3DSA Bulletin nº 9: Activation of the Approval Testing Process for Products Supporting Version 2.2.0 of 3-D Secure Protocol

EMV^® 3-D Secure Approval Bulletin No. 09 First Edition June, 2019 Activation of the Approval Testing Process for Products Supporting Version 2.2.0 of 3-D Secure Protocol

Applicability

This approval bulletin applies to the approval process for the 3-D Secure Products. Related Documents  3-D Secure 2.2.0

• EMV^® 3-D Secure Protocol and Core Functions Specification version 2.2.0
• EMV^® 3-D Secure SDK Specifications version 2.2.0
• EMV^® 3-D Secure Specification Bulletin 214 v1  3-D Secure 2.1.0
• EMV^® 3-D Secure Protocol and Core Functions Specification version 2.1.0
• EMV^® 3-D Secure SDK Specifications version 2.1.0
• EMV^® 3-D Secure Specification Bulletin 204 v5
• EMV^® 3-D Secure Specification Bulletin 205 v1  EMV^® 3-D Secure Specification Bulletin 213 v1 (Applicable to 3-D Secure 2.1.0 and 2.2.0)  3-D Secure Approval Bulletins
• EMV^® 3-D Secure Approval Bulletin 7 v1
• EMV^® 3-D Secure Approval Bulletin 8 v1  EMV^® 3-D Secure Approval – Administrative Process version 1.1  EMV^® 3-D Secure - Implementation Conformance Statement version 1.1  EMV^® 3-D Secure Frequently Asked Question (FAQ)

Effective Date

June 24th 2019

Description

The 3-D Secure Approval process has been updated to support the testing of 3-D Secure Product supporting the version 2.2.0 and 2.1.0 of the 3-D Secure Protocols. On June 24th 2019,

• Product Providers will be able to submit for approval their 3-D Secure Product compliant with version 2.2.0 and 2.1.0 of the 3-D Secure Protocols. This applies to SDK, Server, Directory Server (DS) and Access Control Server (ACS).
• The existing version of the ICS will be suspended and Product Provider will have to use the version 1.1 for all product approvals.
• The new version 1.1 of the 3DS Approval Process will apply to all Product approvals. countries. Impact to the Product providers with new projects:
• Product Providers will be able to select the 3DS protocol version (2.1.0, 2.2.0) supported by their 3DS products when creating a new project on the Platform. For more details, please see the updated Platform Getting Started guide from your Platform vendor.
• When a 3DS Product is created for 3DS 2.2 compliance testing, it will be tested against both 3DS 2.2.0 and the latest 3DS 2.1.0 test plan.
• Please refer to the updated 3DS FAQ document on the EMVCo Website. Impact to the Product providers with in flight projects:
• All Pre-Compliance projects with protocol version 2.1.0 will be upgraded to the latest version of test plan (v2.1.0.18.0). Product Providers must re-execute all test cases including modified and newly added test cases.
• All projects in Compliance with version 2.1.0 (when ICS has been submitted or approved by EMVCo) are not impacted with this platform update and can continue with their current version of the test plan. Impact to the Product Providers with valid 3DS 2.1.0 LOA:
• Existing LOA are not impacted and can be used until their expiry date.
• Product Providers wishing to receive 3DS 2.2.0 LOA will have to follow the approval process to request LOA. - 3DS 2.2.0 Products will be tested against both 3DS 2.2.0 and the latest 3DS 2.1.0 test plan. The latest 3DS 2.1.0 test plan may include updates and changes from the time that your Product received its 3DS 2.1.0 LOA. Please contact your Test Platform Provider and Testing Laboratory to start the testing of a product compliant with version 2.2.0 and 2.1.0 of the 3-D Secure Protocols. For additional information on the changes made to the 3-D Secure Approval process, please contact EMVCo 3DS Secretariat. countries.

Legal Notice

This document summarizes EMVCo’s present plans for evaluation services and related policies and is subject to change by EMVCo at any time. This document does not create any binding obligations upon EMVCo or any third party regarding the subject matter of this document, which obligations will exist, if at all, only to the extent set forth in separate written agreements executed by EMVCo or such third parties. In the absence of such a written agreement, no product provider, test laboratory or any other third party should rely on this document, and EMVCo shall not be liable for any such reliance. No product provider, test laboratory or other third party may refer to a product, service or facility as EMVCo approved, in form or in substance, nor otherwise state or imply that EMVCo (or any agent of EMVCo) has in whole or part approved a product provider, test laboratory or other third party or its products, services, or facilities, except to the extent and subject to the terms, conditions and restrictions expressly set forth in a written agreement with EMVCo, or in an approval letter, compliance certificate or similar document issued by EMVCo. All other references to EMVCo approval are strictly prohibited by EMVCo. Under no circumstances should EMVCo approvals, when granted, be construed to imply any endorsement or warranty regarding the security, functionality, quality, or performance of any particular product or service, and no party shall state or imply anything to the contrary. EMVCo specifically disclaims any and all representations and warranties with respect to products that have received evaluations or approvals, and to the evaluation process generally, including, without limitation, any implied warranties of merchantability, fitness for purpose or non-infringement. All warranties, rights and remedies relating to products and services that have undergone evaluation by EMVCo are provided solely by the parties selling or otherwise providing such products or services, and not by EMVCo, and EMVCo will have no liability whatsoever in connection with such products and services. This document is provided "AS IS" without warranties of any kind, and EMVCo neither assumes nor accepts any liability for any errors or omissions contained in this document. EMVCO DISCLAIMS ALL REPRESENTATIONS AND WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT, AS TO THIS DOCUMENT. EMVCo makes no representations or warranties with respect to intellectual property rights of any third parties in or in relation to this document. EMVCo undertakes no responsibility to determine whether any implementation of this document may violate, infringe, or otherwise exercise the patent, copyright, trademark, trade secret, know-how, or other intellectual property rights of third parties, and thus any person who implements any part of this document should consult an intellectual property attorney before any such implementation. Without limiting the foregoing, this document may provide for the use of public key encryption and other technology, which may be the subject matter of patents in several countries. Any party seeking to implement this document is solely responsible for determining whether its activities require a license to any such technology, including for patents on public key encryption technology. EMVCo shall not be liable under any theory for any party's infringement of any intellectual property rights in connection with this document.

countries.