3DSA Bulletin nº 12: Approval Process Update – ICS and Test Report Expiration

EMV^® 3-D Secure Approval Bulletin No. 12 1st Edition March 2020 Approval Process Update - ICS and Test Report Expiration This Approval Bulletin No. 12v1 provides updates on the ICS and Test Report expiration, incorporated into the EMV^® 3-D Secure Approval – Administrative Process version 1.1 publication

Applicability

This approval bulletin applies to the ICS and Test Report validity defined in the EMV^® 3-D Secure product approval process. Related documents

• EMV^® 3-D Secure Approval – Administrative Process version 1.1 Deleted text is identified using strikethrough, and red font is used to identify changed text. Unedited text is provided only for context

Effective Date

Immediately

Description

The 3-D Secure Approval process is updated to extend the validity of the ICS form and the Test Report.

• The ICS validity is extended to 90 calendar days (previously 45 calendar days)
• The Test Report validity is extended to 90 calendar days (previously 45 calendar days) It is reminded to the Product Providers that all the steps required to obtain a Letter of Approval (LoA) for a 3DS component have to be performed within the 90-day validity period of the ICS. This includes
• The delivery of the Test Report for the tested component to EMVCo by the Laboratory
• The reception of the Request for Approval from the Product provider
• The reception of the payment of the approval fee by the Product Provider to EMVCo If the 3 above steps are not completed within the validity period of the ICS form, the Product Provider shall restart compliance testing, send a new ICS and deliver a new test report. It is also reminded that the Product Provider may send to EMVCo the Request For Approval as early as possible (as soon as the ICS form has been approved by EMVCo and before the Test Report is prepared by the Laboratory) to ensure enough time to manage the fee payment (section 4.5 of the 3-D Secure Approval – Administrative Process). The modifications made into this Approval Bulletin supersedes the content of the EMV^® 3-D Secure Approval – Administrative Process version 1.1 and apply immediately. The changes will be incorporated into the version 1.2 of the EMV^® 3-D Secure Approval – Administrative Process at a later stage. countries. Detailed Changes The detailed modification made to 3-D Secure Approval – Administrative Process version 1.1 are described below:

4.3.1 Testing Steps Note: An Approved ICS is valid for 90 45 calendar days

If the related Request For Approval is not submitted and the invoice is not paid within that period, all related documents to this approval request are no longer valid (ICS, RFA, report) and the Product Provider needs to restart a new process from the beginning by submitting a new ICS. If an approved ICS has expired, the Test Laboratory will evaluate if new Pre-Compliance Testing is also required in addition to Compliance Testing, given the potential for product component modifications or the new Test Plan releases and the rules defined in this section. In such cases the payment of the first invoice is not reimbursed and a new invoice will be created.

4.4 Product Provider Preparation for Approval Request The Product Provider determines whether the test results validated by Laboratory will be submitted to EMVCo for evaluation. Submitting test results to EMVCo for evaluation indicates Product Provider acceptance that the test results are a true representation of 3DS Component performance. Test Report may be submitted to EMVCo for evaluation up to 90 45 calendar days from the date they are generated by the Test Laboratory. Test results that exceed the 90 45 calendar days validity period have expired and cannot be submitted. 3DS Component re-testing is required to create a current Test Report if the validity period is exceeded and EMVCo evaluation is desired (Test Laboratory will evaluate if new Pre-Compliance Testing is also required). For additional questions, please submit a query via EMVCo’s Query System or to our 3DS Secretariat.

countries.

Legal Notice

This document summarizes EMVCo’s present plans for evaluation services and related policies and is subject to change by EMVCo at any time. This document does not create any binding obligations upon EMVCo or any third party regarding the subject matter of this document, which obligations will exist, if at all, only to the extent set forth in separate written agreements executed by EMVCo or such third parties. In the absence of such a written agreement, no product provider, test laboratory or any other third party should rely on this document, and EMVCo shall not be liable for any such reliance. No product provider, test laboratory or other third party may refer to a product, service or facility as EMVCo approved, in form or in substance, nor otherwise state or imply that EMVCo (or any agent of EMVCo) has in whole or part approved a product provider, test laboratory or other third party or its products, services, or facilities, except to the extent and subject to the terms, conditions and restrictions expressly set forth in a written agreement with EMVCo, or in an approval letter, compliance certificate or similar document issued by EMVCo. All other references to EMVCo approval are strictly prohibited by EMVCo. Under no circumstances should EMVCo approvals, when granted, be construed to imply any endorsement or warranty regarding the security, functionality, quality, or performance of any particular product or service, and no party shall state or imply anything to the contrary. EMVCo specifically disclaims any and all representations and warranties with respect to products that have received evaluations or approvals, and to the evaluation process generally, including, without limitation, any implied warranties of merchantability, fitness for purpose or non-infringement. All warranties, rights and remedies relating to products and services that have undergone evaluation by EMVCo are provided solely by the parties selling or otherwise providing such products or services, and not by EMVCo, and EMVCo will have no liability whatsoever in connection with such products and services. This document is provided "AS IS" without warranties of any kind, and EMVCo neither assumes nor accepts any liability for any errors or omissions contained in this document. EMVCO DISCLAIMS ALL REPRESENTATIONS AND WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT, AS TO THIS DOCUMENT. EMVCo makes no representations or warranties with respect to intellectual property rights of any third parties in or in relation to this document. EMVCo undertakes no responsibility to determine whether any implementation of this document may violate, infringe, or otherwise exercise the patent, copyright, trademark, trade secret, know-how, or other intellectual property rights of third parties, and thus any person who implements any part of this document should consult an intellectual property attorney before any such implementation. Without limiting the foregoing, this document may provide for the use of public key encryption and other technology, which may be the subject matter of patents in several countries. Any party seeking to implement this document is solely responsible for determining whether its activities require a license to any such technology, including for patents on public key encryption technology. EMVCo shall not be liable under any theory for any party's infringement of any intellectual property rights in connection with this document.

countries.