Bulletin nº 03: Evaluation Review Fees

EMVCo SEWG Bulletin 03 Fifth Edition - July 2024 Evaluation Review Fees This bulletin clarifies the EMVCo Security Evaluation Working Group policy on evaluation review fees. This bulletin is available to EMVCo product providers. Any questions in relation to this bulletin should be directed to the Security Evaluation Working Group (SEWG) Secretariat at securityevaluation@emvco.com. Applicability This Bulletin applies to: • EMVCo IC, Platform and ICC Product Providers Related Documents • EMV Security Guidelines, EMVCo Security Evaluation Process • EMVCo Product Registration Questionnaire for IC Providers • EMVCo Product Registration Questionnaire for Platform Providers • EMVCo Site Registration Questionnaire for Product Providers Effective Date • 1st July 2024 © 2016-2024 EMVCo, LLC (“EMVCo”). All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. Page 1 Review Fee Structure Since 2007, the SEWG was pleased to announce the setup of the EMVCo security evaluation process for Integrated Circuit (IC) and Integrated Circuit Card (ICC) products. This process was enlarged to Platform approvals (including IC and Operating System) in 2011. Then in 2016, the ‘Extension of Expired Certificates’ process was also introduced, allowing composite product providers to be provided with fresh evaluation evidence for underlying expired Platforms and/or ICs for the renewal of their products. The Card Type Approval Process documentation details the administrative fee structure associated with the review of each product that is charged to product providers. Fee Structure For several years, EMVCo’s fees have remained flat while we continued to absorb various cost increases, due to the current economic situation. To ensure we can continue providing effective services, we are implementing a fee increase. This change will help us cover our running costs and maintain the usual standard of service provided. For all security evaluation reports submitted to EMVCo on or after January 1st, 2025, the following fees shall be paid to EMVCo by the Product Providers: IC Security Evaluation Fee Structure (IC Only): New IC Approval $5,700 per evaluation Renewal of IC Approval $5,700 per evaluation Update to IC Approval $2,850 per evaluation Extension of Expired IC $5,700 per evaluation © 2016-2024 EMVCo, LLC (“EMVCo”). All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. Page 2 Platform Security Evaluation Fee Structure (IC+OS): New Platform Approval $5,700 per evaluation Renewal of Platform Approval $5,700 per evaluation Update to Platform Approval $2,850 per evaluation ICC Security Evaluation Fee Structure (IC + OS + App(s)): New ICC Approval $2,850 per Security evaluation Extension of Expired Platform $5,700 per evaluation ICC Certificate Renewal $2,850 per Security evaluation Update to ICC Product $2,850 per Security evaluation Site Audit Review Fee Structure: Development or Production Site Audit $3,400 per Site Audit Report Note 1: The IC and Platform review fee invoice will be issued by the EMVCo Security Evaluation Secretariat. Note 2: The ICC review fee invoice will be issued by the EMVCo Card Approval Secretariat (when an ICC product is submitted to EMVCo for card type approval, the invoice issued will include both the Functional evaluation and Security evaluation review fee). Note 3: A Functional evaluation renewal (ICC) is valid for 3 years, whereas the Security evaluation renewal is valid for 1 year. For the 1st renewal, both a Functional evaluation and Security evaluation review fee will apply. However, if a second security renewal is requested, only the Security Evaluation administrative fee will apply. For more information on the life cycle of an EMVCo product, please refer to EMVCo SEWG Bulletin 02. IC and Platform Products that successfully pass the security evaluation processes will be added to the EMVCo Approved Product List. © 2016-2024 EMVCo, LLC (“EMVCo”). All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. Page 3 For IC or Platform products that have reached their end of life, the successful review of an extension report will result in the private issuance of an Extension Recognition Letter to the product provider. ICC Products that successfully pass both the security and functional evaluation processes will be added to the EMVCo Approved Product List. Note 4: Each Product Provider must be registered with EMVCo following the usual registration process before any site audit report review can be conducted. Details of the EMVCo Security Evaluation and Card Type Approval processes are available from www.emvco.com. © 2016-2024 EMVCo, LLC (“EMVCo”). All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. Page 4 Legal Notice This document summarizes EMVCo’s present plans for evaluation services and related policies and is subject to change by EMVCo at any time. This document does not create any binding obligations upon EMVCo or any third party regarding the subject matter of this document, which obligations will exist, if at all, only to the extent set forth in separate written agreements executed by EMVCo or such third parties. In the absence of such a written agreement, no product provider, test laboratory or any other third party should rely on this document, and EMVCo shall not be liable for any such reliance. No product provider, test laboratory or other third party may refer to a product, service or facility as EMVCo approved, in form or in substance, nor otherwise state or imply that EMVCo (or any agent of EMVCo) has in whole or part approved a product provider, test laboratory or other third party or its products, services, or facilities, except to the extent and subject to the terms, conditions and restrictions expressly set forth in a written agreement with EMVCo, or in an approval letter, compliance certificate or similar document issued by EMVCo. All other references to EMVCo approval are strictly prohibited by EMVCo. Under no circumstances should EMVCo approvals, when granted, be construed to imply any endorsement or warranty regarding the security, functionality, quality, or performance of any particular product or service, and no party shall state or imply anything to the contrary. EMVCo specifically disclaims any and all representations and warranties with respect to products that have received evaluations or approvals, and to the evaluation process generally, including, without limitation, any implied warranties of merchantability, fitness for purpose or non-infringement. All warranties, rights and remedies relating to products and services that have undergone evaluation by EMVCo are provided solely by the parties selling or otherwise providing such products or services, and not by EMVCo, and EMVCo will have no liability whatsoever in connection with such products and services. This document is provided "AS IS" without warranties of any kind, and EMVCo neither assumes nor accepts any liability for any errors or omissions contained in this document. EMVCO DISCLAIMS ALL REPRESENTATIONS AND WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT, AS TO THIS DOCUMENT. EMVCo makes no representations or warranties with respect to intellectual property rights of any third parties in or in relation to this document. EMVCo undertakes no responsibility to determine whether any implementation of this document may violate, infringe, or otherwise exercise the patent, copyright, trademark, trade secret, know-how, or other intellectual property rights of third parties, and thus any person who implements any part of this document should consult an intellectual property attorney before any such implementation. Without limiting the foregoing, this document may provide for the use of public key encryption and other technology, which may be the subject matter of patents in several countries. Any party seeking to implement this document is solely responsible for determining whether its activities require a license to any such technology, including for patents on public key encryption technology. EMVCo shall not be liable under any theory for any party's infringement of any intellectual property rights in connection with this document. © 2016-2024 EMVCo, LLC (“EMVCo”). All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. Page 5