3DSA Bulletin nº 31: Sunset of EMV 3DS Approval for 2.2.0

© 2026 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. Page 1 EMV ® 3-D Secure Approval Bulletin No. 31 First Edition June 2026 Sunset of EMV 3DS Approval for 2.2.0 Applicability This approval bulletin applies to EMV ® 3-D Secure product approval process. Related specification documents • EMV 3-D Secure Approval – Administrative Process latest version Effective Date 1 July 2027 Description In managing the evolution of the EMV 3DS specifications, EMVCo develops and delivers new protocol versions with enhanced functionalities on a regular basis. As part of this process, EMVCo manages the existing protocol versions to ensure global coherence of the EMV 3DS ecosystem. We aim to maintain at a reasonable level the number of EMV 3DS protocol versions a product is expected to support. EMVCo now plans to only accept the submission for approval of products supporting 3DS protocol version numbers 2.3.1 and higher. This approval bulletin introduces the strategy for EMVCo to sunset testing against the 3DS specification 2.2.0. Two important milestones have been defined: • Milestone 1: Sunset of testing the products supporting only version 2.2.0 On 1 July 2027 (Milestone 1), EMVCo will discontinue accepting Test Reports for products supporting only version 2.2.0 of the 3DS protocol. Products must support version 2.3.1 or higher version of the 3DS protocol. - A Test Report for 2.2.0 only product shall be submitted before 1 July 2027. - A product submitted for 2.3.1 or higher version will continue to be tested against Test Plan 2.2.0 after 1 July 2027. This will ensure the interoperability between components in the field until all products supporting only the version 2.2.0 have expired and/or have transitioned to version 2.3.1 or higher version. © 2026 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. Page 2 • Milestone 2: Cut-off Date for testing all products against specification 2.2.0 Milestone 2 will be implemented no later than 1 July 2029. From Milestone 2 on, testing against Test Plan 2.2.0 will be discontinued, and a product submitted for 2.3.1 or a higher version will no longer be tested against Test Plan 2.2.0. The exact date for Milestone 2 will be determined after Milestone 1 has been reached. Milestone 2 will be the earlier of: - the expiration date of the last 3DS Letter of Approval LOA issued for a product submitted for 3DS protocol 2.2.0; or - 1 July 2029. Milestone 2 will be communicated in upcoming 3DS approval bulletin(s). EMVCo is creating a timeline in order to maximize the interoperability and reduce the impact of sunsetting the version 2.2.0 of the 3DS protocol. This approval bulletin only applies to version 2.2.0 of the 3DS protocol testing during 3DS approvals and not to its usage in production. Please reach out to your payment system(s) and DS operator(s) for usage of the version 2.2.0 of the 3DS protocol for 3DS transactions after Milestone 2. Sunset plans for 3DS protocol 2.3.1 are also being discussed within EMVCo in order to prepare the transition to the next version of 3DS specification 2.4.0 that will be released in 2027. Sunset plans for 3DS protocol 2.3.1 will be communicated in upcoming 3DS approval bulletin(s). For additional questions, please submit a query via EMVCo’s Query System or to our 3DS Secretariat. © 2026 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. Page 3 Legal Notice This document is subject to change by EMVCo at any time. This document does not create any binding obligations upon EMVCo or any third party regarding the subject matter of this document, which obligations will exist, if at all, only to the extent set forth in separate written agreements executed by EMVCo or such third parties. In the absence of such a written agreement, no product provider, test laboratory or any other third party should rely on this document, and EMVCo shall not be liable for any such reliance. No product provider, test laboratory or other third party may refer to a product, service or facility as EMVCo approved, in form or in substance, nor otherwise state or imply that EMVCo (or any agent of EMVCo) has in whole or part approved a product provider, test laboratory or other third party or its products, services, or facilities, except to the extent and subject to the terms, conditions and restrictions expressly set forth in a written agreement with EMVCo, or in an approval letter, compliance certificate or similar document issued by EMVCo. All other references to EMVCo approval are strictly prohibited by EMVCo. Under no circumstances should EMVCo approvals, when granted, be construed to imply any endorsement or warranty regarding the security, functionality, quality, or performance of any particular product or service, and no party shall state or imply anything to the contrary. EMVCo specifically disclaims any and all representations and warranties with respect to products that have received evaluations or approvals, and to the evaluation process generally, including, without limitation, any implied warranties of merchantability, fitness for purpose or non-infringement. All warranties, rights and remedies relating to products and services that have undergone evaluation by EMVCo are provided solely by the parties selling or otherwise providing such products or services, and not by EMVCo, and EMVCo will have no liability whatsoever in connection with such products and services. This document is provided "AS IS" without warranties of any kind, and EMVCo neither assumes nor accepts any liability for any errors or omissions contained in this document. EMVCO DISCLAIMS ALL REPRESENTATIONS AND WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON -INFRINGEMENT, AS TO THIS DOCUMENT. EMVCo makes no representations or warranties with respect to intellectual property rights of any third parties in or in relation to this document. EMVCo undertakes no responsibility to determine whether any implementation of this document may violate, infringe, or otherwise exercise the patent, copyright, trademark, trade secret, know-how, or other intellectual property rights of third parties, and thus any person who implements any part of this document should consult an intellectual property attorney before any such implementation. Without limiting the foregoing, this document may provide for the use of public key encryption and other technology, which may be the subject matter of patents in several countries. Any party seeking to implement this document is solely responsible for determining whether its activities require a license to any such technology, including for patents on public key encryption technology. EMVCo shall not be liable under any theory for any party's infringement of any intellectual property rights in connection with this document.