PCI Watch

Tracking changes across the Payment Card Industry

SB n° 250: EMV® Contactless Kernel C-4 Update

v2.8 Specification Bulletins
Contactless Acceptance Device

EMV<sup>®</sup> Specification Bulletin No.250 First Edition October 2020 EMV Contactless Kernel C-4 Update This Specification Bulletin describes latest changes and corrections to the EMV Contactless Specifications for Payment Systems Book C-4 Version 2.8.

Applicability

This Specification Bulletin applies to:

  • EMV Contactless Specifications for Payment Systems, Book C-4 Kernel 4 Specification, Version 2.8, April 2019

Related Documents

  • EMV Specification Bulletin No.249, EMV Contactless Book A Update, First Edition October 2020

Effective Date

  • Specification: Effective immediately
  • Testing: 15 October 2020

Description

Af ter Version 2.8 of the EMV Contactless Specifications for Payment Systems was published in April 2019, there have been comments and feedback received from the industry regarding Book C-4. Some of those issues reported have since been corrected by Version 2.9 of the EMV Contactless Specifications for Payment Systems which was published in March 2020. However, the associated new test plan and lab release for Version 2.9 won’t be formally available until early 2021. The purpose of this bulletin is to update Version 2.8 to incorporate some of those key changes both in the specification and in the test plan and lab process, to ensure that devices type approved to Version 2.8 include those key updates. Specification Changes Book C-4 In Section 11.2.3 Card Returns SW = ‘6984’, 2nd paragraph, the table reference for the ‘Try Again’ Final Outcome is corrected from ‘Table 11-4’ to ‘Table 11-3’. The updated paragraph should read as shown below: If the card returns SW=6984 and the transaction has not been restarted, then the kernel returns control to Entry Point, passing a Final Outcome of Try Again with the parameter settings defined in Table 11-3. Else if the card returns SW=6984 and the transaction has been restarted,

countries.

then an error condition has occurred and the kernel returns control to Entry Point with a Final Outcome of End Application and the parameters defined in Table 11-4. In Section 12.2.2 Partial Online Processing, in Table 12-4 Partial Online – Parameter Settings, the Online Response Data is corrected from ‘N/A’ to ‘Any’. The updated table is as shown below: Table 12-4: Partial Online - Parameter Settings Start Online Response Data CVM UI Request on Outcome Present UI Request on Restart Present Data Record Present Discretionary Data Present Alternate Interface Preference Receipt Field Off Request Removal Timeout D Any As determined in section 8.2, Cardholder Verification – Processing Requirements Yes

  • Message Identifier: '1B' ("Authorising, Please Wait")
  • Status: Processing
  • Hold Time: 0
  • Language Preference No Yes Conditional1 N/A N/A N/A Zero countries. In Section 12.2.2 Partial Online Processing, in Table 12-6 Request Online PIN – Parameter Settings, the Online Response Data is corrected from ‘N/A’ to ‘Any’. The updated table is as shown below: Table 12-6: Request Online PIN - Parameter Settings Start Online Response Data CVM UI Request on Outcome Present UI Request on Restart Present Data Record Present Discretionary Data Present Alternate Interface Preference Receipt Field Off Request Removal Timeout D Any Online PIN Yes
  • Message Identifier: '09' ("Please Enter Your PIN")
  • Status: Processing
  • Hold Time: 0
  • Language Preference No Yes Conditional1 N/A N/A N/A Zero countries. In Section 12.2.2 Partial Online Processing, update 12.2.2.2 Requirements – Online Response Processing to: Requirements – Online Response Processing 12.2.2.2 If the ARC indicates ‘Request Online PIN’ then If the following conditions are True:
  • Enhanced Contactless Reader Capabilities Byte 2 bit 7 (Online PIN supported) is set to 1b
  • The Card CVM List – the same used in CVM List Processing, Section 8.2 – contains at least one CV Rule entry where the CVM coded in the first byte of the CV Rule is equal to ‘Enciphered PIN verified online’ then the kernel returns control to Entry Point, passing a Final Outcome of Request Online PIN and parameters set as per Table 12-6. When the Online PIN is captured successf ully, the Terminal must send the transaction online for authorization as def ined in section 12.2, containing the captured Online PIN and the same authorization data from the transaction that initiated the authorization request. Otherwise, the transaction must be declined as per section 13.3. else If all of the following conditions are true:
  • The Enhanced Contactless Reader Capabilities Byte 1 Bit 8 (Contact mode supported) is set to 1b
  • The Card Interface and Payment Capabilities is not present or the Card Interface and Payment Capabilities Byte 1 Bit 6 (Contact EMV Interface Supported) is set to 1b then the kernel returns control to Entry Point, passing a Final Outcome of Try Another Interface and parameters set as per Table 11-1. else the transaction must be declined as per section 13.3 else for any other ARC values the transaction must be declined as per section 13.3. In Section 12.2.2 Partial Online Processing, delete 12.2.2.3 Requirements – Online Response Processing. countries.

Legal Notice

Unless the user has an applicable separate agreement with EMVCo or with the applicable payment system, any and all uses of these Specifications is subject to the terms and conditions of the EMVCo Terms of Use agreement available at www.emvco.com and the f ollowing supplemental terms and conditions. Except as otherwise may be expressly provided in a separate agreement with EMVCo, the license granted in the EMVCo Terms of Use specifically excludes (a) the right to disclose, distribute or publicly display these Specifications or otherwise make these Specifications available to any third party, and (b) the right to make, use, sell, offer for sale, or import any software or hardware that practices, in whole or in part, these Specifications. Further, EMVCo does not grant any right to use the Kernel Specifications to develop contactless payment applications designed f or use on a Card (or components of such applications). As used in these supplemental terms and conditions, the term "Card" means a proximity integrated circuit card or other device containing an integrated circuit chip designed to f acilitate contactless payment transactions. Additionally, a Card may include a contact interface and/or magnetic stripe used to facilitate payment transactions. To use the Specifications to develop contactless payment applications designed f or use on a Card (or components of such applications), please contact the applicable payment system. To use the Specifications to develop or manufacture products, or in any other manner not provided in the EMVCo Terms of Use, please contact EMVCo. These Specifications are provided "AS IS" without warranties of any kind, and EMVCo neither assumes nor accepts any liability f or any errors or omissions contained in these Specifications. EMVCO DISCLAIMS ALL REPRESENTATIONS AND WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT, AS TO THESE SPECIFICATIONS. EMVCo makes no representations or warranties with respect to intellectual property rights of any third parties in or in relation to the Specifications. EMVCo undertakes no responsibility to determine whether any implementation of these Specifications may violate, infringe, or otherwise exercise t he patent, copyright, trademark, trade secret, know-how, or other intellectual property rights of third parties, and thus any person who implements any part of these Specifications should consult an intellectualproperty attorney before any such implementation. Without limiting the f oregoing, the Specifications may provide for the use of public key encryption and other technology, which may be the subject matter of patents in several countries. Any party seeking to implement these Specifications is solely responsible for determining whether its activities require a license to any such technology, including for patents on public key encryption technology. EMVCo shall not be liable under any theory f or any party's inf ringement of any intellectual property rights in connection with these Specifications.

countries.