3DSA Bulletin nº 29: 3DS Testing Optimization for all components

EMV® 3-D Secure Approval Bulletin No. 29 Second Edition May 2026 3DS Testing Optimisation for all components Applicability This approval bulletin applies to the approval process for the EMV® 3-D Secure (3DS) ACS, 3DSS, DS and SDK Products. Related Documents • EMV 3-D Secure Approval – Administrative Process – Latest version • EMV 3-D Secure Approval Bulletin No. 30, 1st Edition • EMV 3-D Secure Approval – Implementation Conformance Statement – Latest version Effective Date May 18th, 2026 Description As part of ongoing efforts to further improve 3DS testing process, EMVCo is introducing a new regression testing approach that will apply to all 3DS components 2.3.1. Regression Testing on Protocol Version 2.2.0 Edition 1 of this Approval Bulletin 29 introduced a regression testing approach when testing 3DS protocol 2.2.0 test cases for a 2.3.1 product, provided that: - The products already obtained a previous 3DS LOA 2.2.0 or 2.3.1 for the same Implementation Conformance Statement (ICS) options, features and Operating System (OS). Note that OS version of the previous product may be lower. - The LOA of the previous product is still valid when ICS of the new product is submitted to EMVCo. This approach consists of calculated strategy to retain relevant nominal 2.2.0 test cases and to focus on test cases with removed or modified fields from 2.2.0 to 2.3.1, thus reducing the duration of the 2.2.0 test session. Regression Testing on Protocol Version 2.3.1 This new Edition 2 of Approval Bulletin 29 introduces an additional regression testing approach when testing 3DS protocol version 2.3.1. This approach applies to all 3DS 2.3.1 products, provided that: - The products already obtained a previous 3DS LOA 2.3.1 for the same Implementation Conformance Statement (ICS) options, features and Operating System (OS). Note that OS version of the previous product may be lower. - The product did not undergo major refactoring (attestation required). o i.e major refactoring means for instance the port of the software to another development language or the usage of new libraries to implement the same functionalities. o Please contact EMVCo at EMVCo 3DS Secretariat for questions about eligibility. © 2025-2026 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. Page 1 - In case of Default SDK or Split-SDK, the UI implementation has not been changed (attestation required). Please note that changes made on font, colour, size or boldness of text or on size or shape of logos are not considered as UI implementation changes in the context of this bulletin. - The LOA of the previous product is still valid when ICS of the new product is submitted to EMVCo. Attestation Required: The product provider will have to send a written attestation that the SDK UI implementation has not changed and/or that the product did not undergo any major refactoring no later than submission of the RFA to EMVCo. Attestation template is available on EMVCo website. Note that - The usage of regression testing approach will be documented in the LOA (specific comment added). - This Edition 2 of Approval Bulletin 29 supersedes and sunsets the Approval Bulletin 30 for SDK Products. Please confirm with your Test Platform Provider or Laboratory on the activation and usage of the optimised testing for 2.3.1 products on their test platform. For additional information on the 3DS Testing Optimisation, please contact EMVCo 3DS Secretariat. © 2025-2026 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. Page 2 Legal Notice This document is subject to change by EMVCo at any time. This document does not create any binding obligations upon EMVCo or any third party regarding the subject matter of this document, which obligations will exist, if at all, only to the extent set forth in separate written agreements executed by EMVCo or such third parties. In the absence of such a written agreement, no product provider, test laboratory or any other third party should rely on this document, and EMVCo shall not be liable for any such reliance. No product provider, test laboratory or other third party may refer to a product, service or facility as EMVCo approved, in form or in substance, nor otherwise state or imply that EMVCo (or any agent of EMVCo) has in whole or part approved a product provider, test laboratory or other third party or its products, services, or facilities, except to the extent and subject to the terms, conditions and restrictions expressly set forth in a written agreement with EMVCo, or in an approval letter, compliance certificate or similar document issued by EMVCo. All other references to EMVCo approval are strictly prohibited by EMVCo. Under no circumstances should EMVCo approvals, when granted, be construed to imply any endorsement or warranty regarding the security, functionality, quality, or performance of any particular product or service, and no party shall state or imply anything to the contrary. EMVCo specifically disclaims any and all representations and warranties with respect to products that have received evaluations or approvals, and to the evaluation process generally, including, without limitation, any implied warranties of merchantability, fitness for purpose or non-infringement. All warranties, rights and remedies relating to products and services that have undergone evaluation by EMVCo are provided solely by the parties selling or otherwise providing such products or services, and not by EMVCo, and EMVCo will have no liability whatsoever in connection with such products and services. This document is provided "AS IS" without warranties of any kind, and EMVCo neither assumes nor accepts any liability for any errors or omissions contained in this document. EMVCO DISCLAIMS ALL REPRESENTATIONS AND WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT, AS TO THIS DOCUMENT. EMVCo makes no representations or warranties with respect to intellectual property rights of any third parties in or in relation to this document. EMVCo undertakes no responsibility to determine whether any implementation of this document may violate, infringe, or otherwise exercise the patent, copyright, trademark, trade secret, know-how, or other intellectual property rights of third parties, and thus any person who implements any part of this document should consult an intellectual property attorney before any such implementation. Without limiting the foregoing, this document may provide for the use of public key encryption and other technology, which may be the subject matter of patents in several countries. Any party seeking to implement this document is solely responsible for determining whether its activities require a license to any such technology, including for patents on public key encryption technology. EMVCo shall not be liable under any theory for any party's infringement of any intellectual property rights in connection with this document. © 2025-2026 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. Page 3