3-D Secure Implementation Conformance Statement

Export Form Data Import Form Data 3-D Secure Implementation Conformance Statement Version 1.12 ICS Reference Number and Validity Period (for EMVCo administrative use only) ICS Reference Number: Valid from: Valid to: Notice: This ICS form shall be completed for products submitted to receive EMVCo 3DS testing and approval. The form shall be completed in its entirety. Part I - Administrative Product Provider Identification M Company Legal Name: (As listed on the Letter of Registration) M EMVCo Registration Number: Laboratory Identification (provided by the Laboratory) M Company Legal Name: M EMVCo Registration Number: ICS Submission Type M Select submission type: C For any submission except “Initial”, please provide the EMVCo Letter of Approval reference number of the previously approved product: M Is this ICS a replacement of a No previously accepted ICS? C If Yes. Please provide the reference number of the previously accepted ICS: C If Yes, please provide the reason for replacing the ICS: C If Yes, please provide details of the ICS replacement: V260428 Copyright ©2020-2026 EMVCo, LLC. All rights reserved. ICS 3DS – version 1.12 ICS Reference Number: Page 1 of 14 PART II - Submitted Component and Specification Version (only one choice) 3DS SDK (applicable for 3DS Specification 2.2.0) or Default-SDK (applicable for 3DS Specification 2.3.1.x): Split-SDK/Native (applicable for 3DS Specification 2.3.1.x): Standard Limited Split-SDK/Shell (applicable for 3DS Specification 2.3.1.x): Split-SDK/Browser (applicable for 3DS Specification 2.3.1.x): 3DS Server (3DSS): Directory Server (DS): Access Control Server (ACS): Letter of Approval Requested (3DS Protocol Version) Select version of LOA: Specification Bulletins supported by the product Specification Bulletin(s) and Version(s) supported: Bulletin Note: to be filled whatever LOA version is requested Version V260428 Copyright ©2020-2026 EMVCo, LLC. All rights reserved. ICS 3DS – version 1.12 ICS Reference Number: Page 2 of 14 Device Information Data Version supported (if the submitted component is ‘3DS SDK’ or ‘Default-SDK’ or any ‘Split-SDK/x’ variant or Access Control Server) Supported Device Information Data Version Number(s): (Latest version shall be listed for 3DS SDK, Default-SDK or Split-SDK, and all active versions shall be listed for ACS) Laboratory reserved section (for Laboratory administrative use only) Project ID: Product Provider details M Contact name of the person who completed the ICS: O Comments: V260428 Copyright ©2020-2026 EMVCo, LLC. All rights reserved. ICS 3DS – version 1.12 ICS Reference Number: Page 3 of 14 PART IIIa – 3DS SDK Component (to be filled if Section II, submitted Component is ‘3DS SDK’ or ‘Default-SDK’) 3DS SDK Component Identification 3DS SDK Name: 3DS SDK Version: 3DS SDK Build Number: Name of the Operating System used for testing the 3DS SDK: Version of the Operating System used for testing the 3DS SDK: Operating System Version(s) able to support the 3DS SDK: (If multiple Versions of the Operating System are supported, they have to be separated by a space) SDK Regression Testing Applicability (applicable for Default-SDK component compliant with Protocol Version 2.3.1 and when submission type = “Initial”). Regression Testing is defined in the latest Approval Bulletin 29. Note: Regression Testing will only apply if the expiring SDK LOA is still valid when the ICS of the new (replacing) SDK product is submitted Eligibility for Regression Testing on Protocol 2.2.0 Is a previous version of this 3DS SDK product already certified (i.e. expiring LOA) - for 2.2.0 or 2.3.1 protocol, - for the same Operating System, - for the same or lower Operating System Version, - for the same 3DS SDK Component options and features, - and for the same Message Extensions tested (if supported)? Eligibility for Regression Testing on Protocol 2.3.1 Is - answer to previous question = Yes? - expiring SDK supporting protocol version 2.3.1? - UI implementation the same as in the expiring SDK? - and do you confirm that submitted SDK has not undergone any major refactoring? Note: If the response to this question is Yes and the product provider wants to benefit from the regression testing on protocol 2.3.1 for its SDK, an attestation that the UI implementation has not changed and that the SDK did not undergo any major refactoring has to be signed and provided to EMVCo no later than RFA submission. Attestation template can be downloaded from EMVCo website. V260428 Copyright ©2020-2026 EMVCo, LLC. All rights reserved. ICS 3DS – version 1.12 ICS Reference Number: Page 4 of 14 What is the Reference Number of the expiring 3DS SDK LOA? Reference/Requestor Application Are you using the Reference/Requestor Application provided by the Test Platform Provider for the 3DS SDK testing? In case you are using the Test Platform Provider Reference/Requestor Application, did you make any change to this Application? If yes is answered at the previous question, please provide high level description of the changes: 3DS SDK Component Features 3DS SDK is Platform Provider specific (e.g. gaming console, set top box, e-reader, …): - Does the platform support an OOB authentication app on the same device as the merchant app? - Is Cancel Action implemented as a function on an external controller for the platform (e.g. gaming console controller, TV remote controller,…)? Trust List implementation: Please describe implementation 3DS SDK Component Options Supported Device User Interface Mode(s) (of the target merchant application): Type of Device Parameters included in the Device Information: Portrait Landscape V260428 Copyright ©2020-2026 EMVCo, LLC. All rights reserved. ICS 3DS – version 1.12 ICS Reference Number: Page 5 of 14 PART IIIb –Split-SDK Component (to be filled if Section II, submitted Component is any variant of Split-SDK/x) Split-SDK Name: Split-SDK Version: Split-SDK Client Split-SDK Client Identification (not filled if Section II, submitted Component is ‘Split-SDK/Browser’) Split-SDK Client SDK Version: Split-SDK Client SDK Build Number: Operating System Name used for testing the SplitSDK Client: Operating System Version used for testing the Split-SDK Client: Operating System Version(s) able to support the Split-SDK Client: (If multiple Versions of the Operating System are supported, they have to be separated by a space) Split-SDK Regression Testing Applicability (applicable for Split-SDK component compliant with Protocol Version 2.3.1 and when submission type = “Initial”). Regression Testing is defined in the latest Approval Bulletin 29. Note: Regression Testing will only apply if the expiring Split-SDK LOA is still valid when the ICS of the new (replacing) Split-SDK product is submitted Eligibility for Regression Testing on Protocol 2.2.0 Is a previous version of this 3DS Split-SDK product already certified (i.e. expiring LOA) - for 2.3.1 protocol, - for the same Operating System, - for the same or lower Operating System Version, - for the same 3DS Split-SDK client Component options and features, - and for the same Message Extensions tested (if supported)? Eligibility for Regression Testing on Protocol 2.3.1 Is - answer to previous question = Yes? - UI implementation the same as in the expiring Split-SDK? - Do you confirm that submitted Split-SDK has not undergone any major refactoring? Note: If the response to this question is Yes and the product provider wants to benefit from the regression testing on protocol 2.3.1 for its SplitSDK, an attestation that the UI implementation has not changed and that the Split-SDK did not undergo any major refactoring has to be signed and provided to EMVCo no later than RFA submission. V260428 Copyright ©2020-2026 EMVCo, LLC. All rights reserved. ICS 3DS – version 1.12 ICS Reference Number: Page 6 of 14 Attestation template can be downloaded from EMVCo website. What is the Reference Number of the expiring 3DS Split-SDK LOA? Reference/Requestor Application (not filled if Section II, submitted Component is ‘Split-SDK/Browser’) Are you using the Reference/Requestor Application provided by the Test Platform Provider for the Split-SDK testing? If you are using the Test Platform Provider Reference/Requestor Application, did you make any change to this Application? If at the answer to the previous question is yes, please provide high level description of the changes: Split-SDK Client Component Features Split-SDK Client is Platform Provider specific (e.g. gaming console, set top box, e-reader, …): - Does the platform support an OOB authentication app on the same device as the merchant app? (question not applicable if Section II, submitted Component is ‘Split-SDK/Browser’) - Is Cancel Action implemented as a function on an external controller for the platform (e.g. gaming console controller, TV remote controller,…)? Trust List implementation: Please describe implementation Split-SDK Client Component Options Supported Device User Interface Mode(s) (of the target merchant application): Type of Device Parameters included in the Device Information: Portrait Landscape Voice Platform Provider Device Parameters Split-SDK Server Split-SDK Server Version: Split-SDK Server Build Number: Operating System Name or Virtual Machine Name used for testing the Split-SDK Server: Operating System Version or Virtual Machine Version used for testing the Split-SDK Server: In case of Virtual Machine used for testing the Split SDK Server, Name of the underlying Operating System used for testing the Split-SDK Server: V260428 Copyright ©2020-2026 EMVCo, LLC. All rights reserved. ICS 3DS – version 1.12 ICS Reference Number: Page 7 of 14 PART IIIc – 3DS Server Component (to be filled if Section II, submitted Component is ‘3DS Server’) 3DS Server Component Identification 3DS Server name: 3DS Server Version: 3DS Server Build Number: Operating System Name or Virtual Machine Name used for testing the 3DS Server: Operating System Version or Virtual Machine Version used for testing the 3DS Server: In case of Virtual Machine used for testing the 3DS Server, Name of the underlying Operating System used for testing the 3DS Server: 3DS Server Regression Testing Applicability (applicable for 3DS Server component compliant with Protocol Version 2.3.1 and when submission type = “Initial”). Regression Testing is defined in the latest Approval Bulletin 29. Note: Regression Testing will only apply if the expiring 3DS Server LOA is still valid when the ICS of the new (replacing) 3DS Server product is submitted Eligibility for Regression Testing on Protocol 2.2.0 Is a previous version of this 3DS Server product already certified (i.e. expiring LOA) - for 2.2.0 or 2.3.1 protocol, - for the same Operating System, - for the same or lower Operating System Version - and for the same Message Extensions tested (if supported)? Eligibility for Regression Testing on Protocol 2.3.1 Is - answer to previous question = Yes? - expiring 3DS Server supporting protocol version 2.3.1? - and do you confirm that submitted 3DS Server has not undergone any major refactoring? Note: If the response to this question is Yes and the product provider wants to benefit from the regression testing on protocol 2.3.1 for its 3DS Server, an attestation that the 3DS Server did not undergo any major refactoring has to be signed and provided to EMVCo no later than RFA submission. Attestation template can be downloaded from EMVCo website. What is the Reference Number of the expiring 3DS Server LOA? V260428 Copyright ©2020-2026 EMVCo, LLC. All rights reserved. ICS 3DS – version 1.12 ICS Reference Number: Page 8 of 14 PART IIId –Directory Server Component (to be filled if Section II, submitted Component is ‘Directory Server’) Directory Server Component Identification Directory Server Name: Directory Server Version: Directory Server Build Number: Operating System Name or Virtual Machine Name used for testing the Directory Server: Operating System Version or Virtual Machine Version used for testing the Directory Server: In case of Virtual Machine used for testing the Directory Server, Name of the underlying Operating System used for testing the Directory Server: Directory Server Regression Testing Applicability (applicable for Directory Server component compliant with Protocol Version 2.3.1 and when submission type = “Initial”). Regression Testing is defined in the latest Approval Bulletin 29. Note: Regression Testing will only apply if the expiring Directory Server LOA is still valid when the ICS of the new (replacing) Directory Server product is submitted Eligibility for Regression Testing on Protocol 2.2.0 Is a previous version of this 3DS Directory Server product already certified (i.e. expiring LOA) - for 2.2.0 or 2.3.1 protocol, - for the same Operating System, - for the same or lower Operating System Version, - for the same Directory Server Component options, - and for the same Message Extensions tested (if supported)? Eligibility for Regression Testing on Protocol 2.3.1 Is - answer to previous question = Yes? - expiring Directory Server supporting protocol version 2.3.1? - and do you confirm that submitted Directory Server has not undergone any major refactoring? Note: If the response to this question is Yes and the product provider wants to benefit from the regression testing on protocol 2.3.1 for its Directory Server, an attestation that the Directory Server did not undergo any major refactoring has to be signed and provided to EMVCo no later than RFA submission. Attestation template can be downloaded from EMVCo website. What is the Reference Number of the expiring Directory Server LOA? V260428 Copyright ©2020-2026 EMVCo, LLC. All rights reserved. ICS 3DS – version 1.12 ICS Reference Number: Page 9 of 14 Directory Server Component Options Does the Directory Server support Card Range Data File download? (applicable for DS component compliant with Protocol Version 2.3.1) Does the Directory Server support the Partial Cache update? Does the Directory Server support Card Security Code? (applicable for DS component compliant with Protocol Version 2.3.1 or 2.2.0 supporting Bridging Message Extension 2.0) Is the Directory Server able to creates the Ares message on the ACS’s behalf? (applicable for DS component compliant with Protocol Version 2.3.1) Split-SDK Server Signature algorithm supported? (applicable for DS component compliant with Protocol Version 2.3.1) Does the Directory Server support OReq/ORes messages? (applicable for DS component compliant with Protocol Version 2.3.1) PS256 ES256 V260428 Copyright ©2020-2026 EMVCo, LLC. All rights reserved. ICS 3DS – version 1.12 ICS Reference Number: Page 10 of 14 PART IIIe –Access Control Server Component (to be filled if Section II, submitted Component is ‘Access Control Server’) Access Control Server Component Identification Access Control Server Name: Access Control Server Version: Access Control Server Build Number: Operating System Name or Virtual Machine Name used for testing the ACS: Operating System Version or Virtual Machine Version used for testing the ACS: In case of Virtual Machine used for testing the ACS, Name of the underlying Operating System used for testing the ACS: ACS Regression Testing Applicability (applicable for ACS component compliant with Protocol Version 2.3.1 and when submission type = “Initial”). Regression Testing is defined in the latest Approval Bulletin 29. Note: Regression Testing will only apply if the expiring ACS LOA is still valid when the ICS of the new (replacing) ACS product is submitted Eligibility for Regression Testing on Protocol 2.2.0 Is a previous version of this ACS product already certified (i.e. expiring LOA) - for 2.2.0 or 2.3.1 protocol, - for the same Operating System, - for the same or lower Operating System Version, - for the same ACS Component options, - and for the same Message Extensions tested (if supported)? Eligibility for Regression Testing on Protocol 2.3.1 Is - answer to previous question = Yes? - expiring ACS supporting protocol version 2.3.1? - and do you confirm that submitted ACS has not undergone any major refactoring? Note: If the response to this question is Yes and the product provider wants to benefit from the regression testing on protocol 2.3.1 for its ACS, an attestation that the ACS did not undergo any major refactoring has to be signed and provided to EMVCo no later than RFA submission. Attestation template can be downloaded from EMVCo website. What is the Reference Number of the expiring ACS LOA? V260428 Copyright ©2020-2026 EMVCo, LLC. All rights reserved. ICS 3DS – version 1.12 ICS Reference Number: Page 11 of 14 Access Control Server Component Options D.1 – Native UI Does the ACS support text UI (01) Protocol 2.2.0 Protocol 2.3.1 Does the ACS support Single Select UI (02) Does the ACS support Multi Select UI (03) Does the ACS support OOB UI (04) Note: Information UI (07) is mandatory for ACS compliant with Protocol Version 2.3.1 D.2 – HTML UI Protocol 2.2.0 Protocol 2.3.1 Does the ACS support text UI (01) Does the ACS support Single Select UI (02) Does the ACS support Multi Select UI (03) Does the ACS support OOB UI (04) Does the ACS support HTML Other UI (05) Does the ACS support HTML OOB UI (06) Note: Information UI (07) is mandatory for ACS compliant with Protocol Version 2.3.1 V260428 Copyright ©2020-2026 EMVCo, LLC. All rights reserved. ICS 3DS – version 1.12 ICS Reference Number: Page 12 of 14 PART IV – Message Extensions to Test Bridging Message Extension Recurring data? (Not applicable to SDK and Split-SDK) Challenge data? (Not applicable to DS and 3DSS) Additional data? (Not applicable to SDK and Split-SDK) File URL data? (Not applicable to ACS, SDK and Split-SDK) V260428 Copyright ©2020-2026 EMVCo, LLC. All rights reserved. ICS 3DS – version 1.12 ICS Reference Number: Page 13 of 14 Part V - Digital Signatures Laboratory I hereby declare that this ICS document has been reviewed, and that all product information is consistent throughout the ICS. Comments: Signature: EMVCo Approval Secretariat Signature: V260428 Copyright ©2020-2026 EMVCo, LLC. All rights reserved. ICS 3DS – version 1.12 ICS Reference Number: Page 14 of 14