3DSA Bulletin nº 11: Approval Process Update for Specification Bulletins 204v6, 214v2, 222v1 and 223v1

EMV^® 3-D Secure Approval Bulletin No. 11 1st Edition March, 2020 Approval Process Update for Specification Bulletins 204v6, 214v2, 222v1 and 223v1

Applicability

This approval bulletin applies to EMV^® 3-D Secure product approval process. Related specification documents

• EMV^® 3-D Secure Protocol and Core Functions Specification version 2.1.0
• EMV^® 3-D Secure Protocol and Core Functions Specification version 2.2.0
• EMV^® 3-D Secure SDK Specifications version 2.1.0
• EMV^® 3-D Secure SDK Specifications version 2.2.0
• EMV^® 3-D Secure SDK—Device Information Data Version 1.4EMV^® Specification Bulletin No. 204 v6 - 3-D Secure Updates, Clarifications & Errata
• EMV^® Specification Bulletin No. 214 v2 - 3-D Secure 2.2.0 Updates, Clarifications & Errata
• EMV^® Specification Bulletin No. 222 v1 - SDK—Device Information Data Version 1.3
• EMV^® Specification Bulletin No. 223 v1 - SDK - Device Information Data Version 1.4 Updates, Clarifications and Errata
• EMV^® 3-D Secure Approval – Administrative Process version 1.1
• EMV^® 3-D Secure Approval Bulletin No. 1: 3-D Secure Approval Fees

Effective Date

April 18th 2020

Description

EMVCo has released

• the Specification Bulletin 204v6 for the EMV 3DS Protocol and Core Functions Specification 2.1.0,
• the Specification Bulletin 214v2 for the EMV 3DS Protocol and Core Functions Specification 2.2.0,
• the Specification Bulletin 222v1 for the EMV 3DS Device Information Data Version 1.3,
• the Specification Bulletin 223v1 for the EMV 3DS Device Information Data Version 1.4. On the effective date of this Approval Bulletin No 11, the 3DS Test Plan and 3DS Test Platform(s) will be updated to support testing of the above Specification Bulletins countries. Testing Requirements before Effective Date Until the effective date of this Approval Bulletin 11, Products may still be developed and approved according to the EMV^® Specification Bulletins No. 204v5 and No. 214v1 and without supporting EMV^® Specification Bulletins No. 222v1, No. 223v1 Products supporting the EMV^® Specification Bulletins No. 204v6, No. 214v2, No. 222v1, No. 223v1 may start testing against the current version of the Test Plans. However, compliance may only occur when the Test Plans version 2.1.0.21 and version 2.2.0.5 will be activated from April 18th 2020. 3DS TPP and Laboratories will assist your product testing. Testing Requirements at Effective Date On the effective date of this Approval Bulletin No 11, the following rules will apply. A- 3DS Products that do not have an LoA
• All projects in pre-compliance will be tested against the new Test Plan
• Projects in Compliance may continue the testing with the former version of the Test Plan (i.e. Overlapping Period applies)
• Specific Requirements apply to SDK and ACS vendors: Specific Requirements for Device Parameter management o 3DS SDK vendor shall select the correct set of Device Parameters (Android/iOS/Windows/Platform Provider-specific Parameters) in order to successfully perform and complete the approval process; o 3DS SDK vendors shall always utilize the latest Data Version (DV) according to the latest Specification and Specification Bulletins; o 3DS ACS vendors shall support ALL active Data Versions (DV) according to the latest Specification and Specification Bulletins Specific Requirements for UI Orientation support o 3DS SDK for landscape-only devices shall implement the landscape UI definition (E.g. SDK for gaming consoles); o 3DS SDK for portrait-only devices shall implement portrait UI definition; o 3DS SDK for rotatable devices shall implement both landscape and portrait UI definitions; o 3DS SDK providers shall ensure the ICS option(s) correctly reflect the UI definition it supports and perform corresponding test cases during the 3DS approval process B- 3DS SDK Products that do have an LoA:
• Products that have an LoA shall implement the latest Specification Bulletins.
• No testing is required and there will be no new LoA issued. (The major change process described in the 3DS Approval Administrative Process does not apply for the Specification Bulletins covered by this Approval Bulletin.)
• Product providers may still request a retest for an updated LOA subject to fees as described in 3DSA Bulletin No. 1: 3-D Secure Approval Fees. Other non-EMVCo fees (e.g. Test Platform or Test Lab fees) may apply. countries. For additional questions, please submit a query via EMVCo’s Query System or to our 3DS Secretariat. countries.

Legal Notice

This document summarizes EMVCo’s present plans for evaluation services and related policies and is subject to change by EMVCo at any time. This document does not create any binding obligations upon EMVCo or any third party regarding the subject matter of this document, which obligations will exist, if at all, only to the extent set forth in separate written agreements executed by EMVCo or such third parties. In the absence of such a written agreement, no product provider, test laboratory or any other third party should rely on this document, and EMVCo shall not be liable for any such reliance. No product provider, test laboratory or other third party may refer to a product, service or facility as EMVCo approved, in form or in substance, nor otherwise state or imply that EMVCo (or any agent of EMVCo) has in whole or part approved a product provider, test laboratory or other third party or its products, services, or facilities, except to the extent and subject to the terms, conditions and restrictions expressly set forth in a written agreement with EMVCo, or in an approval letter, compliance certificate or similar document issued by EMVCo. All other references to EMVCo approval are strictly prohibited by EMVCo. Under no circumstances should EMVCo approvals, when granted, be construed to imply any endorsement or warranty regarding the security, functionality, quality, or performance of any particular product or service, and no party shall state or imply anything to the contrary. EMVCo specifically disclaims any and all representations and warranties with respect to products that have received evaluations or approvals, and to the evaluation process generally, including, without limitation, any implied warranties of merchantability, fitness for purpose or non-infringement. All warranties, rights and remedies relating to products and services that have undergone evaluation by EMVCo are provided solely by the parties selling or otherwise providing such products or services, and not by EMVCo, and EMVCo will have no liability whatsoever in connection with such products and services. This document is provided "AS IS" without warranties of any kind, and EMVCo neither assumes nor accepts any liability for any errors or omissions contained in this document. EMVCO DISCLAIMS ALL REPRESENTATIONS AND WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT, AS TO THIS DOCUMENT. EMVCo makes no representations or warranties with respect to intellectual property rights of any third parties in or in relation to this document. EMVCo undertakes no responsibility to determine whether any implementation of this document may violate, infringe, or otherwise exercise the patent, copyright, trademark, trade secret, know-how, or other intellectual property rights of third parties, and thus any person who implements any part of this document should consult an intellectual property attorney before any such implementation. Without limiting the foregoing, this document may provide for the use of public key encryption and other technology, which may be the subject matter of patents in several countries. Any party seeking to implement this document is solely responsible for determining whether its activities require a license to any such technology, including for patents on public key encryption technology. EMVCo shall not be liable under any theory for any party's infringement of any intellectual property rights in connection with this document.

countries.