SB n°326: Updates to Book A

EMV® Specification Bulletin No. 326 First Edition, May 2026 Updates to EMV® Contactless Specification Book A – Architecture and General Requirements Applicability This Specification Bulletin applies to: • EMV Contactless Specifications for Payment Systems, Book A, Architecture and General Requirements version 2.11, June 2023 Effective Date: ⚫ 1 April 2027 Description This specification bulletin contains clarifications and corrections to Book A. Details of Changes This specification bulletin discusses changes to the following topics: A. Start D B. Timeout Indicator C. Transaction Disposition Indication Times (shall to should) D. Change On-Device CVM to CDCVM Key Yellow highlights existing text with areas of addition or change. Blue highlights existing text to be deleted. Red text indicates final text; that is, text that has been changed or inserted. © 2026 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® Specification Bulletin No. 326 A. Start D In Section 6.2, Table 6-2, Outcome Parameters: Change: Start Indicates whether Entry Point should be B restarted after the Outcome has been processed, and which Entry Point start location should be used. Typically used in conjunction with an online request and allows for issuer risk management via a variety of approaches, such as a “second presentment” or “present and hold”. C It may also be used to allow card removal to be confirmed, before a kernel is restarted. D N/A First Edition Restart Entry Point from Protocol Activation. If the same card is present, the same kernel will be selected. • Used by Online Request for “two presentments”. • Used by End Application to confirm card removal before restart. • Used by Try Again, which is processed by Entry Point. Restart Entry Point from Combination Selection. Currently only used by Select Next processed internally by Entry Point. Restart Entry Point from Kernel Activation. The same kernel will be selected. There will be no removal procedure and the field will stay on. Used by Online Request for “present and hold” and Request Online PIN for the second submission of online data after entry of online PIN. Do not restart Entry Point. © 2026 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® Specification Bulletin No. 326 To: Start Indicates whether Entry Point should be B restarted after the Outcome has been processed, and which Entry Point start location should be used. Typically used in conjunction with an online request and allows for issuer risk management via a variety of approaches, such as a “second presentment” or “present and hold”. It may also be used to allow card C removal to be confirmed, before a kernel is restarted. D N/A First Edition Restart Entry Point from Protocol Activation. If the same card is present, the same kernel will be selected. • Used by Online Request for “two presentments”. • Used by End Application to confirm card removal before restart. • Used by Try Again, which is processed by Entry Point. • Used by Request Online PIN with field on Restart Entry Point from Combination Selection. Currently only used by Select Next processed internally by Entry Point. Restart Entry Point from Kernel Activation. The same kernel will be selected. There will be no removal procedure and the field will stay on. Used by Online Request for “present and hold” and Request Online PIN with field off for the second submission of online data after entry of online PIN. Do not restart Entry Point. © 2026 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV® Specification Bulletin No. 326 First Edition B. Timeout Indicator In Section 8, POS System Requirements: Change: 8.1.1.21 If the Outcome parameter Removal Timeout has a value other than zero, then the reader shall start a timeout function using the value of the parameter and reset the timeout indicator to 0. When the reader is informed by the terminal of the results of an online authorisation request, it shall stop the timeout function. If the timeout occurs, the reader shall:: • Send a User Interface Request with the following parameters: o Message Identifier: '17' (“Card Read OK. Please Remove Card”) o Status: Card Read Successfully • Set the timeout indicator to 1. To: 8.1.1.21 If the Outcome parameter Removal Timeout has a value other than zero, then the reader shall start a timeout function using the value of the parameter. When the reader is informed by the terminal of the results of an online authorisation request, it shall stop the timeout function. If the timeout occurs, the reader shall:: • Send a User Interface Request with the following parameters: o Message Identifier: '17' (“Card Read OK. Please Remove Card”) o Status: Card Read Successfully © 2026 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. Page 4 EMV® Specification Bulletin No. 326 First Edition C. Transaction Disposition Indication Times (shall to should) In Section 10.3.1, Offline: Change: 10.3.1.1 The time that a POS system takes to indicate an offline transaction disposition shall be a maximum of 250ms. This is between: • The end of the card response to the final application level command and • The start of the transaction disposition as determined by the POS system being displayed to the cardholder. To: 10.3.1.1 The time that a POS system takes to indicate an offline transaction disposition should be a maximum of 250ms. This is between: • The end of the card response to the final application level command and • The start of the transaction disposition as determined by the POS system being displayed to the cardholder. In Section 10.3.2, Online: Change: 10.3.2.1 The time that a POS system takes to indicate an online transaction disposition shall be a maximum of 400ms. This is the sum of the times: • Between the end of the card response to the final application level command and the start of the authorisation request from the terminal • Between the end of the authorisation response received by the terminal and the start of the transaction disposition being displayed to the cardholder. To: 10.3.2.1 The time that a POS system takes to indicate an online transaction disposition should be a maximum of 400ms. This is the sum of the times: • Between the end of the card response to the final application level command and the start of the authorisation request from the terminal • Between the end of the authorisation response received by the terminal and the start of the transaction disposition being displayed to the cardholder. © 2026 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. Page 5 EMV® Specification Bulletin No. 326 First Edition D. Change On-Device CVM to CDCVM In Annex C, update as shown below: Change: Restart flag Internal reader flag that indicates whether a kernel is being started for a new transaction or continuing with an ongoing transaction (e.g. in order to complete online processing, to perform on-device CVM, to recover from a communication error, etc.). To: Restart flag Internal reader flag that indicates whether a kernel is being started for a new transaction or continuing with an ongoing transaction (e.g. in order to complete online processing, to perform CDCVM, to recover from a communication error, etc.). © 2026 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. Page 6 EMV® Specification Bulletin No. 326 First Edition Legal Notice The EMV® Specifications are provided “AS IS” without warranties of any kind, and EMVCo neither assumes nor accepts any liability for any errors or omissions contained in these Specifications. EMVCO DISCLAIMS ALL REPRESENTATIONS AND WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT, AS TO THESE SPECIFICATIONS. EMVCo makes no representations or warranties with respect to intellectual property rights of any third parties in or in relation to the Specifications. EMVCo undertakes no responsibility to determine whether any implementation of the EMV® Specifications may violate, infringe, or otherwise exercise the patent, copyright, trademark, trade secret, know-how, or other intellectual property rights of third parties, and thus any person who implements any part of the EMV® Specifications should consult an intellectual property attorney before any such implementation. Without limiting the foregoing, the Specifications may provide for the use of public key encryption and other technology, which may be the subject matter of patents in several countries. Any party seeking to implement these Specifications is solely responsible for determining whether its activities require a license to any such technology, including for patents on public key encryption technology. EMVCo shall not be liable under any theory for any party’s infringement of any intellectual property rights in connection with the EMV® Specifications © 2026 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. Page 7