EMV® Level 3 Testing Framework – Test Tool Requirements – Version 1.1

EMV Level 3 Testing Framework - Test Tool Requirements v1.1.r EMV® Level 3 (L3) Testing Framework Page 1 / 37 Test Tool Requirements Version 1.1.r October 2025 EMV Level 3 Testing Framework - Test Tool Requirements v1.1.r Page 2 / 37 Legal Notice The EMV® Specifications are provided “AS IS” without warranties of any kind, and EMVCo neither assumes nor accepts any liability for any errors or omissions contained in these Specifications. EMVCO DISCLAIMS ALL REPRESENTATIONS AND WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NONINFRINGEMENT, AS TO THESE SPECIFICATIONS. EMVCo makes no representations or warranties with respect to intellectual property rights of any third parties in or in relation to the Specifications. EMVCo undertakes no responsibility to determine whether any implementation of the EMV® Specifications may violate, infringe, or otherwise exercise the patent, copyright, trademark, trade secret, know-how, or other intellectual property rights of third parties, and thus any person who implements any part of the EMV® Specifications should consult an intellectual property attorney before any such implementation. Without limiting the foregoing, the Specifications may provide for the use of public key encryption and other technology, which may be the subject matter of patents in several countries. Any party seeking to implement these Specifications is solely responsible for determining whether its activities require a license to any such technology, including for patents on public key encryption technology. EMVCo shall not be liable under any theory for any party’s infringement of any intellectual property rights in connection with the EMV® Specifications. EMV Level 3 Testing Framework - Test Tool Requirements v1.1.r Page 3 / 37 Revision Log – Version 1.1 The following changes have been made to the document since the publication of Version 1.0. Version V1.0 V1.1 Date September 2017 April 2018 V1.1.r October 2025 Description First public release of document. Proposed updates following L3 CS qualification “dry-run” and in preparation for L3 TT qualification testing. Includes the following:  Note added to Section 4.1.2, recommending that the L3 Test Tool supplier be present on-site at the L3 QSP during the qualification testing session.  Deletion of the note in Section 4.1.3, stating that an L3 Qualification Testing (QT) tool would not be required a part of the process.  Note added in Section 4.1.3, requiring that the L3 test tool supplier should leave a copy of the tested tool with the L3 QSP as a reference, for a period of one year following successful testing. Editorial changes EMV Level 3 Testing Framework - Test Tool Requirements v1.1.r Page 4 / 37 Contents 1 Introduction ....................................................................................................... 8 1.1 Intended Audience ...................................................................................... 8 1.2 Scope ......................................................................................................... 8 1.3 Document Organization .............................................................................. 8 2 Normative References..................................................................................... 10 2.1 EMVCo L3 Documents ............................................................................. 10 2.2 Terminology and Conventions .................................................................. 10 2.3 Glossary ................................................................................................... 11 3 L3 Test Tool Development .............................................................................. 13 3.1 L3 Test Tool Architectural Overview ......................................................... 13 3.2 Functional Requirements .......................................................................... 14 3.2.1 3.2.2 3.2.3 L3 Test Selection Engine (L3 TSE) ............................................... 14 L3 Test Tool (L3 TT)...................................................................... 14 L3 Card Simulator (L3 CS) ............................................................ 14 3.3 L3 Machine-readable Files Life Cycle ....................................................... 15 3.3.1 Files Content Changes .................................................................. 15 3.3.2 File Format Definition Changes ..................................................... 15 4 L3 Test Tool Qualification Process ................................................................ 16 4.1 Process Overview ..................................................................................... 16 4.1.1 Registration and Licensing ............................................................ 16 4.1.2 Qualification Session Request....................................................... 18 4.1.3 Qualification Session Execution/Analysis ...................................... 19 4.1.4 Qualification Results Reporting ..................................................... 19 4.1.5 Results Review ............................................................................. 20 4.1.6 Qualification .................................................................................. 20 4.1.6.1 Validity of the Letter of Qualification .......................................................20 4.2 L3 Test Tool Qualification Mode................................................................ 20 4.3 Requalification Steps for L3 Test Tools..................................................... 21 5 Post-Qualification Activities ........................................................................... 23 5.1 L3 Test Tool Distribution to Clients ........................................................... 23 5.2 L3 Test Tool Licensing to Other Third Parties ........................................... 23 5.3 Modifications or Terminations Affecting L3 Test Tool Qualifications.......... 23 5.3.1 5.3.2 5.3.3 Supplier making changes to an already-qualified L3 Test Tool or Component ...................................................................................................... 24 Supplier ceasing to offer any EMVCo-qualified L3 Test Tools or Components.................................................................................. 25 Supplier request to terminate L3 Qualification ............................... 25 EMV Level 3 Testing Framework - Test Tool Requirements v1.1.r Page 5 / 37 5.3.4 EMVCo Suspension of L3 Test Tool Qualification ......................... 25 5.3.5 EMVCo Revocation of L3 Test Tool Qualification .......................... 26 5.3.6 EMVCo Changes to L3 Test Tool Requirements ........................... 26 5.3.7 Other Stakeholder-motivated changes .......................................... 27 5.3.7.1 Payment Systems-motivated Changes ..................................................27 5.3.7.2 End User-motivated Changes ................................................................27 5.4 EMVCo Management of L3 Requirements Updates.................................. 29 6 L3 Test Tool Supplier Additional Requirements ........................................... 30 6.1 Business Requirements ............................................................................ 30 6.1.1 6.1.2 6.1.3 6.1.4 6.1.5 6.1.6 Financial and Business Practices .................................................. 30 Legal ............................................................................................. 30 Public Communications ................................................................. 30 Independence ............................................................................... 30 EMVCo Documentation Management ........................................... 31 Changes in Contact Information .................................................... 31 6.2 Security Requirements.............................................................................. 31 6.2.1 6.2.2 6.2.3 Handling Confidential Materials and Information ........................... 31 Test Tool Software Modification .................................................... 32 Network Access ............................................................................ 32 6.3 Technical Requirements ........................................................................... 32 6.3.1 Test Tool Version Management..................................................... 32 6.3.1.1 Documenting L3 Test Tool Change Version History...............................32 6.3.1.2 Version Tracking of Payment Systems Provided Files ...........................33 6.3.2 Implementation of EMVCo L3 Updates.......................................... 33 6.4 Quality Assurance Requirements.............................................................. 33 6.4.1 Test Equipment Hardware and Software Upgrades....................... 33 EMV Level 3 Testing Framework - Test Tool Requirements v1.1.r Page 6 / 37 Figures Figure 3-1: L3 Tools environment and functionalities ....................................... 13 Figure 4-1: Qualification Process Overview ........................................................ 16 EMV Level 3 Testing Framework - Test Tool Requirements v1.1.r Page 7 / 37 Tables Table 2-1: Relevant EMVCo L3 Documents ......................................................... 10 Table 2-2: L3 Glossary .......................................................................................... 11 Table 4-1: Conformance Types............................................................................. 17 Table 4-2: Qualification Mode Requirements ...................................................... 20 Table 4-3: Requalification Steps........................................................................... 22 Table 5-1: Minor vs Major Test Tool Updates ...................................................... 24 Table 5-2: Actions following changes to L3 Test Tool Requirements ............... 27 Table 5-3: Management of L3 Test Tool Requirements Changes ..................... 29 Table 6-1: Example of Change Version History Table ....................................... 33 Table 6-2: Example of Payment Systems File Tracking Table ........................... 33 Table 6-3: Relevant L3 Process Forms ................................................................ 36 EMV Level 3 Testing Framework - Test Tool Requirements v1.1.r Page 8 / 37 1 Introduction With the agreed standardization of key elements related to the development and readiness of Level 3 test tools, EMVCo is building a process to qualify these tools in accordance with requirements specifically intended to ensure consistency in the development, qualification and deployment of tools used for Level 3 testing. This document, EMV® Level 3 (L3) Testing Framework – Test Tool Requirements [L3REQ] outlines a set of requirements applicable to L3 test tool development and readiness. It covers the administrative qualification processes that will be used to assess whether an L3 test tool has correctly implemented the subset(s) of these requirements relevant to the type of qualification for which the L3 tool is submitted. 1.1 Intended Audience This document is intended for use by test tool suppliers seeking EMVCo Level 3 qualification for their test tools, and for test tool suppliers that are seeking to maintain EMVCo Level 3 qualification status for their test tools. 1.2 Scope This document includes the EMVCo L3 test tool qualification processes and requirements applicable to suppliers of those tools. These processes and requirements apply to qualifications for both contact and contactless supporting tools. This document should be used in conjunction with the EMV Level 3 (L3) Testing Framework – Implementation Guidelines [L3FIG], which provide the technical specifications for the features and functions to be supported. 1.3 Document Organization This document is organized as follows:  Chapter 1: Introduction – describes the document’s purpose, its intended audience, and the scope of its content.  Chapter 2: Normative References – includes a list of other related L3 documents, a list of forms related to the L3 test tool qualification process, a description of Terminologies, Conventions and Terms used within the document.  Chapter 3: Level 3 Test Tool Development – provides an architectural overview and describes the functional requirements expected to be developed for each supported component of the L3 test tool.  Chapter 4: L3 Test Tool Qualification Process – includes the requirements and steps related to preparation, submission and qualification for L3 test tools. EMV Level 3 Testing Framework - Test Tool Requirements v1.1.r Page 9 / 37  Chapter 5: Post Qualification Activities – covers the activities related to deployment of the L3 test tool post-qualification, and includes information on drivers for requalification.  Chapter 6: L3 Test Tool Supplier Additional Requirements – outlines the expected business, security and QA requirements from prospective suppliers of L3 test tools.  Annex A: Summary of Roles and Responsibilities – lists the roles and responsibilities for each of the key entities in the L3 test tool qualification process.  Annex B: Relevant L3 Process Forms – provides a list of forms relevant to the L3 qualification process. EMV Level 3 Testing Framework - Test Tool Requirements v1.1.r Page 10 / 37 2 Normative References The following tables list the publications that are referenced in this specification. The latest version, including all published amendments, shall apply unless a publication date is explicitly stated. 2.1 EMVCo L3 Documents Bookmark [L3FRAME] [L3FIG] Table 2-1: Relevant EMVCo L3 Documents Publication Name EMV Level 3 (L3) Testing Framework – Process Enhancements Version Latest available EMV Level 3 (L3) Testing Framework – Implementation Guidelines Latest available 2.2 Terminology and Conventions Throughout this specification, the following specific conventions and meanings shall be applied to these terms:  Shall: Defines a product, system capability or requirement that is mandatory.  May: Defines a product, system capability or requirement that is optional, or a statement that is informative only and is out of scope for this specification.  Should: Defines a product, system capability or requirement that is recommended. EMV Level 3 Testing Framework - Test Tool Requirements v1.1.r Page 11 / 37 2.3 Glossary Table 2-2: L3 Glossary Recognition Activation Date Deactivation Date EMVCo EMVCo Recognised Service Provider EMVCo L3 Bulletin EMVCo L3 Secretariat EMVCo Qualified Test Tool EMV Specifications L3 Tool Engine L3 CTT L3 QSP Formal recognition by EMVCo that a test Service Provider is competent to perform Terminal Integration testing defined by EMVCo L3 procedures. The date that testing against a particular version of the L3 format is available on EMVCo Qualified L3 Tools. The date that testing against a particular version of the test cases is no longer permitted at EMVCo Recognised Laboratories. A Limited Liability Company established to develop and maintain the EMV specifications and administer Tool Qualification against those specifications. An independent, impartial entity that has been audited by an EMVCo Qualified Auditor for compliance with EMVCo requirements and has received a Letter of Recognition from EMVCo entitling it to perform testing on behalf of Payment Systems. TITF notification released to communicate corrections and updates to the L3 documentation and processes. The EMVCo entity that manages the L3 Tool Qualification process. A test tool for which the test tool supplier has received a Letter of Qualification from EMVCo. Technical specifications, including bulletins, updating the specifications, developed and maintained by EMVCo to facilitate global interoperability and acceptance of secure payment transactions, including for use of chip technology in the payment industry. Software and hardware components required to execute the L3 Tool functions. L3 Consolidated Test Tool – an L3 tool that includes all currently defined L3 tool components: L3 Test Selection Engine (L3 TSE); L3 Test Tool (L3 TT); L3 Card Simulator (L3 CS). L3 Tool qualification service provider: An entity recognised by EMVCo to perform the qualification services on submitted L3 test tools; or An independent, impartial entity that has been selected by EMVCo to perform qualification for L3 Tool seeking EMVCo qualification. EMV Level 3 Testing Framework - Test Tool Requirements v1.1.r Page 12 / 37 L3 LoQ Letter of Revocation Qualification Qualification Report Qualification Reference Number Registration Number Specification Bulletin Test Case Terminal Integration Testing Terminal Integration Task Force (TITF) Test Tool Qualification Test Tool Supplier/vendors L3 Letter of Qualification: A formal letter issued to an L3 Test Tool supplier on successful completion of the qualification process; or A written statement that documents the decision of EMVCo that a L3 tool has demonstrated sufficient conformance to EMVCo requirements. A written statement that documents the decision of EMVCo that a test tool is no longer an EMVCo Qualified Test Tool and that the relevant EMVCo legal agreement has been terminated. Process to obtain formal recognition by EMVCo that an L3 tool has sufficiently implemented a particular version of EMVCo files format. Document provided by the Qualification Service Provider containing the qualification results for a L3 Tool. A unique identification number that EMVCo assigns to a specific version of the test tool once that version of the test tool has been qualified. Unique identification number that EMVCo assigns to a test tool supplier, to be used on all communication and reports sent to EMVCo. Notification released to communicate updates to the EMV specifications. A single test scenario of a Test Plan, corresponding to one action by the tester. It is defined by a Payment System for execution of terminal integration or Host message testing. A process implemented and managed by the respective Payment systems, aimed at providing a level of assurance that Payment system-specific requirements and recommendations are being implemented in contact or contactless chip acceptance device designed specifically to interoperate with the Payment Systems’ networks. Task Force established by EMVCo in 2013 with the purpose of examining each of the Payment system’s terminal integration processes, in order to determine the possibilities of aligning key elements of these processes. The process undertaken by each Payment system to provide themselves, Test Tool suppliers and clients with a level of assurance that the tools being used by clients to execute terminal integration testing, will do so in compliance with EMVCo requirements. An entity that submits an L3 Tool to EMVCo for qualification. EMV Level 3 Testing Framework - Test Tool Requirements v1.1.r Page 13 / 37 3 L3 Test Tool Development This section outlines the development requirements for each supported component of the L3 test tool. It includes an architectural overview of the components and the functional capabilities expected. It also includes life cycle details for the machine-readable files to be prepared and distributed by each Payment System. 3.1 L3 Test Tool Architectural Overview The L3 Test Tool architecture, defined by EMVCo, consists primarily of three key components, collectively known as an L3 Consolidated Test Tool (L3 CTT). These components are the:  L3 Test Selection Engine (L3 TSE)  L3 Test Tool Engine (L3 TT)  L3 Card Simulator (L3 CS) The figure below provides an illustration of the CTT and the interaction between its key components. Section 3.2 lists the functional requirements for each of the key components of the L3 CTT. Figure 3-1: L3 Tools environment and functionalities EMV Level 3 Testing Framework - Test Tool Requirements v1.1.r Page 14 / 37 3.2 Functional Requirements Test tool suppliers must ensure the correct development of each supported component of their L3 test tool. These developments must be in accordance with the EMV® Level 3 (L3) Testing Framework – Implementation Guidelines [L3FIG], available on the EMVCo website. 3.2.1 L3 Test Selection Engine (L3 TSE) If a supplier chooses to develop and support the L3 TSE within their test tool or test environment, it must be able to systematically and accurately:  Import any Test Set files provided by Payment Systems  Collect user input about the terminal configuration under test, according to the instructions provided in the Test Set files  Generate Test Session files embedding the applicable test plan (test cases and corresponding pass criteria) based on the terminal configuration information collected and on the instructions provided in the Test Set files.  Export the Test Session files 3.2.2 L3 Test Tool (L3 TT) The L3 test tool engine must be able to systematically and accurately:  Import any Test Session file generated by an L3 TSE  Run the selected test cases, preventing any manual intervention between the execution of test cases (except interventions required as part of the test case, such as key entry and visual inspections of terminal screens or printed receipts, etc.).  Import Card Terminal logs generated by the L3 Card Simulator  Import the online messages generated by the Network Simulators  Perform the applicable Pass Criteria checks  Update the Test Session files accordingly  Export the Test Session files, together with the test session interactions (CardTerminal logs and online messages). Note: The L3 Tool Engine software must be independent of the Payment Systems’ L3 machine-readable Test Set files. This is to ensure that changing a L3 machine-readable Test Set file content does not impact the L3 Tool Engine itself (e.g. adding, modifying or removing a test case, pass criteria, etc.). 3.2.3 L3 Card Simulator (L3 CS) If a supplier chooses to develop and support the L3 Card Simulator (L3 CS) within their test tool, it must be able to systematically and accurately:  Import any machine-readable Card Image provided by Payment Systems  Emulate the answer to the terminal in test requests according the Card Image directives  Retrieve Card-Terminal logs  Export Card-Terminal logs EMV Level 3 Testing Framework - Test Tool Requirements v1.1.r Page 15 / 37 3.3 L3 Machine-readable Files Life Cycle 3.3.1 Files Content Changes Each Payment System reserves the right to release a new version of their Test Sets and/or Card Images at their discretion and in accordance with their own release schedules, following changes to the content of these files. 3.3.2 File Format Definition Changes Whenever changes are introduced to the L3 machine-readable files, EMVCo shall:  Schedule the introduction of the new or updated versions of the L3 machine-readable files  Decide when to phase out the previous version of the L3 machine-readable files. EMVCo will release a bulletin to inform all stakeholders of the new or updated L3 files and their activation date(s). This bulletin will also include the date of deactivation of the old L3 file versions. When requested by EMVCo, the L3 test tool supplier must implement the new L3 file versions in accordance with the requested schedule. EMV Level 3 Testing Framework - Test Tool Requirements v1.1.r Page 16 / 37 4 L3 Test Tool Qualification Process The purpose of EMVCo L3 Test Tool Qualification Process is to validate a test tool supplier’s accurate implementation of the EMVCo L3 test tool requirements, as defined in the [L3FIG]. This process helps to provide a level of assurance to end users that the tools will work in accordance with EMVCo’s and the Payment Systems’ requirements, when used to perform L3 testing. Note: separate from the formal L3 Test Tool Qualification Process defined by EMVCo, an L3 test tool supplier may independently engage the services of the L3 Qualification Service Provider (QSP) to assist them with development, debug or QA assistance testing. 4.1 Process Overview The figure below illustrates the main steps involved in the L3 Test Tool Qualification Process. The subsections that follow explain the requirements for each of these steps. Figure 4-1: Qualification Process Overview 4.1.1 Registration and Licensing The L3 Test Tool qualification process begins with the EMVCo registration of the prospective test tool supplier. The supplier should first download the EMVCo Level 3 Test Tool Supplier Registration Request form [L3 TTREG] from the emvco.com website, complete the required registration details and return the completed form to the L3 Secretariat by email (L3_Secretariat@emvco.com). The [L3 TTREG] form will request information about their company, including a description of their ability to meet EMVCo’s Level 3 developmental and qualification requirements. On receiving the completed form, EMVCo will review its details in order to determine whether the prospective L3 test tool supplier meets the requirements to qualify as a potential candidate for provision of a L3 test tool. Note that, to help assess a potential supplier’s suitability to deliver an L3 test tool, EMVCo reserves the right to request additional conformance details, such as:  Business conformance  Security conformance EMV Level 3 Testing Framework - Test Tool Requirements v1.1.r Page 17 / 37  QA conformance  Technical conformance Conformance Type Business Conformance Security Conformance Table 4-1: Conformance Types Requirements Provide written evidence of: The organization’s executives The services the organization provides If applicable, disclosure that the company is owned by a Product Provider involved in the creation of a terminal Certificate of ownership and/or tax identification number In addition, the test tool supplier may be required to provide EMVCo with the following:  Audited financial statements for the organization  Official Annual Report as required by national or international law and/or regulation. In the event that EMVCo might need to share confidential information with the test tool supplier, evidence of its logical security conformance may be requested. This evidence may be: Included in the test tool supplier procedures and documentation; or Through a written report describing the test tool supplier’s:  Security policy, with particular focus on the logical network security measures  Confidential data protection practices. Quality Assurance (QA) Conformance Provide evidence of quality assurance conformance. This evidence may be in the form of a written report describing the test tool supplier’s procedures for development and maintenance of, and upgrades to, the test suite and test tool engine Technical Conformance Provide evidence of technical conformance. This evidence may be in the form of a summary of technical expertise. If the supplier is considered a suitable candidate for provision of an L3 test tool, EMVCo will provide the test tool supplier with an L3 Test Tool Supplier Registration Packet. This packet contains the following:  A Cover Letter, explaining the contents of the packet and providing some directional instructions  EMVCo Letter of Registration – including the supplier’s unique Registration Number  L3 Test Documentation License Agreement – to enable the licensing of any EMVCo-owned L3 documentation or other support materials to the test tool supplier EMV Level 3 Testing Framework - Test Tool Requirements v1.1.r Page 18 / 37 On receipt of the L3 Test Tool Supplier Registration Packet, the test tool supplier should:  Signed and return two copies of the L3 Test Documentation License Agreement to the EMVCo L3 Secretariat, to enable execution of the licence agreement On receipt of the two copies of the signed L3 Test Documentation License Agreement, EMVCo will:  Co-sign both copies, and return one copy to the test tool supplier  Provide the test tool supplier with the L3 Qualification Packet. This packet will contain: o A Cover Letter, explaining the contents of the packet and providing some directional instructions o Sample L3 Test Set files from each of the participating Payment Systems o Sample L3 Test Card images from each of the participating Payment Systems o A zipped file, containing various attachments referenced in the [L3FIG] document o L3 Test Tool Qualification Testing Request form – for completion and submission to the L3 QSP, indicating the functions and Payment Systems’ requirements being supported on the test tool o Blank Implementation Conformance Statement (ICS) – for completion by L3 TT Supplier o Details of available Level 3 Test Tool Qualification Service Provider(s) (L3 QSP) that are recognised by EMVCo to independently and impartially perform L3 Test Tool qualifications Note: If the supplier is not considered to be a suitable candidate for provision of an L3 test tool, a Letter of Rejection will be sent to them by EMVCo. 4.1.2 Qualification Session Request To make arrangements for the qualification testing session, the test tool supplier must first contact an L3 Test Tool Qualification Service Provider (L3 QSP) - chosen from the list of L3 QSPs recognised by EMVCo to offer this service. The tool supplier and the L3 QSP will agreed on scheduling arrangements for testing and will subsequently execute the necessary Service Agreement for the testing session. EMV Level 3 Testing Framework - Test Tool Requirements v1.1.r Page 19 / 37 The Service Agreement will cover the obligations of both parties: Level 3 Test Tool Supplier shall... The L3 QSP shall…  Deliver a qualification-ready version of  Provide a Fee Schedule to the L3 test the L3 test tool to the L3 QSP for testing tool supplier for their qualification  Confirm that the qualification-ready services version of the test tool has implemented Note: these fees will be determined and the applicable version of the [L3FIG] and administered by the L3 QSP. EMVCo the applicable Test Set files and Card assumes no responsibilities for fees charged Images supplied by the Payment for the qualification service. Systems.  Provide test tool submission instructions  Provide all the necessary documentation to the supplier to enable a seamless qualification effort, including:  L3 Test Tool Architecture description  Installation Guide  L3 Test Tool User Guide Note: EMVCo recommends that, if practical, the L3 Test Tool supplier makes arrangements with the L3 QSP to be present on-site during the qualification testing exercise. That way, any operational or functional issues on the tool can be resolved more efficiently. 4.1.3 Qualification Session Execution/Analysis A test tool qualification testing session is required in order to demonstrate that the EMVCo L3 requirements have been correctly implemented. The L3 QSP performs all the test procedures and test cases that apply to the submitted test tool for the qualification session. The applicable test procedures are determined as follows: If… Then… It is an Initial qualification: Execute the complete L3 test procedure and all applicable test cases Changes were made to a previously qualified L3 test tool component: The L3 QSP will determine the portion of the test procedure and test cases to be executed. An L3 test tool qualification session is considered successful if positive compliance responses are provided for all applicable test procedures and test cases. Each individual version of a supplier’s test tool must complete a qualification session. Note: A copy of the L3 Test Tool that was successfully tested, should be retained by the L3 QSP for the minimum period of one year following qualification testing. 4.1.4 Qualification Results Reporting On completion of an L3 test tool qualification session, the L3 QSP will prepare an L3 Qualification Results Report and send it to the L3 test tool supplier, with a request to submit the report to EMVCo for official test tool qualification. EMV Level 3 Testing Framework - Test Tool Requirements v1.1.r Page 20 / 37 4.1.5 Results Review On receipt of the L3 Qualification Results Report, EMVCo will review the results and determine whether or not to grant L3 qualification of the test tool. Such qualification is based on the tool’s compliance with requirements specified in this document and other Level 3 specification documents. 4.1.6 Qualification Once EMVCo is satisfied that all applicable L3 requirements have been met, a Letter of Qualification (LoQ) will be issued to the L3 test tool supplier. The Letter of Qualification will include:  Supplier details (Name, Business address, contacts, etc.)  The L3 test tool details (Tool Name, Version #, etc.)  L3-qualified component(s)  Reference EMVCo L3 Specifications It may also include reference to any minor and acceptable exceptions noted. 4.1.6.1 Validity of the Letter of Qualification In accordance with EMVCo’s standard policy on approved and qualified product, an L3 test tool Letter of Qualification will normally be valid for a period of three years, commencing from the date of issuance of the letter. Exceptions to this could be based on: An EMVCo decision (e.g. EMVCo L3 files format changes impacting L3 Tool engine software) A Payment System decision (e.g. New or updated Card Images requiring changes to the test tool’s compiler) 4.2 L3 Test Tool Qualification Mode For L3 Test Tool qualification purposes only, suppliers should consider accommodating a test tool “qualification mode” as separate from the normal “production mode” of the test tool. This “qualification mode” would enable specific testing focus on each supported L3 component of the test tool. Such an approach would streamline the qualification effort by the L3 QSP. Note: In “qualification mode” the L3 TSE, L3 TT and L3 CS may each be qualified separately. The following table outlines the Qualification Mode requirements for each L3 component of the test tool. Table 4-2: Qualification Mode Requirements Tool L3 Test Selection Engine (L3 TSE) Requirements In qualification mode, the L3 TSE would enable visibility into the: Import of any Test Set files provided by a Payment System EMV Level 3 Testing Framework - Test Tool Requirements v1.1.r Page 21 / 37 Tool L3 Test Tool (L3 TT) L3 Card Simulator (L3 CS Requirements Collection of user input about the terminal configuration under test, according to the instructions provided in the Test Set files Generation of Test Session files embedding the applicable test plan (test cases and corresponding pass criteria) based on the terminal configuration information collected, and on the instructions provided in such Test Set. Export of the Test Session files In qualification mode, and independent of other L3 test tool components, the L3 TT must enable visibility of the: Import of Test Session file sets (which may be separate from the test tool generated Test Session files) Import of a Card-Terminal log and an Online Message Log, dedicated to verifying the Pass/Fail criteria syntax qualification, without necessarily being connected to the L3 TSE, L3 Card Simulator or the Payment Systems’ Host Simulators. The files referenced above are all “dummy files”, created and provided by EMVCo to enable validation of the test case PASS/Fail Criteria syntax implementation as defined in the [L3FIG]. Since both “dummy” Card-Terminal and Online Message Logs are available for the L3 test tool qualification process, it should be possible for the L3 QSP to perform the Pass/Fail Criteria checks without the need to execute any actual test cases with a “real” terminal. The results must, however, be made available through updates within the relevant Test Session files, similar to a live process. In qualification mode, the L3 CS must enable visibility of the: Import of Card Images containing reference data that will be used to check its behaviour Export of Card-Terminal Logs 4.3 Requalification Steps for L3 Test Tools If Requalification of a previously confirmed L3 test tool becomes necessary for any of the reasons described later in Section 5.3, the test tool supplier will need to follow most of the process steps that were described in Section 4.1 above. These would specifically be as follows: EMV Level 3 Testing Framework - Test Tool Requirements v1.1.r Page 22 / 37 Step: Table 4-3: Requalification Steps Registration and Licensing (Section 4.1.1) Qualification Session Request (Section 4.1.2) Qualification Session Execution/Analysis (Section 4.1.3) Qualification Results Reporting (Section 4.1.4) Results Review (Section 4.1.5) Qualification (Section 4.1.6) Required? Yes No √ √ √ √ √ √ EMV Level 3 Testing Framework - Test Tool Requirements v1.1.r 5 Post-Qualification Activities Page 23 / 37 5.1 L3 Test Tool Distribution to Clients Once EMVCo has granted qualification for an L3 test tool and has issued the corresponding LoQ, the test tool supplier is free to distribute the new release to Clients, and other users, claiming EMV L3 qualification. Each Payment System remains responsible for defining policies around the introduction and usage of new tool releases, taking the L3 qualification validity date provided by EMVCo into account for specific tools. 5.2 L3 Test Tool Licensing to Other Third Parties EMVCo has no restrictions or prohibitions on suppliers providing their L3-qualified test tools to other third party service providers, for the purposes of performing debugging or quality assurance testing. 5.3 Modifications or Terminations Affecting L3 Test Tool Qualifications The status of a qualified L3 test tool may be modified or terminated at any time by the actions of EMVCo, a supplier of the tool or other stakeholders. This may be for any of the following reasons:  Supplier wanting to make changes to their L3 test tool or a component that’s already been qualified  Supplier ceasing to offer a specific type of L3 test tool or component of that tool  Supplier’s decision to discontinue to offer any L3 test tools  EMVCo decision to suspend a test tool’s L3 qualification  EMVCo decision to revoke a test tool’s L3 qualification  EMVCo making changes to any of its L3 test tool or qualification requirements  Stakeholder-motivated changes, including observations and reporting of operational issues while using the test tool The following subsections provide additional details. EMV Level 3 Testing Framework - Test Tool Requirements v1.1.r Page 24 / 37 5.3.1 Supplier making changes to an already-qualified L3 Test Tool or Component If a test tool supplier intends to make changes to their existing EMVCo-qualified test tool or a qualified component thereof, they are required to notify EMVCo of these planned changes. This notification will allow EMVCo to determine whether or not the changes or updates proposed on the test tool will likely impact the execution of its L3 testing capability. If so, EMVCo may require re-qualification of the test tool in order to preserve the integrity of its L3 testing capability. The process by which EMVCo determines whether re-qualification is required, and if so, the level of testing that needs to be performed will be dependent on the type of change or update made to the L3 test tool. Changes may either be categorized as: Table 5-1: Minor vs Major Test Tool Updates Category Description Minor Major Not impacting functionality of any of the following:  Execution of a Test Case condition or outcome of a test result  Test Selection Engine  L3 Test Tool engine  L3 Card Simulator Impacting functionality of any of the following:  Execution of a Test Case condition or outcome of a test result  Test Selection Engine  L3 Test Tool engine  L3 Card Simulator Requalification Required? Yes No √ √ If a change is considered by EMVCo to be minor, the timing of implementing that change and subsequently deploying to users of the L3 test tool is at the discretion of the test tool supplier. However, they must still inform EMVCo of this deployment. Note: if a supplier chooses to introduce a new or additional component to their test tool (for example, introduction of an L3 Test Selection Engine (TSE)) that doesn’t necessitate changes to an existing tool or component that has already been qualified, no requalification of the existing tool or components will be necessary. However, the new or additional component will need to separately undergo an Initial Qualification, following the steps detailed in Section 4, but again skipping the Registration procedure. EMV Level 3 Testing Framework - Test Tool Requirements v1.1.r Page 25 / 37 5.3.2 Supplier ceasing to offer any EMVCo-qualified L3 Test Tools or Components If a supplier decides to cease offering a specific type of L3 test tool or component of that tool that has already been qualified by EMVCo, they must send written notification to EMVCo requesting removal of that test tool or component from EMVCo’s list of qualified L3 test tools. In response to such a request, EMVCo will:  Send the L3 test tool supplier a letter confirming Termination of Qualification of the relevant L3 Test Tool or component  Update the list of Qualified L3 Test Tools on the EMVCo website, removing the suppliers L3 Test Tool from that list. Note: Clients already using a L3 test tool or a component of that tool that was subsequently removed from the EMVCo list of Qualified L3 Test Tools will need to contact their respective Payment Systems for guidance on policies regarding ongoing use of withdrawn L3 test tools. 5.3.3 Supplier request to terminate L3 Qualification If a supplier has made the decision to cease to offer any EMVCo-qualified L3 test tools, they must send written notification to EMVCo requesting termination of qualification. In response to such a request, EMVCo will:  Send the L3 test tool supplier a letter confirming Termination of Qualification of the L3 Test Tool. The letter will also:  Confirm termination of any L3 License Agreement actively in place between the test tool supplier and EMVCo.  Instruct the test tool supplier to either destroy or return to EMVCo any proprietary or confidential documentation or materials that is the property of EMVCo  Update the list of Qualified L3 Test Tools on the EMVCo website, removing the suppliers L3 Test Tool from that list. Note: Clients already using a L3 test tool or a component of that tool that was subsequently removed from the EMVCo list of Qualified L3 Test Tools will need to contact their respective Payment Systems for guidance on policies regarding ongoing use of terminated L3 test tools. 5.3.4 EMVCo Suspension of L3 Test Tool Qualification EMVCo may temporarily suspend qualification of one or numerous versions of a supplier’s L3 test tool. This could occur, for example, if a supplier fails to notify EMVCo, a Payment System or any Clients of any updates made to the tool that were later discovered. If the qualification of one version of the L3 tool is suspended, EMVCo will remove that specific version of the L3 tool from the list of Qualified L3 Tools on the EMVCo website and notify the supplier accordingly. If qualification of all versions of the L3 tool are suspended, EMVCo will remove the names of the L3 test tools and all versions of it from the list of Qualified L3 Tools on the EMVCo website and notify the supplier accordingly. EMV Level 3 Testing Framework - Test Tool Requirements v1.1.r Page 26 / 37 To re-instate qualification of the tool or any of its versions, the supplier may be required by EMVCo to undergo a re-qualification effort, as described in Section 7. 5.3.5 EMVCo Revocation of L3 Test Tool Qualification In more extreme circumstances, EMVCo may revoke qualification of an L3 test tool. Such action may be considered for any of the following reasons: If a test tool supplier fails to notify EMVCo or Clients using the L3 tool that an update has been made and subsequently refused to undergo the re-qualification procedure If the L3 test tool supplier fails to comply with the terms of the EMVCo License Agreement, specifically regarding the implementation of L3 updates applicable to the type of tool to which the qualification applies If the test tool supplier is in breach of any of the terms or conditions set forth in the LoQ or the EMVCo L3 License Agreement. If a decision is made to revoke qualification of an L3 test tool, EMVCo will: Send the test tool supplier a Letter of Revocation Terminate the EMVCo L3 License Agreement Remove the test tool’s name from the list of Qualified Test Tools on the EMVCo website. Once a qualification has been revoke, the test tool supplier must promptly return all EMVCoproperty or confidential information to EMVCo. Alternatively, if so directed by EMVCo, the test tool supplier shall destroy all confidential information, and all copies thereof, in their possession or control. A signed document by an officer of the company, confirming such destruction would be acceptable to EMVCo. 5.3.6 EMVCo Changes to L3 Test Tool Requirements EMVCo reserves the right to release updates to its [L3FIG] or [L3REQ] documents on a periodic basis. Updates to any of these documents will be communicated through the release of an L3 Bulletin, detailing the expected impacts of the updates. Such updates may necessitate corresponding test tool updates and possibly requalification requirements of L3 test tools already qualified by EMVCo. Note: It remains at the test tool supplier’s discretion whether or not to apply updates and subsequently submit their test tool for requalification. If a supplier chooses not do so, the test tool will retain its qualification only for the previous version of the EMVCo L3 Requirements. Changes to these L3 Test Tool Requirements by EMVCo may also necessitate modification to a supplier’s test tool qualification. If this is the case, EMVCo will initiate the Bulletin publication process as described in Section 7.1. Depending on the status of the L3 test tool at the time of the Bulletin’s release, difference actions may be required by the test tool supplier. The table outlines the actions to be taken by the test tool supplier, depending on the current status of their test tool. EMV Level 3 Testing Framework - Test Tool Requirements v1.1.r Page 27 / 37 Table 5-2: Actions following changes to L3 Test Tool Requirements Tool Status The L3 test tool has already been qualified, and in some cases, may have already been deployed in the field The L3 test tool is currently undergoing qualification testing with the L3 QSP L3 Requirements have been implemented on the test tool, but the tool has not yet been submitted for qualification Required Actions Since the EMVCo released Bulletin will include details of the specific changes to be made within the L3 Test Tool Requirements document, along with any actions to be taken by L3 test tool suppliers, on release of the Bulletin, a supplier with an L3 test tool in this status shall: Ensure implementation of any relevant updates, in the timeline specified in the Bulletin If applicable, follow the EMVCo re-qualification requirements described in the Bulletin in order to preserve the test tool’s qualification status Inform customers of changes required and timeline for implementation Since the EMVCo released Bulletin will include details of the specific changes to be made within the L3 Test Tool Requirements document, along with any actions to be taken by L3 test tool suppliers, on release of the Bulletin, a supplier with an L3 test tool in this status shall ensure immediate implementation of any relevant updates, prior to completion of qualification testing. Since the EMVCo released Bulletin will include details of the specific changes to be made within the L3 Test Tool Requirements document, along with any actions to be taken by L3 test tool suppliers, on release of the Bulletin, a supplier with an L3 test tool in this status shall ensure implementation of any relevant updates, prior to submission for qualification testing. 5.3.7 Other Stakeholder-motivated changes The actions of other stakeholders such as Payment Systems and end users of the L3 test tools may also motivate changes to the L3 requirements and/or test tools. The nature of the changes will determine is qualification of test tools will be affected. 5.3.7.1 Payment Systems-motivated Changes From time to time, Payment Systems may want to introduce new requirements, and the ability to use existing qualified L3 test tools to test and validate these new requirements may be constrained by the current definitions of the L3 requirements and the capabilities of the L3 test tool. EMVCo has processes in place to manage the introduction of new required features and capabilities. From an L3 perspective, these will managed through the process described in Section 5.4 of this document. 5.3.7.2 End User-motivated Changes Observations and reports submitted to EMVCo by end users of the test tools, such a clients, their processors and other service providers, may also motivate updates to EMVCo’s L3 Requirements. Such observations or reports would typically be submitted by the EMVCo Query EMV Level 3 Testing Framework - Test Tool Requirements v1.1.r Page 28 / 37 System and managed by the Level 3 Testing Group (L3TG). There’s also the possibility operational issues could be reported directly to the test tool suppliers. Once notified of an L3 query via EMVCo’s Query Management System, the L3TG will investigate it to decide on the appropriate action to take. Possible outcomes might be for:  EMVCo to update one or multiple L3-related documents – if this is the outcome, EMVCo will initiate the Updates Management Process as described in Section 5.4 below  One or multiple L3 Test Tool suppliers need to subsequently update their test tool and possibly request requalification – if this is the outcome, the suppler will need to follow the process as described in Section 5.3.1. EMV Level 3 Testing Framework - Test Tool Requirements v1.1.r Page 29 / 37 5.4 EMVCo Management of L3 Requirements Updates EMVCo already has a process in place for managing the development, review and publication of Bulletins related to Specification changes, etc. This process will be applied for the management of Bulletins related to changes in the L3 Test Tool requirements documents. The table below identifies the steps to be taken in effecting the release of a Bulletin related to changes in the L3 Test Tool requirements. Table 5-3: Management of L3 Test Tool Requirements Changes Entity: EMVCo EMVCo Technical Associates & Subscribers (Inc. L3 TT suppliers) EMVCo EMVCo EMVCo Action: Receive and agree on submitted new requirements request Create and publish on the EMVCo website for Technical Associates and Subscribers’ review, a Draft L3 Bulletin, detailing the changes proposed to the affected L3 document(s) and the requirements for L3 Test Tool requalification Review and provide EMVCo with feedback to Draft L3 Bulletin, including:  L3 Test Tool suppliers confirmation of the feasibility implementing changes by the stated Effective Date, or requests for adjustment to the timeline  Notifies EMVCo of any additional requirements other than those specified in the Bulletin, that also need to be qualified on the L3 Test Tool During the Public Review & Comments period:  Work with stakeholders to resolve any implementation timeline issues, confirming or adjusting the timelines/effective dates as necessary At the end of the Public Review & Comments period (or sooner, if EMVCo decides that an expedited publication is necessary), assess comments received and apply necessary updates the L3 requirements document Publish finalized Bulletin along with the updated L3 requirements on the EMVCo.com website Work with L3 QSP to implement any new L3 test cases that may be required EMV Level 3 Testing Framework - Test Tool Requirements v1.1.r Page 30 / 37 6 L3 Test Tool Requirements Supplier Additional In order to obtain and maintain L3 test tool qualification, a test tool supplier must satisfy all relevant requirements set out in this document. Additionally, the requirements described in the subsections that follow must also be met. 6.1 Business Requirements This section describes the business requirements that a test tool supplier must meet. 6.1.1 Financial and Business Practices The test tool supplier shall: Be financially sound Conduct business in a manner that is consistent with the highest ethical business standards and with practices that minimize risk Be free of any fraudulent or criminal charges Note: the test tool supplier may be subject to a review, with the primary focus of identifying and mitigating any potential financial and goodwill risks. 6.1.2 Legal The test tool supplier must be recognized as a legal entity and must be (or must be part of) an organization that is registered as: A tax-paying business; or Having a tax exempt status; or A legal entity in some form with a national body. The test tool supplier must be able to sign and abide by all EMVCo legal agreements for L3 test tool suppliers. 6.1.3 Public Communications Since a key goal of the L3 test tool qualification process is to make best efforts to ensure that any EMVCo-qualified test tool used for performing L3 testing, is acceptable for the purpose, a supplier of such a tool shall make no claims to the contrary in their marketing material. The test tool supplier shall not, under any circumstances, communicate nor disclose to any other party that test tool has or has not been qualified by EMVCo prior to receiving the EMVCo Letter of Qualification (LoQ). EMVCo, not the test tool supplier, shall be the final party to determine whether a particular test tool conforms to the EMVCo L3 requirements. The test tool supplier must comply with the conditions detailed in the LoQ about public communications/advertising/marketing. 6.1.4 Independence The test tool supplier shall: EMV Level 3 Testing Framework - Test Tool Requirements v1.1.r Page 31 / 37 Be able to demonstrate independence from any EMV acceptance products undergoing L3 testing Only receive communication and direction related to the L3 processes from EMVCo Disclose to EMVCo, in writing, if their company is owned by a product provider involved in the development or provision on an EMV acceptance product 6.1.5 EMVCo Documentation Management The test tool supplier must have procedures in place to manage, and must maintain records of relevant EMV L3 requirements, bulletins, and L3 qualification documentation updates and implementation dates authorized by EMVCo. 6.1.6 Changes in Contact Information The test tool supplier must inform the EMVCo L3 Secretariat if the company name, ownership, legal entity status, address, or contact information changes from that which is stated on the test tool supplier’s Request for Registration and L3 Test Documentation License Agreement. Changes impacting company name, ownership, or legal status may require a new Test Document License Agreement with EMVCo. Generally, LoQs are not reissued when name changes are the result of corporate mergers or sales. Modifications to company addresses and contact information will be applied to the EMVCo website and to subsequent communications (e.g. notifications of test case updates, qualification notifications). Contact information changes will be applied to all listed EMVCo Qualified Test Tools unless specifically stated on the request. 6.2 Security Requirements The test tool supplier must maintain and comply with a logical security policy that includes, at a minimum, the requirements outlined below. 6.2.1 Handling Confidential Materials and Information Confidential materials and information provided to the L3 test tool supplier by EMVCo, such as L3 Test Samples, L3 documents, L3 Test Set files, etc., to assist with their L3 test tool development and qualification efforts shall be handled with particular care. These materials and information shall be kept securely within the company’s environment, and shall only be accessible to persons authorized by the business’s management to receive them for the purposes of their work effort. These materials must be controlled and stored securely whether in electronic or paper format. Receipt of restricted information must be acknowledged by signature of the company’s official representative. In general, test tool suppliers must hold in strict confidence any confidential information received from L3 stakeholder entities. Confidential documents must be stored securely by the recipient. When an entity grants permission to the test tool supplier to release confidential information to EMVCo, this information may be released only to EMVCo. The EMVCo L3 Secretariat may release information to appropriate working group members within EMVCo for purposes of process improvement. Disclosure of any stakeholder data or documents to third parties must be authorized in writing by an officer of the company that owns the data or documents to be released. EMV Level 3 Testing Framework - Test Tool Requirements v1.1.r Page 32 / 37 . 6.2.2 Test Tool Software Modification Personnel not involved in test development shall not be able to modify in any way the test tool development environment nor the test tool itself, including the L3 test tool engine. 6.2.3 Network Access Any computers used to store secure information (EMVCo data, Client or Service Provider data, Product Provider data, etc.) must not be connected to any network (external or internal) that allows unauthorized personnel access. If the test tool supplier uses a non-dedicated network, suitable controls must be in place to protect the integrity of the data within the test tool supplier’s company. These controls include the use of firewalls and routers that offer sufficient security levels for the data being handled. Networks that link separate test tool supplier premises must use the network controls described above, and all security sensitive data must be encrypted when using such networks. The test tool supplier must have a secure method of transferring EMVCo data to its systems and computers that does not introduce security risks or vulnerabilities. 6.3 Technical Requirements This section describes the technical requirements that the test tool supplier must meet. These specifically cover the test tool’s version management process and implementation of required updates. 6.3.1 Test Tool Version Management As part of the implementation of an L3 Test Tool Version Management process, the test tool supplier shall assign a unique Test Tool Version Identifier (version number) to each EMVCoqualified test tool or component of that tool. With each subsequent change or modification to an EMVCo-qualified test tool or component, the test tool supplier shall: Update the Version Identifier Maintain a change history, describing all modifications or changes made within each version of each test tool or component. 6.3.1.1 Documenting L3 Test Tool Change Version History As a means of identifying and communicating test tool implementation updates to stakeholders, EMVCo recommends that test tool suppliers utilize a Change History Table. The Change History Table would provide detailed information concerning the nature of the change to the test tool, the reason for the change, the assigned Version Identifier and the date on which the change was implemented or (if required) qualified by EMVCo. Note: If the changes or modifications made require EMVCo re-qualification, it may be helpful for the supplier to provide EMVCo with the Change History Table when submitting the test tool or component for re-qualification. The table below provides a sample Change History Table that may be used by the test tool supplier as part of their version management process: EMV Level 3 Testing Framework - Test Tool Requirements v1.1.r Page 33 / 37 Table 6-1: Example of Change Version History Table Test Tool/Component Description Test Tool/Component Version Number Description of Changes Made EMVCo Qualification Date Release Date to Clients 6.3.1.2 Version Tracking of Payment Systems Provided Files Although the Test Set files and Test Card images being created by the Payment Systems will be assigned version tracking numbers by the respective Payment Systems, EMVCo recommends that L3 test tool suppliers receiving these files for incorporation into their tools should develop and maintain a tracking process for all the Payment Systems provided machine readable files. An example of a Payment System File Tracking Table is shown below: Table 6-2: Example of Payment Systems File Tracking Table Payment System L3 Test Set/Images Version Number Description of Changes Made Release Date 6.3.2 Implementation of EMVCo L3 Updates The test tool supplier must implement any updates to the EMVCo L3 requirements, as specified in the EMVCo Test Document License Agreement. See Section 5.4 for details of how EMVCo handles these changes. 6.4 Quality Assurance Requirements This section describes the quality assurance requirements that a test tool supplier must meet. The test tool supplier must have software configuration management or version control and documented procedures, to ensure a high quality of development, maintenance, and upgrades. 6.4.1 Test Equipment Hardware and Software Upgrades Test equipment hardware, hardware systems, and software must be protected from unauthorized modification. There must be a documented procedure signing the equipment over to development and authorizing the equipment for release to customers. With each modification made to the test suite or test tool engine, the test tool supplier must increment the corresponding version number. Note: EMVCo does not expect the test tool supplier to supply a new build of the entire software package to their customers for every revision. However, EMVCo does expect the test tool engine version to be incremented with each modification. This version control will allow EMVCo to track each version, and to understand which version was applied to a particular test report for a Terminal product. EMV Level 3 Testing Framework - Test Tool Requirements v1.1.r Page 34 / 37 Annex A Summary of Roles and Responsibilities This Annex summarized the roles and responsibilities of the three key entities in the L3 test tool qualification process. A.1 EMVCo EMVCo’s roles and responsibilities include the following. EMVCo:  Owns, defines, and maintains the EMV specifications  Communicates any L3 specifications or guideline updates and their effective dates  Defines L3 tool qualification requirements  Selects and recognises a Qualification Service Provider to coordinate execution of qualification sessions  Determines whether an L3 tool should be granted EMVCo qualification  Publishes on the EMVCo website when the qualification of a L3 tool has been granted, suspended, or revoked  Maintains a list of EMVCo qualified L3 tools on the EMVCo website. A.2 L3 Test Tool Supplier The L3 test tool supplier’s roles and responsibilities include the following. Test tool suppliers:  Register with EMVCo  Notify EMVCo of any change in contact information  Satisfy all test tool supplier requirements specified in this document  Implement the EMVCo L3 specifications and guidelines  Complete the qualification processes defined by EMVCo to demonstrate that EMVCo L3 specifications and guidelines have been correctly implemented  Pay the Qualification Service Provider the required fee for each qualification session  Authorize the Qualification Service Provider to send Qualification Session Reports to EMVCo  Provide feedback on the EMVCo L3 specifications and guidelines to EMVCo and confirm feasibility of the Effective Date of the L3 Tool updates  Notify EMVCo and all parties using the L3 tool of any changes made to the L3 tool engine beyond editorial fixes and typos  Maintain a Change History Table  Inform EMVCo of any issues found with its qualified tool after receiving a Letter of Qualification  Comply with all conditions in the Letter of Qualification and the Test Document License Agreement EMV Level 3 Testing Framework - Test Tool Requirements v1.1.r Page 35 / 37  Obtain EMVCo’s prior written approval for all advertising and promotion of the L3 tool  Prominently state the version of the EMVCo L3 specifications and guidelines the L3 tool is qualified for in all advertising and promotion of the L3 tool A.3 L3 Qualification Service Provider The L3 Qualification Service Provider’s role and responsibilities include the following. L3 Qualification Service Providers:  Provide feedback on the EMVCo L3 specifications and guidelines to EMVCo and confirm feasibility of the Effective Date of the L3 Tool updates  Inform the test tool supplier of the qualification session requirements and dates, and samples if applicable.  Coordinate execution of the qualification session  Provide the Qualification Session Report to EMVCo after receiving authorization from the test tool supplier EMV Level 3 Testing Framework - Test Tool Requirements v1.1.r Annex B Relevant L3 Process Forms and Documents The table below includes a list of relevant L3 forms applicable to the L3 test tool qualification process. Table 6-3: Relevant L3 Process Forms Bookmark [L3TTSRF] [L3TQFORM] [L3TDAGR] [L3 ICS] [L3QSA] Form L3 Test Tool Request form Suppler Registration Request for EMVCo Level 3 Tool Qualification form L3 Test Documentation Agreement License L3 Test Tool Implementation Conformance Statement L3 Qualification Service Agreement Purpose EMVCo provided form intended for use by an L3 register with EMVCo, prior to initiating an L3 te session. EMVCo provided form intended for use by an L3 formally request submission of their test too qualification. Legal agreement for execution between EMVCo L3 test tool supplier to enable EMVCo to documentation and other materials to the supplie EMVCo provided form, for use by a prospective to indicate to the L3 QSP the L3 functions that ar tool so that the appropriate qualification tests ca the L3 QSP. Legal agreement for execution between the prospective L3 test tool supplier to enable the L qualification testing service. EMV Level 3 Testing Framework - Test Tool Requirements v1.1.r Page 37 / 37 *** END OF DOCUMENT ***