory Initial Letter of Recognition (typical duration: 9 months) Adds laboratory to the list of Recognised Laboratories Audit report is acceptable to EMVCo? N End With action items EMVCo: Sends laboratory Provisional Letter of Recognition (maximun duration: 9 months) Adds laboratory to the list of Recognised Laboratories Laboratory must complete Interim Proficiency Audit on the laboratory s operational testing activities, before the expiration of the initial recognition Laboratory must complete Interim Proficiency Audit as specified in the Provisional Letter of Recognition, before the expiration of the provisional recognition N Parent Laboratory must verify at least 5 reports (per product type) from the laboratory under recognition, before the expiration of the initial recognition Parent Laboratory exists? Y Auditor must verify 3 reports (per product type) from the laboratory under recognition, before the expiration of the provisional recognition If no major issues detected during the report review, and no corrective actions identified during the Interim Proficiency audit, EMVCo extends laboratory recognition to 3 years If corrective actions identified during the Interim Proficiency audit, EMVCo reduces the extension of the recognition to 1 or 2 years. Figure 2: Two Phases Initial Recognition Audit Process, continued © 2014-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.9 Page 18 / 63 5.1.2 Single Phase Initial Recognition Audit Table 3 outlines the steps in the Single Phase Initial Recognition Audit process. (Section 5.1.1 describes the Two Phases Initial Recognition Audit process.) Laboratory EMVCo EMVCo Laboratory EMVCo Sends to EMVCo the request for recognition, using the EMV Terminal/Card/Mobile Type Approval Request for Registration form (available at www.emvco.com) • Register the laboratory Request for Registration • Acknowledge that this registration is formally added this in EMVCo waiting list. • When ready to process the request, confirms to the laboratory that the present recognition process can be initiated Note 1: The time between the previous step and this one, depends on various factors such as other projects managed by EMVCo Note 2: This confirmation is mandatory to start the process Note 3: In case multiple functional evaluations are requested by the laboratory, EMVCo may propose to split the recognition with different time frames After EMVCo confirmation to proceed with the request, the laboratory, sends documentation to EMVCo to begin the recognition process: • Executive and financial summary • Technical expertise summary, including experience with EMV Specifications • Laboratory background • Desired audit approach: Single Phase Audit Evaluates whether laboratory qualifies to be accepted for consideration as a potential EMVCo Recognised Laboratory • Informs laboratory if it may proceed with recognition Note: EMVCo reserves the right, at its own discretion and without providing a detailed explanation, to deny a laboratory the right to proceed through the recognition process. • Provides laboratory with: o The EMVCo Functional Evaluation Relationship Agreement for signature Laboratory o The EMVCo Test Document License Agreement for signature Table 3: Single Phase Initial Recognition Audit Process © 2014-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.9 Page 19 / 63 Laboratory EMVCo Laboratory EMVCo Qualified Auditor • Signs the Relationship Agreement with EMVCo and returns two signed copies to EMVCo Note: The laboratory may proceed with the audit once the Relationship Agreement has been received by EMVCo. • Signs the EMVCo Test Document License Agreement and returns two signed copies to EMVCo • Signs the Relationship Agreement and returns one signed copy to the laboratory. • Signs the Test Document License Agreement and sends a signed version to the laboratory • Returns a Letter of Registration including a Registration Number, to be used on all communication and reports sent to EMVCo • Provides the laboratory access to the EMVCo repository of information • Requests a demonstration of testing capabilities as described in section 9.3 • Purchases necessary EMVCo-qualified test tools or develops necessary test tools and applies for EMV qualification for the tools • Obtains adequate training on EMV Test Cases and test tools Note: Training is not the responsibility of EMVCo. • Selects an auditor from the list of EMVCo Qualified Auditors and makes financial and legal arrangements with the auditor for the laboratory to be audited • Informs EMVCo of auditor selected • Provides to the auditor the information required to meet the audit requirements defined in section 9.1 • Demonstrates testing capabilities as described in section 9.3 for the supported functional evaluations • Performs audit covering [ISO17025] and EMVCo requirements (in accordance with [ISO17021]) • Ensures laboratory meets all requirements detailed in sections 8 and 9 • Audits the laboratory’s testing capabilities • Provides audit findings to the laboratory • If a corrective action plan (as described in section 9.4) is NOT necessary: Provides audit report to EMVCo Table 3: Single Phase Initial Recognition Audit Process, continued © 2014-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.9 Page 20 / 63 Laboratory EMVCo Qualified Auditor EMVCo If a corrective action plan (as described in section 9.4) is necessary: • Defines the action plan with deliverables and due dates to meet all EMV requirements • Provide action plan to EMVCo Qualified Auditor If a corrective action plan is necessary: • Reviews and validates the action plan defined by the laboratory • Provides a copy of the validated laboratory action plan in its audit report to EMVCo • Reviews audit report (and action plan, if any) and determines whether the laboratory may be recognised or whether followup action is required Note: EMVCo reserves the right to deny recognition at its own discretion and without detailed explanation. • If audit report is acceptable to EMVCo, sSends the laboratory an Initial Letter of Recognition with a validity of typically 9 months • If audit report is acceptable but laboratory action items are pending, o May grant recognition on a provisional basis, o Sends the laboratory a provisional Letter of Recognition with conditions: The letter will include the requirements for an Interim Proficiency Audit (as described in section 4.4) and a date by which it must be completed (with a validity of 9 months maximum). • Adds the laboratory to the list of recognised laboratories on the EMVCo website Table 3: Single Phase Initial Recognition Audit Process, continued © 2014-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.9 Page 21 / 63 Laboratory EMVCo Qualified Auditor EMVCo During the validity of the Initial Letter of Recognition: • If the laboratory has a Parent Laboratory (for example the laboratory is a subsidiary of an already EMVCo recognised Laboratory): At least 5 reports issued (with at a minimum one report per product type for which the laboratory seeks for recognition) shall be reviewed and controlled by the Parent Laboratory to ensure correctness of these reports. Parent Laboratory shall report to EMVCo the result of these reviews. Failure to complete testing on 5 products in the allotted time, or poor quality audit results may trigger further interim proficiency audits and/or loss of recognition. • If the laboratory does not have a Parent Laboratory: the first 3 reports issued (per product type for which the laboratory seeks for recognition) shall be fully reviewed and controlled by an EMVCo Qualified Auditor to ensure correctness of these reports. The laboratory shall be responsible for all fees associated with such activity. The EMVCo Qualified Auditor shall report to EMVCo the result of these reviews. Failure to complete testing on 3 products per type approval in the allotted time, or poor quality audit results may trigger further interim proficiency audits and/or loss of recognition • Before the expiration of the Initial Letter of Recognition, the laboratory shall organize an Interim Proficiency Audit (as described in section 4.4.). • Performs Interim Proficiency Audit on the laboratory’s operational testing activities during the period of the Initial Letter of Recognition • Performs Interim Proficiency Audit on the results of the action plan if a Provisional Letter of Recognition had been requested during the initial audit. Note: Additional check points will be organized remotely by the EMVCo qualified auditor before the Interim Proficiency audit to follow up the implementation of the action plan (see details in section 9.4) • Provides audit report to EMVCo. If no major issues have been detected during the review by EMVCo of the report from the Parent Laboratory or from the EMVCo Qualified Auditor and if no corrective actions items have been identified during the Interim Proficiency Audit, then the laboratory’s recognition is extended to three years from the initial recognition date. If issues and/or corrective action items have been identified, depending on the severity and number of deviations, a new interim proficiency audit may be required and the extension of the laboratory recognition may be reduced to one to two years at EMVCo discretion. Table 3: Single Phase Initial Recognition Audit Process, continued © 2014-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.9 Laboratory sends Request for Registration to EMVCo EMVCo acknowledges registration and add the laboratory to the waiting list EMVCo confirms to the laboratory that its recognition can be initiated Laboratory sends documentation to EMVCo to begin recognition process Page 22 / 63 EMVCo authorizes N laboratory to begin? Y EMVCo sends: Relationship Agreement Test Document License Agreement Laboratory signs and returns: Relationship Agreement Test Document License Agreement EMVCo signs and returns: Relationship Agreement Test Document License Agreement Letter of Registration including Registration Number Laboratory request rejected End Laboratory: Purchases EMVCo-qualified tools Laboratory: Develops Test Tools Applies for EMVCo qualification for tools Laboratory selects an EMVCo Qualified Auditor C Figure 3: Single Phase Initial Recognition Audit Process © 2014-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.9 C Laboratory demonstrates testing capabilities Auditor: Performs audit as per ISO 17025 Provides audit findings to the laboratory Page 23 / 63 Corrective action Y plan needed? N Laboratory defines action plan Auditor reviews and validates action plan Auditor sends audit report to EMVCo Y EMVCo: Sends laboratory Initial Letter of Recognition (typical duration: 9 months Adds laboratory to the list of Recognised Laboratories Audit report is acceptable to EMVCo? N With action items End EMVCo: Sends laboratory Provisional Letter of Recognition (maximum duration: 9 months) Adds laboratory to the list of Recognised Laboratories Laboratory must complete Interim Proficiency Audit on the laboratory s operational testing activities, before the expiration of the initial recognition Laboratory must complete Interim Proficiency Audit as specified in Provisional Letter of Recognition, before the expiration of the provisional recognition D Figure 3: Single Phase Initial Recognition Audit Process, continued © 2014-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.9 D Page 24 / 63 Y Parent Laboratory N Exist? Parent Laboratory must verify at least 5 reports (per product type) from the laboratory under recogniton, before the expiration of the initial recognition Auditor must verify 3 reports (per product type) from the laboratory under recognition, before the expiration of the provisional recognition If no major issues detected during the report review, and no corrective actions identified during the Interim Proficiency audit, EMVCo extends laboratory recognition to 3 years. If corrective actions identified during the Interim Proficiency audit, EMVCo reduces the extension of the recognition to 1 or 2 years. Figure 3: Single Phase Initial Recognition Audit Process, continued © 2014-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.9 5.2 Recognition Renewal Process Table 4 outlines the steps in the recognition renewal process. Page 25 / 63 Laboratory EMVCo Laboratory EMVCo Qualified Auditor Laboratory Sends request to EMVCo to begin the recognition renewal process Note: If a laboratory wishes to renew its recognition with EMVCo, the laboratory should contact EMVCo at least four months prior to the expiration date of the laboratory’s recognition. • Informs the laboratory if it may proceed with the recognition renewal Note: EMVCo reserves the right, at its own discretion and without providing a detailed explanation, to deny a laboratory the right to proceed through the recognition renewal process. • Identifies the audit requirements, which may be a subset of sections 8 and 9, and informs the laboratory • Selects an auditor from the list of EMVCo Qualified Auditors and makes financial and legal arrangements with the auditor for the laboratory to be audited • Provides to the auditor the information required to meet the audit requirements identified by EMVCo • Demonstrates testing capabilities (as described in section 9.3) if requested by EMVCo • Performs audit covering [ISO17025] and EMVCo requirements (in accordance with [ISO17021]) • Ensures laboratory meets all requirements identified by EMVCo • Audits the laboratory’s testing capabilities if requested by EMVCo • Provides audit findings to the laboratory • If a corrective action plan (as described in section 9.4) is NOT necessary: Provides audit report to EMVCo If a corrective action plan is necessary: • Defines the action plan with deliverables and due dates to meet all EMV requirements • Provides action plan to EMVCo Qualified Auditor Table 4: Recognition Renewal Audit Process © 2014-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.9 Page 26 / 63 EMVCo Qualified Auditor EMVCo EMVCo Qualified Auditor If a corrective action plan is necessary: • Reviews and validates the action plan defined by the laboratory • Provides a copy of the validated laboratory action plan in its audit report to EMVCo • Reviews audit report (and action plan, if any) and determines whether the laboratory’s recognition may be renewed or whether follow-up action is required Note: EMVCo reserves the right to deny recognition at its own discretion and without detailed explanation. • If audit report is acceptable to EMVCo, sends a new Letter of Recognition to the laboratory • If audit report is acceptable but laboratory action items are pending, o May renew recognition on a provisional basis, o Sends the laboratory a provisional Letter of Recognition with a duration defined by EMVCo: The letter may include the requirements for an Interim Proficiency Audit (as described in section 4.4) and a date by which it must be completed If laboratory action items are pending when the new Letter of Recognition is granted, organizes remote check points with the laboratory to follow up the implementation of the action plan (see details in section 9.4) Table 4: Recognition Renewal Audit Process, continued © 2014-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.9 Laboratory sends request to EMVCo to begin recognition renewal process EMVCo N authorizes laboratory End to begin? Y EMVCo identifies audit requirements Laboratory: Selects EMVCo Qualified Auditor Demonstrates testing capabilities Auditor: Performs audit as per ISO 17025 Provides audit findings to the laboratory Page 27 / 63 Corrective action Y plan needed? N Laboratory defines action plan Auditor reviews and validates action plan Auditor sends audit report to EMVCo E Figure 4: Recognition Renewal Audit Process © 2014-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.9 E Page 28 / 63 Y EMVCo sends laboratory a new Letter of Recognition Audit report is acceptable to EMVCo? N End With action items EMVCo sends laboratory a provisional Letter of Recognition Laboratory may complete an Interim Proficiency Audit as specified in provisional Letter of Recognition Figure 4: Recognition Renewal Audit Process, continued © 2014-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.9 5.3 Incremental Recognition Process Table 5 outlines the steps in the incremental recognition process. Page 29 / 63 Laboratory EMVCo Laboratory EMVCo Qualified Auditor Laboratory EMVCo Qualified Auditor Sends request to EMVCo to begin the incremental recognition process using the EMV Terminal/Card/Mobile Type Approval Request for incremental recognition form (available at www.emvco.com) • Informs the laboratory if it may proceed with the incremental recognition and the date by which the audit must be completed Note: EMVCo reserves the right, at its own discretion and without providing a detailed explanation, to deny a laboratory the right to proceed through the incremental recognition. • Identifies the audit requirements, which may be a subset of sections 8 and 9, and informs the laboratory • Selects an auditor from the list of EMVCo Qualified Auditors and makes financial and legal arrangements with the auditor for the laboratory to be audited • Provides to the auditor the information required to meet the audit requirements identified by EMVCo • Demonstrates testing capabilities (as described in section 9.3) if requested by EMVCo • Performs audit covering [ISO17025] and EMVCo requirements (in accordance with [ISO17021]) • Ensures laboratory meets all requirements identified by EMVCo • Audits the laboratory’s testing capabilities if requested by EMVCo • Provides audit findings to the laboratory • If a corrective action plan (as described in section 9.4) is NOT necessary: Provides audit report to EMVCo If a corrective action plan is necessary: • Defines the action plan with deliverables and due dates to meet all EMV requirements • Provides action plan to EMVCo Qualified Auditor If a corrective action plan is necessary: • Reviews and validates the action plan defined by the laboratory • Provides a copy of the validated laboratory action plan in its audit report to EMVCo Table 5: Incremental Recognition Audit Process © 2014-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.9 Page 30 / 63 EMVCo EMVCo Qualified Auditor • Reviews audit report (and action plan, if any) and determines whether the laboratory may be recognised or whether followup action is required Note: EMVCo reserves the right to deny recognition at its own discretion and without detailed explanation. • If audit report is acceptable to EMVCo: o Updates the Relationship Agreement with the laboratory o Sends an updated Letter of Recognition to the laboratory Note: The existing renewal date for the laboratory’s recognition does not change. • If audit report is acceptable but laboratory action items are pending, o May grant recognition on a provisional basis, o Updates the Relationship Agreement with the laboratory o Sends the laboratory a provisional Letter of Recognition with conditions: The letter may include the requirements for an Interim Proficiency Audit (as described in section 4.4) and a date by which it must be completed. Note: The existing renewal date for the laboratory’s recognition does not change. • Updates the list of recognised laboratories on the EMVCo website. If laboratory action items are pending when the updated Letter of Recognition is granted, organizes remote check points with the laboratory to follow up the implementation of the action plan (see details in section 9.4) Table 5: Incremental Recognition Audit Process, continued © 2014-2025 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.9 Page 31 / 63 Laboratory During the first 9 months of the incremental recognition: • If the laboratory has a Parent Laboratory that is recognised for the service being added: At least 5 reports issued (with at a minimum one report per product type for which the laboratory seeks for incremental recognition) shall be reviewed and controlled by the Parent Laboratory to ensure correctness of these reports. Parent Laboratory shall report to EMVCo the result of these reviews. Failure to complete testing on 5 products in the allotted time, or poor quality audit results may trigger further interim proficiency audits and/or loss of recognition. • If the laboratory does not have a Parent Laboratory already recognised for the service being added: the first 3 reports issued (per product type for which the laboratory seeks for incremental recognition) shall be fully reviewed and controlled by an EMVCo Qualified Auditor to ensure correctness of these reports. The laboratory shall be responsible for all fees associated with such activity. The EMVCo Qualified Auditor shall report to EMVCo the result of these reviews. Failure to complete testing on 3 products per type approval in the allotted time, or poor quality audit results may trigger further interim proficiency audits and/or loss of recognition Table 5: Incremental Recognition Audit Process, continued ©