GB n°60: EMV Contact Chip Features Sunsetting - P1

EMV® General Bulletin No. 60 Third Edition, May 2026 EMV® Contact Chip Features Sunsetting This Bulletin describes EMVCo’s plans for sunsetting certain features in the EMV Contact Chip Specification Applicability This Bulletin applies to: • EMV Integrated Circuit Card Specifications for Payment Systems – Books 1/2/3/4. (Background of the 3rd edition) General Bulletin 60 2nd edition announced that EMVCo is sunsetting selected EMV Contact features in two phases to enhance security, improve usability, and remove obsolete elements. And Phase 1 was already implemented in January 2025 through Specification Bulletin 308. Based on feedback received after Phase 1 implementation, EMVCo decided to allow conditional continued use of Offline Plaintext PIN to enable a more flexible transition for regions where needed. This 3rd edition provides additional clarification on the sunsetting strategy and the Type Approval strategy related to the above changes. The changes made in the 2nd edition are shown in red, and the changes between the 2nd and 3rd editions are shown in blue. For information on the specification changes, please refer to SB308 2nd edition. Description In the late 1990s, certain EMV Contact Chip Specification features were designed to support the rollout of the technology in various marketplaces. While these features played an important role at the time, the evolution of card payments technology and the acceptance landscape means that some are no longer required to ensure seamless and secure payments. In response, EMVCo has worked closely with EMVCo Associates and Subscribers to identify specification features that could be sunsetted and to explore the respective benefits, implications, and considerations of such an action. Following this process, the following features have been selected to be sunsetted with the aim of collectively improving security, optimising the usability of the specifications, simplifying editorial understanding, and removing obsolete or unused features: Security ⚫ Velocity checking ⚫ Static Data Authentication (SDA) ⚫ Offline Plaintext PIN Optimisation ⚫ Combined Cardholder Verification Method (CVM) Editorial ⚫ Plugs and Sockets Obsolete ⚫ Transaction Certificate Data Object List (TDOL) ⚫ Biometric Cardholder Verification Method ⚫ Unused Tags Unused Tags to be sunsetted in Phase 1: o ‘9F04’ (Amount, Other (Binary)) o ‘9F3A’ (Amount, Reference Currency) © 2023 - 2026 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. Page 1 o ‘9F3B’ (Application Reference Currency) o ‘9F43’ (Application Reference Currency Exponent) o ‘81’ (Amount, Binary) o ‘97’ (Transaction Certificate Data Object List (TDOL)) Unused Tags to be sunsetted in Phase 2: o ‘9F45’ (Data authentication code) o ‘A1’ (Biometric Header Template. BHT) o ‘7F60’ Biometric Information Template. BIT) o ‘90’ (Biometric Solution ID) o ‘82’ (Biometric Subtype) o ‘BF4C’ (Biometric Try Counters Template) o ‘81’ (Biometric Type) o ‘DF50’ (Facial Try Counter) o ‘DF51’ (Finger Try Counter) o ‘DF52’ (Iris Try Counter) o ‘BF4A’ (Offline BIT Group Template) o ‘BF4B’ (Online BIT Group Template) o ‘DF53’ (Palm Try Counter) o ‘BF4D’ (Preferred Attempts Template) o ‘DF50’ (Preferred Facial Attempts) o ‘DF51’ (Preferred Finger Attempts) o ‘DF52’ (Preferred Iris Attempts) o ‘DF53’ (Preferred Palm Attempts) o ‘DF54’ (Preferred Voice Attempts) Sunsetting Strategy To avoid excessive updates to the specifications and mitigate the impact on industry stakeholders, EMVCo plans to complete the sunsetting process in two three phases, although the dates may be subject to change. Phase 1 – Features to be sunsetted starting in January 2025 ⚫ Offline Plaintext PIN (unattended) * ⚫ Combined CVM ⚫ Plugs and Sockets ⚫ TDOL ⚫ Unused Tags to be sunsetted in Phase 1 (excluding Tag 9F45) Q1 2025 – Publish Specification Bulletin for Phase 1 in Q1 2025 (Effective date: January 2026) Phase 2 – Features to be sunsetted starting in January 2027 ⚫ Offline Plaintext PIN (attended) * ⚫ SDA (including Tag 9F45) ⚫ Velocity checking ⚫ Plugs and Sockets ⚫ Biometric Cardholder Verification Method ⚫ Unused Tags to be sunsetted in Phase 2 * After the sunset, continued use of Offline Plaintext PIN may be allowed where required to meet region-specific guidance from payment system(s), provided that terminals: i) support a primary configuration without Offline Plaintext PIN in line with the sunset timelines, and, ii) support Offline Plaintext PIN as a secondary configuration, and, iii) are capable of selecting configurations per AID. Q1 2027 – Publish Specification Bulletin for Phase 2 in Q1 2027 (Effective date: January 2028) H2 2027 – Publish Version 4.5 of EMV Integrated Circuit Card Specifications for Payment Systems – © 2023-2026 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. Page 2 Books 1/2/3/4 Type Approval Strategy As part of EMVCo’s standard ongoing maintenance and evolution of the EMV Contact Chip Specifications, any updates to the specifications published prior to April are addressed in the corresponding EMVCo Type Approval annual release the following January. This existing process will ensure that sunsetted features are no longer supported. ⚫ Phase 1: July 2026 – Type Approval update to address features sunsetted in Q1 2025 Specification Bulletin. ⚫ Phase 2: January 2028 – Type Approval update to address features sunsetted in Q1 2027 Specification Bulletin. It should be noted that product providers developing new products should not pre-empt the specification and Type Approval updates before the applicable effective date of Specification Bulletins by removing features that are currently mandatory. However, EMVCo expects that features that are being sunsetted for security reasons can be removed at any time after the specification releases (to be confirmed when the drafts of the specification are made available to the Associates) or as soon as their support is optional in an Implementation Conformance Statement (already the case of the plaintext PIN in the current ICS). Letter of Approval (LoA) Restricted renewal will be possible with a maximum validity of 4 years from the renewal request or 4 years from the Type Approval activation, whichever comes first (so that the validity cannot extend beyond 31st December 2029 30th June 2030 for features sunsetted in Phase 1 and 31st December 2031 for features sunsetted in Phase 2). Secondary Configuration supporting Offline Plaintext PIN can only be submitted until June 30th, 2033, provided the conditions previously defined (selectable per AID) in the Sunsetting Strategy section are met. Queries Any queries should be submitted via the Query System to the appropriate Working Group: - - To “EMV Contact Specification” for any Specification related queries; - To “Card and Mobile Approval” or “Terminal Approval” for any Approval related queries. © 2023-2026 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. Page 3 Legal Notice This document is subject to change by EMVCo at any time. This document does not create any binding obligations upon EMVCo or any third party regarding the subject matter of this document, which obligations will exist, if at all, only to the extent set forth in separate written agreements executed by EMVCo or such third parties. In the absence of such a written agreement, no product provider, test laboratory or any other third party should rely on this document, and EMVCo shall not be liable for any such reliance. No product provider, test laboratory or other third party may refer to a product, service or facility as EMVCo approved, in form or in substance, nor otherwise state or imply that EMVCo (or any agent of EMVCo) has in whole or part approved a product provider, test laboratory or other third party or its products, services, or facilities, except to the extent and subject to the terms, conditions and restrictions expressly set forth in a written agreement with EMVCo, or in an approval letter, compliance certificate or similar document issued by EMVCo. All other references to EMVCo approval are strictly prohibited by EMVCo. Under no circumstances should EMVCo approvals, when granted, be construed to imply any endorsement or warranty regarding the security, functionality, quality, or performance of any particular product or service, and no party shall state or imply anything to the contrary. EMVCo specifically disclaims any and all representations and warranties with respect to products that have received evaluations or approvals, and to the evaluation process generally, including, without limitation, any implied warranties of merchantability, fitness for purpose or non-infringement. All warranties, rights and remedies relating to products and services that have undergone evaluation by EMVCo are provided solely by the parties selling or otherwise providing such products or services, and not by EMVCo, and EMVCo will have no liability whatsoever in connection with such products and services. This document is provided "AS IS" without warranties of any kind, and EMVCo neither assumes nor accepts any liability for any errors or omissions contained in this document. EMVCO DISCLAIMS ALL REPRESENTATIONS AND WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON- INFRINGEMENT, AS TO THIS DOCUMENT. EMVCo makes no representations or warranties with respect to intellectual property rights of any third parties in or in relation to this document. EMVCo undertakes no responsibility to determine whether any implementation of this document may violate, infringe, or otherwise exercise the patent, copyright, trademark, trade secret, know-how, or other intellectual property rights of third parties, and thus any person who implements any part of this document should consult an intellectual property attorney before any such implementation. Without limiting the foregoing, this document may provide for the use of public key encryption and other technology, which may be the subject matter of patents in several countries. Any party seeking to implement this document is solely responsible for determining whether its activities require a license to any such technology, including for patents on public key encryption technology. EMVCo shall not be liable under any theory for any party's infringement of any intellectual property rights in connection with this document. © 2023-2026 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. Page 4