DSB n°331: RRP Requirements for Kernel 2 - Comment period ends 26 June 2026

Draft EMV® Specification Bulletin No. 331 First Edition May 2026 RRP Requirements for Kernel 2 This Draft Specification Bulletin introduces new requirements on the processing of the ERRD Command. Please submit any comments you may have via the EMVCo website at www.emvco.com by June 26, 2026. Applicability This Draft Specification Bulletin applies to: • EMV Contactless Specifications for Payment Systems, Book C-2, Kernel 2 Specification, Version 2.11 – June 2023. Related Documents • None Description This Specification Bulletin introduces Terminal RRP Delay, Mean Terminal RRP Delay, Terminal RRP Spread and Mean Terminal RRP Transmission Time as new parameters associated with the processing of the ERRD Command. It mandates that • the Terminal Spread does not exceed 3 milliseconds (ms). • the declared Terminal Expected Transmission Time For Relay Resistance C-APDU (Tag ’DF8134’) is close to the corresponding measured parameters i.e. the Mean Terminal RRP Transmission Time. It also puts boundaries on the Minimum Relay Resistance Grace Period (Tag ‘DF8132’) and the Maximum Relay Resistance Grace Period (Tag ‘DF8133’). © 2026 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. Specification Changes Add the following terms to Table 1.1-Terminology under section 1.4 Terminology. Terminal RRP Delay: The delay (expressed in milliseconds) between the Terminal sending the RRP C-APDU and having received the RRP R-APDU. This delay is the sum of: • The time required for the Terminal to transmit the ERRD Command C-APDU • The time required for the Card to process the ERRD Command APDU • The time required for the Card to transmit the corresponding ERRD Response (R-APDU) • Any additional internal delay attributable to Terminal processing and/or transmission mechanisms. Note that “Terminal RRP Delay” represents the same measurement as “Time Taken” (from section 6.6) but expressed in milliseconds rather than microseconds. Mean Terminal RRP Delay: The mean Terminal RRP Delay is measured over n samples using a Card that exhibits constant processing and transmission characteristics. Measurements must be adjusted to account for the card type (Type A or Type B). The number of samples n must be determined such that the mean Terminal RRP Delay is estimated with a precision of 1 millisecond and a 99% statistical confidence level. Terminal RRP Spread: The absolute value of the variation in Terminal RRP Delay relative to the Mean Terminal RRP Delay. Mean Terminal RRP Transmission Time: The mean time required for the Terminal to transmit the ERRD Command C-APDU calculated from the Mean Terminal RRP Delay by removing the Card processing and transmission time. Add a new section 3.7.3 “Terminal RRP Variation” under section 3.7 “Relay Resistance Protocol”. 3.7.3 Terminal RRP Spread The Terminal RRP Spread must not exceed 3 milliseconds, for a precision of 1 millisecond and a 99% confidence level. Add a new section 3.7.4 “Terminal Expected Transmission Time For Relay Resistance C-APDU” under section 3.7 “Relay Resistance Protocol”. 3.7.4 Terminal Expected Transmission Time For Relay Resistance C-APDU The declared Terminal Expected Transmission Time For Relay Resistance C-APDU (Tag ’DF8134’) must not deviate from the measured Mean Terminal RRP Transmission Time by more than 1 millisecond. Add a new section 3.7.5 “Relay Resistance Grace Periods” under section 3.7 “Relay Resistance Protocol”. 3.7.5 Relay Resistance Grace Periods If the declared Terminal Expected Transmission Time For Relay Resistance C-APDU is smaller than the measured Mean Terminal RRP Transmission Time, then the Minimum Relay Resistance Grace Period must be less than the maximum allowed Terminal RRP Spread (i.e. 3 milliseconds). If the declared Terminal Expected Transmission Time For Relay Resistance C-APDU is larger than the measured Mean Terminal RRP Transmission Time, then the Maximum Relay Resistance Grace Period must be larger than the maximum allowed Terminal RRP Spread (i.e. 3 milliseconds). The sum of Minimum Relay Resistance Grace Period and Maximum Relay Resistance Grace Period must not exceed 7 milliseconds. © 2026 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. Legal Notice Unless the user has an applicable separate agreement with EMVCo or with the applicable payment system, any and all uses of these Specifications is subject to the terms and conditions of the EMVCo Terms of Use agreement available at www.emvco.com and the following supplemental terms and conditions. The license granted in the EMVCo Terms of Use specifically excludes (a) the right to disclose, distribute or publicly display these Specifications or otherwise make these Specifications available to any third party, and (b) the right to make, use, sell, offer for sale, or import any software or hardware that practices, in whole or in part, these Specifications. Further, EMVCo does not grant any right to use the Kernel Specifications to develop contactless payment applications designed for use on a Card (or components of such applications). As used in these supplemental terms and conditions, the term “Card” means a proximity integrated circuit card or other device containing an integrated circuit chip designed to facilitate contactless payment transactions. Additionally, a Card may include a contact interface and/or magnetic stripe used to facilitate payment transactions. To use the Specifications to develop contactless payment applications designed for use on a Card (or components of such applications), please contact the applicable payment system. To use the Specifications to develop or manufacture products, or in any other manner not provided in the EMVCo Terms of Use, please contact EMVCo. These Specifications are provided "AS IS" without warranties of any kind, and EMVCo neither assumes nor accepts any liability for any errors or omissions contained in these Specifications. EMVCO DISCLAIMS ALL REPRESENTATIONS AND WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT, AS TO THESE SPECIFICATIONS. EMVCo makes no representations or warranties with respect to intellectual property rights of any third parties in or in relation to the Specifications. EMVCo undertakes no responsibility to determine whether any implementation of these Specifications may violate, infringe, or otherwise exercise the patent, copyright, trademark, trade secret, know-how, or other intellectual property rights of third parties, and thus any person who implements any part of these Specifications should consult an intellectual property attorney before any such implementation. Without limiting the foregoing, the Specifications may provide for the use of public key encryption and other technology, which may be the subject matter of patents in several countries. Any party seeking to implement these Specifications is solely responsible for determining whether its activities require a license to any such technology, including for patents on public key encryption technology. EMVCo shall not be liable under any theory for any party's infringement of any intellectual property rights in connection with these Specifications. © 2026 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries.