3DSA Bulletin nº 5: 3DS Letter of Approval (LOA) Issuance Process Update

© 2021-2026 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. Page 1 EMV ® 3-D Secure Approval Bulletin No. 05 Fifth Edition June, 2026 Letter of Approval (LOA) Issuance Process Update This bulletin describes the EMVCo update to the LOA issuance process. Applicability This bulletin applies to EMV® 3-D Secure product approval process. Related Documents • EMV ® 3-D Secure Approval - Administrative Process - latest version • EMV ® 3-D Secure Approval Bulletin N°01 - EMV ® 3-D Secure Approval Fees Effective Date • Immediately Description In order to accelerate the LOA issuance and publication, we are allowing eligible product providers to request the LOA earlier in the process. In the existing process, prior to the report review, the product provider shall have paid the related EMVCo approval fee. In this update, eligible product providers can request EMVCo to begin the compliance test report review prior to the payment of the EMVCo approval fee. Once the submitted test report is approved by EMVCo, an LOA will be issued. • For ACS, 3DS Server or DS Server request for approval: This policy applies to only one 3DS request for approval at a time for a given product provider. In case a second 3DS LOA request package is received, the fee for the previous 3DS LOA request will have to be paid before this policy can apply to the second 3DS product. • For SDK request for approval (Default-SDK or Split-SDK): This policy applies to up to two 3DS requests for approval if the product provider supports Android and iOS operating systems for the same version of Default-SDK specification or if the product provider supports two variants of Split-SDK (Native, Shell or Browser). The second request for SDK approval (for the second operating system for Default-SDK or for the second variant for Split-SDK) shall be submitted no later than 30 calendar days after the first request for approval to benefit from the Bulletin 5. In case a third 3DS LOA request package is received, the fee for the two previous 3DS SDK LOA request will have to be paid before this policy can apply to this third 3DS product. Note that SDK requests for approval cannot benefit from the bulletin 5 if the payment of the fee for a previous ACS, 3DS Server or DS Server request for approval is still pending © 2021-2026 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. Page 2 Eligibility Eligible product providers are those product providers that are registered with EMVCo and that have paid any EMVCo fees such as Type Approval Fees (includes any type approval supported by EMVCo), EMVCo Subscriber or Associate Fees, etc. The eligible product provider must not have delinquent payments owed. Payment Terms and Conditions • EMVCo may send invoices by email to the email address registered with EMVCo by a product provider. Invoices are stated in U.S. dollars, and all payments are due to EMVCo in U.S. dollars. • All payments are due by wire transfer and must include the applicable EMVCo invoice numbers for EMVCo’s reference. Product providers are responsible for all bank charges for wire transfers and are responsible for ensuring that EMVCo receives all payments in full. Details on wiring instructions, including EMVCo’s bank account information, will be stated in each invoice or separately communicated to product provider • Payment of approval fee is due to EMVCo within 30 calendar days from the date of each invoice. • Any amounts not paid when due shall bear interest at the rate of one percent (1%) per month or the highest rate permitted by applicable law, whichever is less, determined and compounded daily, from the date due until the date paid. EMVCo reserves the right to revoke the LOA in the case of non-payment of the EMVCo approval fee as per above invoice terms and conditions. For additional information please contact EMVCo 3DS Secretariat. © 2021-2026 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. Page 3 Legal Notice This document is subject to change by EMVCo at any time. This document does not create any binding obligations upon EMVCo or any third party regarding the subject matter of this document, which obligations will exist, if at all, only to the extent set forth in separate written agreements executed by EMVCo or such third parties. In the absence of such a written agreement, no product provider, test laboratory or any other third party should rely on this document, and EMVCo shall not be liable for any such reliance. No product provider, test laboratory or other third party may refer to a product, service or facility as EMVCo approved, in form or in substance, nor otherwise state or imply that EMVCo (or any agent of EMVCo) has in whole or part approved a product provider, test laboratory or other third party or its products, services, or facilities, except to the extent and subject to the terms, conditions and restrictions expressly set forth in a written agreement with EMVCo, or in an approval letter, compliance certificate or similar document issued by EMVCo. All other references to EMVCo approval are strictly prohibited by EMVCo. Under no circumstances should EMVCo approvals, when granted, be construed to imply any endorsement or warranty regarding the security, functionality, quality, or performance of any particular product or service, and no party shall state or imply anything to the contrary. EMVCo specifically disclaims any and all representations and warranties with respect to products that have received evaluations or approvals, and to the evaluation process generally, including, without limitation, any implied warranties of merchantability, fitness for purpose or non-infringement. All warranties, rights and remedies relating to products and services that have undergone evaluation by EMVCo are provided solely by the parties selling or otherwise providing such products or services, and not by EMVCo, and EMVCo will have no liability whatsoever in connection with such products and services. This document is provided "AS IS" without warranties of any kind, and EMVCo neither assumes nor accepts any liability for any errors or omissions contained in this document. EMVCO DISCLAIMS ALL REPRESENTATIONS AND WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON -INFRINGEMENT, AS TO THIS DOCUMENT. EMVCo makes no representations or warranties with respect to intellectual property rights of any third parties in or in relation to this document. EMVCo undertakes no responsibility to determine whether any implementation of this document may violate, infringe, or otherwise exercise the patent, copyright, trademark, trade secret, know-how, or other intellectual property rights of third parties, and thus any person who implements any part of this document should consult an intellectual property attorney before any such implementation. Without limiting the foregoing, this document may provide for the use of public key encryption and other technology, which may be the subject matter of patents in several countries. Any party seeking to implement this document is solely responsible for determining whether its activities require a license to any such technology, including for patents on public key encryption technology. EMVCo shall not be liable under any theory for any party's infringement of any intellectual property rights in connection with this document.