EMV® Card and Terminal Type Approval Laboratory Recognition Requirements

2026-07-15T00:00:00+00:00 v2.10 Service Provider Recognition/Qualification

BiometricContactContactlessMobile Acceptance DeviceCardFingerprint SensorNFC Consumer Device

EMV® Card and Terminal Type Approval ________________________________________________ ________ Laboratory Recognition Requirements Version 2.10 July 2026 EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.10 Page i / vii

Legal Notice

This document is subject to change by EMVCo at any time. This document does not create any binding obligations upon EMVCo or any third party regarding the subject matter of this document, which obligations will exist, if at all, only to the extent set forth in separate written agreements executed by EMVCo or such third parties. In the absence of such a written agreement, no product provider, test laboratory or any other third party should rely on this document, and EMVCo shall not be liable for any such reliance. No product provider, test laboratory or other third party may refer to a product, service or facility as EMVCo approved, in form or in substance, nor otherwise state or imply that EMVCo (or any agent of EMVCo) has in whole or part approved a product provider, test laboratory or other third party or its products, services, or facilities, except to the extent and subject to the terms, conditions and restrictions expressly set forth in a written agreement with EMVCo, or in an approval letter, compliance certificate or similar document issued by EMVCo. All other references to EMVCo approval are strictly prohibited by EMVCo. Under no circumstances should EMVCo approvals, when granted, be construed to imply any endorsement or warranty regarding the security, functionality, quality, or performance of any particular product or service, and no party shall state or imply anything to the contrary. EMVCo specifically disclaims any and all representations and warranties with respect to products that have received evaluations or approvals, and to the evaluation process generally, including, without limitation, any implied warranties of merchantability, fitness for purpose or non- infringement. All warranties, rights and remedies relating to products and services that have undergone evaluation by EMVCo are provided solely by the parties selling or otherwise providing such products or services, and not by EMVCo, and EMVCo will have no liability whatsoever in connection with such products and services. This document is provided "AS IS" without warranties of any kind, and EMVCo neither assumes nor accepts any liability for any errors or omissions contained in this document. EMVCO DISCLAIMS ALL REPRESENTATIONS AND WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON - INFRINGEMENT, AS TO THIS DOCUMENT. EMVCo makes no representations or warranties with respect to intellectual property rights of any third parties in or in relation to this document. EMVCo undertakes no responsibility to determine whether any implementation of this document may violate, infringe, or otherwise exercise the patent, copyright, trademark, trade secret, know-how, or other intellectual property rights of third parties, and thus any person who implements any part of this document should consult an intellectual property attorney before any such implementation. Without limiting the foregoing, this document may provide for the use of public key encryption and other technology, which may be the subject matter of patents in several countries. Any party seeking to implement this document is solely responsible for determining whether its activities require a license to any such technology, including for patents on public key encryption technology. EMVCo shall not be liable under any theory for any party's infringement of any intellectual property rights in connection with this document EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.10

/ vii

Revision Log – Version 2.10 The following changes have been made to the document since the publication of Version 2.9:

Updated laboratory accreditation requirements in the quality assurance requirements section.
Coverage of the Fingerprint Sensor assessment process EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.10 / vii 1. 1. 4. 4. 4. 4. 5. 5.1. 5.1. 5. 5. 5. 6. 6. 6. 7. 7. 7. 7. 8. 8.1. 8.1. 8.1. 8.1. 8.1. 8.1. 8.1. 8.1. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.10 / vii 8. 8.2. 8.2.1. 8.2.1. 8.2.1. 8.2. 8.2.2. 8.2.2. 8.2.2. 8.2.2. 8.2.2. 8. 8.3. 8.3. 8.3.2. 8.3.2. 8.3. 8.3. 8. 8.4. 8.4.1. 8.4.1. 8.4. 8.4.2. 8.4.2. 8. 8.5. 8.5. 8.5. 8.5. 8.5. 8.5. 8.5. 8.5.7. 8.5.7. 8.5. 8.5. 9. 9.1. 9.1. 9.1. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.10 Page v / vii 9. 9. 9. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.10 / vii EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.10 / vii Figures Figure 1: Initial Recognition: Two Phases Approach vs. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.10 / 66 1

Introduction

EMVCo recognises independent laboratories throughout the world to conduct evaluations for card, fingerprint sensor, mobile and terminal products, hereafter referred to as “type approval”:

Card Type Approval (for Card Consumer devices)
Common Core Definition (CCD) Level 1 and 2
Common Payment Application (CPA) Level 1 and 2
Fingerprint Sensor Assessment (for Card Consumer devices)
Mobile Type Approval (for NFC Consumer devices)
Mobile Product Level 1
Contactless Mobile Payment (evaluations for Proximity Payment System Environment and Application Management for Secure Element - CMP/PPSE)
Terminal Type Approval (for Acceptance devices)
IFM Level 1 (contact Level 1)
Contact Level 2 (EMV® Kernel)
PCD Level 1 (contactless Level 1)
Reduced Range PCD Level 1 (RR Level 1)
Contactless Product (Contactless C-x)
Terminal ESD Evaluation A laboratory may choose to be recognised for functional evaluations and may choose to be recognised for one or more of the following:
Card Type Approval
Contact - Level 1 (Electrical and Protocol) - CCD Level 2 - CPA Level 2
Contactless - Level 1 (Analog and Digital) Note: Although Card Contactless Level 1 (Analog and Digital) testing capability of a laboratory may be assessed by the EMVCo auditor during the lab recognition process, there is no EMVCo Card Contactless Approval and the formal recognition process for Card Contactless Level 1 (Analog and Digital) is managed by Payment Systems. Refer to them for further information.
Fingerprint Sensor Assessment EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.10 / 66
Mobile Type Approval
Contactless - CMP/PPSE - Level 1 (Analog, Digital, Validation, Interoperability)
Terminal Type Approval
Contact - Level 1 - IFM (Electrical and Protocol) - Level 2 - EMV Kernel
Contactless - Level 1 – PCD (Analog, Digital, Interoperability) and RR PCD - C-x (Contactless Product) Note: EMVCo recognises laboratories for Terminal Contactless Products and may grant LOAs. But Terminal Contactless Product testing capability of a laboratory is only partly verified by the EMVCo auditor during the lab recognition process and the formal and complete laboratory recognition process for Terminal Contactless product is managed by Payment Systems. Refer to them for further information.
ESD Evaluation A laboratory is recognised for a specific site location and the supported functional evaluations are documented in the Letter of Recognition of the laboratory.

1.1 Purpose and Audience This document describes the EMV laboratory recognition process for functional evaluations and outlines a set of requirements that an EMVCo Qualified Auditor will use to assess a laboratory’s capabilities. The resulting audit report will enable EMVCo to judge whether a laboratory has the proper competencies and the proper administrative structure to perform type approval functional evaluations on behalf of EMVCo. This document is intended for laboratories that are seeking EMV recognition, for EMVCo Recognised Laboratories, and for EMVCo Qualified Auditors that will perform recognition audits on behalf of EMVCo. 1.2

Scope

This document covers the EMV laboratory recognition process and requirements for functional evaluations. It does not cover the EMV laboratory recognition process and requirements for security. For the role and responsibilities of an EMVCo Recognised Laboratory in the type approval process, please refer to [AP CCD], [AP CPA], [AP CPA], [AP ML1], [AP CMP] [AP IFM], [AP CTN], [AP PCD], [AP RR], [AP CLS] and [AP ESD]. 1 1 The normative references are listed in section 2. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.10

/ 66

2 Normative

References

Ref. Document Title Version Distribution [AP CCD] EMV Card Type Approval Administrative Process for CCD Latest Available Publicly Available [AP CPA] EMV Card Type Approval Administrative Process for CPA Latest Available Publicly Available [AP CMP] EMV Contactless Mobile Product Type Approval Administrative Process Latest Available Publicly Available [AP ML1] EMV Mobile Product Level 1 Type Approval Administrative Process Latest Available Publicly Available [AP IFM] EMVCo Terminal Type Approval Administrative Process for Contact Terminal Level 1 (IFM) Latest Available Publicly Available [AP CTN] EMVCo Terminal Type Approval Administrative Process for Contact Terminal Level 2 (EMV Kernel) Latest Available Publicly Available [AP PCD] EMVCo Terminal Type Approval Administrative Process for Contactless Terminal Level 1 (PCD) Latest Available Publicly Available [AP RR] EMVCo Terminal Type Approval Administrative Process for Reduced Range PCD Level 1 Latest Available Publicly Available [AP CLS] EMVCo Terminal Type Approval Administrative Process for Contactless product Latest Available Publicly Available [AP ESD] EMVCo Terminal Type Approval Administrative Process for ESD Evaluation Latest Available Publicly Available [AP FSA EMVCo Fingerprint Sensor Assessment Administrative Process Latest Available Publicly Available [ISO17025] ISO/IEC 17025 - General requirements for the competence of testing and calibration laboratories Latest Available Publicly Available Table 1: Normative References EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.10

/ 66

3 Glossary This appendix defines selected terms used in this document. Action plan See “Corrective action plan”. Corrective action plan A set of deliverables and due dates defined by the laboratory, then reviewed and validated by the EMVCo Qualified Auditor, to enable a laboratory to fully meet EMV requirements. EMVCo A Limited Liability Company established to maintain the EMV specifications and administer Type Approval against those specifications. EMVCo Qualified Auditor An independent, impartial entity that has received a Letter of Qualification from EMVCo, entitling it to verify conformance to EMV-defined Type Approval procedures. Note: The auditor reviewing the first approval test reports during the initial recognition is usually not the same as the auditor performing the onsite audit. EMVCo Recognised Laboratory An independent, impartial entity that has been audited by an EMVCo Qualified Auditor for compliance with the requirements outlined in this document and has received a Letter of Recognition from EMVCo, entitling it to perform testing for Type Approval. Evaluation area An area in a laboratory facility in which chip products, components, or data are tested or stored. Impartiality Freedom from conflicts of interest, from bias, and from prejudice, neutrality, fairness, open- mindedness, even-handedness detachment and balance. Ability to ensure that conflict of interest do not exist or are resolved so as not to adversely influence the activities of the Laboratory. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.10

/ 66

Letter of Recognition Written statement that documents the decision of EMVCo that a laboratory is an EMVCo Recognised Laboratory and performs testing for Type Approval in conformance with the rules defined by EMVCo. Letter of Approval Written statement that documents the decision of EMVCo that a specified product has demonstrated sufficient conformance to the applicable EMV specifications as of its test date. Letter of Compliance Written statement that documents the decision of EMVCo that a specified CMP Secure Element (SE) product or CMP PPSE product has demonstrated sufficient conformance to the applicable EMV specifications as of its test date. Online Tool Provider Developer and operator of an online test tool used during the EMVCo approvals. In the context of this document, no distinction is made between the two roles. Parent laboratory Head laboratory of a group of laboratories (subsidiaries) belonging to the same entity. Product Provider The entity that submits a card, mobile or terminal product to EMVCo for Type Approval. Recognition Formal recognition by EMVCo that a test laboratory is competent to perform one or more categories of testing defined by EMV Card, Mobile or Terminal Type Approval procedures. Registration Number Unique identification number that EMVCo assigns to an EMVCo Recognised Laboratory, to be used on all communication and reports sent to EMVCo. Type Approval Verification by EMVCo that a specific card, mobile or terminal product has demonstrated sufficient conformance to the applicable EMV specifications. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.10

/ 66

4 Types of Recognition Audits A laboratory shall obtain and maintain current EMV recognition. Therefore, several types of audits may be required during a laboratory’s relationship agreement with EMVCo:

Initial Recognition Audit
Recognition Renewal Audit
Incremental Recognition Audit
Interim Proficiency Audit Note: Payment of fees for audit tasks undertaken by EMVCo Qualified Auditors is the responsibility of the laboratory requesting EMVCo’s recognition. EMVCo is not responsible for auditor fees.

4.1 Initial Recognition Audit A laboratory shall be recognised by EMVCo to perform approval for cards, mobiles or terminals. The Initial Recognition Audit is the first audit that a candidate laboratory shall pass. When a laboratory requests the EMV Initial Recognition, EMVCo adds this request to the EMVCo waiting list. After EMVCo confirmation to proceed with the request, the laboratory supplies EMVCo with documentation about the laboratory which includes an overview of its abilities to meet EMV recognition requirements. Once EMVCo has reviewed the documents supplied and has accepted the laboratory for potential recognition, a full recognition audit is required. This audit consists of items identified in sections 8 and 9. Note: The initial recognition audit process does not apply yet for Fingerprint Sensors testing capability. Please contact EMVCo for this specific case.

4.2 Recognition Renewal Audit A laboratory shall be audited as specified in the Letter of Recognition to renew its EMV recognition. The requirements for the Recognition Renewal Audit are determined by EMVCo at the time of renewal. The audit may include all items identified in sections 8 and 9 or EMVCo may select specific items for the auditor to cover. The audit shall be completed before the expiration date of the laboratory’s recognition. If a laboratory wishes to renew its recognition with EMVCo, the laboratory should contact EMVCo at least four months prior to the expiration date of the laboratory’s recognition. It is the responsibility of the laboratory to renew its recognition before it expires. If a laboratory does not renew its recognition, EMVCo may revoke its recognition. See section 7.3. If the recognition renewal has not been granted by EMVCo before the expiration date, The Approval Secretariat will stop reviewing any Test Report from the concerned Laboratory. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.10

/ 66

4.3 Incremental Recognition Audit If a laboratory requests to add a new type of testing or a new site to its recognition, an Incremental Recognition Audit is required. The existing renewal date for the laboratory’s recognition does not change. The requirements for an Incremental Recognition Audit are determined by EMVCo at the time of the audit. The scope of the audit is a subset of the items identified in sections 8 and 9. Note: The incremental recognition audit process does not apply yet when adding Fingerprint Sensors testing capability. Please contact EMVCo for this specific case.

4.4 Interim Proficiency Audit At any time, at the discretion of EMVCo, an Interim Proficiency Audit may be required. For instance, it may happen if:

A previous audit required a corrective action plan,
Deviations are not fixed appropriately or in the expected timeline,
Repetitive issues are noticed,
A laboratory performs a low number of approvals a year,
A laboratory requests to use an EMV qualified online tool for testing. Refer to section 8.4 for more details,
Or for any other reason that EMVCo deems relevant In this case, EMVCo will:
Inform the laboratory that an Interim Proficiency Audit must be performed and the date by which the audit must be completed
Inform the laboratory of the audit requirements (which will be based upon the issues or changes identified) The scope of the audit will primarily include a laboratory’s testing procedures and capabilities. This scope and the date of the interim proficiency audit are usually determined by the list of corrective actions, which have been issued during the previous audit performed but it is at the discretion of the auditor to extend the scope. If a laboratory does not complete the audit to the satisfaction of EMVCo by the required date, EMVCo may suspend or revoke its recognition. See sections 7.3 and 7.4. Note: Interim Proficiency audits requested during the period of the Initial Letter of Recognition (see 5.1.1 and 5.1.2) or requested in a Letter of Recognition (see 5.2) have to be organised and planned by the laboratory and EMVCo does not inform or remind the laboratory to do it. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.10 / 66 5 Recognition Processes The following sections describe the processes involved in the various types of audits.

5.1 Initial Recognition Process The Initial Recognition Process is performed by each new laboratory that wants to be recognised by EMVCo.

A laboratory that has a parent laboratory already recognised by EMVCo may complete the initial recognition process in two phases or in a single phase. The laboratory may choose the Two Phases Initial Recognition Audit if it wishes to start the recognition process before purchasing or developing the necessary EMVCo-qualified test tools.
Any other laboratory (new) shall follow the two phases process. Figure 1 provides an overview of the differences between the two phases and the single phase approaches. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.10 / 66 Laboratory applies to EMVCo to begin recognition process Y Auditor completes first phase of audit Laboratory purchases or develops test tools EMVCo provides Letter of Recognition Y NN First phase passed? Laboratory selects EMVCo Qualified Auditor to begin two phases audit N Y EMVCo authorises laboratory to begin? Laboratory selects EMVCo Qualified Auditor to begin single phase audit Y Auditor completes second phase of audit Second phase passed? Auditor completes entire audit Laboratory purchases or develops test tools Audit passed? N Two Phases Audit Single Phase Audit End End Figure 1: Initial Recognition: Two Phases Approach vs. Single Phase Approach 2 2 Figure 1 indicates that the laboratory purchases or develops test tools only after the first phase of the Two Phases Audit is complete. There is an alternative, as described in the note on 6. EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.10 / 66

5.1.1 Two Phases Initial Recognition Audit Table 2 outlines the steps in the Two Phases Initial Recognition Audit process. (Section 5.1.2 describes the Single Phase Initial Recognition Audit process.) Laboratory Sends EMVCo a request for recognition using the EMV Terminal/Card/Mobile Type Approval Request for Registration form (available at www.emvco.com) EMVCo

Register the laboratory Request for Registration
Acknowledge that this registration is formally added in EMVCo waiting list. EMVCo
When ready to process the request, EMVCo confirms to the laboratory that the present recognition process can be initiated Note 1: The time between the previous step and this one, depends on various factors such as other projects managed by EMVCo Note 2: This confirmation is mandatory to start the process Note 3: In case multiple functional evaluations are requested by the laboratory, EMVCo may propose to split the recognition with different time frames Laboratory After EMVCo confirmation to proceed with the request, the laboratory sends documentation to EMVCo to begin the recognition process:
Executive and financial summary
Technical expertise summary, including experience with EMV Specifications
Laboratory background
Desired audit approach: Two Phases Audit EMVCo
Evaluates whether laboratory qualifies to be accepted for consideration as a potential EMVCo Recognised Laboratory
Informs laboratory if it may proceed with recognition Note: EMVCo reserves the right, at its own discretion and without providing a detailed explanation, to deny a laboratory the right to proceed through the recognition process.
Provides laboratory with:
The EMVCo Functional Evaluation Laboratory Relationship Agreement for signature
The EMVCo Test Document License Agreement for signature Table 2: Two Phases Initial Recognition Audit Process EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.10 / 66 Laboratory
Signs the Relationship Agreement with EMVCo and returns two signed copies to EMVCo. Note: The laboratory may proceed with the audit once the Relationship Agreement has been received by EMVCo.
Signs the Test Document License Agreement and returns two signed copies to EMVCo EMVCo
Signs the Relationship Agreement and returns one signed copy to the laboratory.
Signs the Test Document License Agreement and returns one signed copy to the laboratory.
Returns a Letter of Registration including a Registration Number, to be used on all communication and reports sent to EMVCo.
Provides the laboratory access to the EMVCo repository of information. Laboratory
Selects an auditor from the list of EMVCo Qualified Auditors and makes financial and legal arrangements with the auditor for the laboratory to be audited.
Informs EMVCo of selected auditor
Provides to the auditor the information required to meet the audit requirements defined in section 9.1 EMVCo Qualified Auditor
Performs audit covering EMVCo requirements
Ensures laboratory meets all requirements detailed in sections 8.1 and 9.1
Provides audit findings to the laboratory
If a corrective action plan (as described in section 9.4) is NOT necessary: provides audit report to EMVCo Note: Decision to have an onsite audit or a remote audit for phase 1 is at the discretion of the EMVCo Qualified Auditor and EMVCo. Laboratory If a corrective action plan (as described in section 9.4) is necessary:
Defines the action plan with deliverables and due dates to meet all EMV requirements
Provides action plan to EMVCo Qualified Auditor EMVCo Qualified Auditor If a corrective action plan is necessary:
Reviews and validates the action plan defined by the laboratory
Provides a copy of the validated laboratory action plan in its audit report to EMVCo Table 2: Two Phases Initial Recognition Audit Process, continued EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.10 / 66 EMVCo Reviews audit report (and action plan, if any) and determines whether the second phase of the audit may begin; if so:
Requests a site audit and a demonstration of testing capabilities as described in section 9.3 Note: EMVCo reserves the right, at its own discretion and without providing a detailed explanation, to deny a laboratory the right to continue through the recognition process. Laboratory
Purchases necessary EMVCo-qualified test tools or develops necessary test tools and applies for EMV qualification for the tools
Obtains adequate training on EMV test cases and test tools Note: Training is not the responsibility of EMVCo.
Demonstrates testing capabilities as described in section 9.3 for the supported functional evaluations EMVCo Qualified Auditor
Performs audit covering EMVCo requirements
Ensures laboratory meets all requirements detailed in sections 8.2 through 8.5 and 9.1.2 through 9.3
Audits the laboratory’s testing capabilities
Provides audit findings to the laboratory
If a corrective action plan (as described in section 9.4) is NOT necessary: provides audit report to EMVCo. Laboratory If a corrective action plan is necessary:
Defines the action plan with deliverables and due dates to meet all EMV requirements
Provides action plan to EMVCo Qualified Auditor EMVCo Qualified Auditor If a corrective action plan is necessary:
Reviews and validates the action plan defined by the laboratory
Provides a copy of the validated laboratory action plan in its audit report to EMVCo Table 2: Two Phases Initial Recognition Audit Process, continued EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.10 / 66 EMVCo
Reviews audit report (and action plan, if any) and determines whether the laboratory may be recognised or whether follow- up action is required Note: EMVCo reserves the right to deny recognition at its own discretion and without detailed explanation.
If audit report is acceptable to EMVCo, sends the laboratory an Initial Letter of Recognition with a validity of typically 9 months
If audit report is acceptable but the laboratory’s action items are pending,
May grant recognition on a provisional basis with pending corrective actions,
Sends the laboratory a Provisional Letter of Recognition with conditions: The letter will include the requirements for an Interim Proficiency Audit (as described in section 4.4) and a date by which it must be completed (with a validity of 9 months maximum).
Adds the laboratory to the list of recognised laboratories on the EMVCo website Laboratory During the validity of the Initial Letter of Recognition:
If the laboratory has a Parent Laboratory (for example the laboratory is a subsidiary of an already EMVCo Recognised Laboratory): At least 5 reports issued (with at a minimum one report per product type for which the laboratory seeks for recognition) shall be reviewed and controlled by the Parent Laboratory to ensure integrity of these reports. Parent Laboratory shall report to EMVCo the result of these reviews. Failure to complete testing on 5 products in the allotted time, or poor quality audit results may trigger further interim proficiency audits and/or loss of recognition.
If the laboratory does not have a Parent Laboratory: the first 3 reports issued (per product type for which the laboratory seeks for recognition) shall be fully reviewed and controlled by an EMVCo Qualified Auditor to ensure correctness of these reports. The laboratory shall be responsible for all fees associated with such activity. The EMVCo Qualified Auditor shall report to EMVCo the result of these reviews. Failure to complete testing on 3 products per type approval in the allotted time, or poor quality audit results may trigger further interim proficiency audits and/or loss of recognition
Before the expiration of the Initial Letter of Recognition, the laboratory shall organise an Interim Proficiency Audit (as described in section 4.4.). Table 2: Two Phases Initial Recognition Audit Process, continued EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.10 / 66 EMVCo Qualified Auditor
Performs Interim Proficiency Audit on the laboratory’s operational testing activities during the period of the Initial Letter of Recognition
Performs Interim Proficiency Audit on the results of the action plan if a Provisional Letter of Recognition had been requested during the initial audit. Note: Additional check points will be organised remotely by the EMVCo qualified auditor before the Interim Proficiency audit to follow up the implementation of the action plan (see details in section 9.4)
Provides audit report to EMVCo. EMVCo If no major issues have been detected during the review by EMVCo of the reports from the Parent Laboratory or from the EMVCo Qualified Auditor and if no corrective action items have been identified during the Interim Proficiency Audit, then the laboratory’s recognition is extended to three years from the initial recognition date. If issues and/or corrective action items have been identified, depending on the severity and number of deviations, a new interim proficiency audit may be required and the extension of the laboratory recognition may be reduced to one to two years at EMVCo discretion. Table 2: Two Phases Initial Recognition Audit Process, continued EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.10 / 66 Laboratory sends Request for Registration to EMVCo A EMVCo acknowledges registration and add the laboratory to the waiting list N YCorrective action plan needed? Laboratory defines action plan Laboratory sends documentation to EMVCo to begin recognition process EMVCo authorises laboratory to begin? EMVCo confirms to the laboratory that its recognition can be initiated End Laboratory request rejected N EMVCo sends: Relationship Agreement Test Document License Agreement Laboratory signs and returns: The Relationship Agreement Test Document License Agreement Y Auditor sends audit report to EMVCo Auditor reviews and validates action plan Auditor: Performs audit as per Laboratory requirements Provides audit findings to laboratory Laboratory selects an EMVCo qualified auditor EMVCo signs and returns: The Relationship Agreement Test Document License Agreement Letter of Registration including Registration Number EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.10 / 66 Figure 2: Two Phases Initial Recognition Audit Process A Auditor: Performs audit as per Laboratory requirements Provides audit findings to the laboratory B Laboratory: Develops test tools Applies for EMVCo qualification for tools Laboratory demonstrates testing capabilities Note: A laboratory may purchase or develop test tools in parallel with the first phase of the audit, at the laboratory s own risk. EMVCo reserves the right to accept or deny such request. N Y Corrective action plan needed? Laboratory defines action plan Auditor reviews and validates action plan EMVCo authorises second phase? End Laboratory request rejected N EMVCo reviews audit report phase 1 Y Laboratory purchases: EMVCo-qualified test tools Figure 2: Two Phases Initial Recognition Audit Process, continued EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.10 / 66 Auditor sends audit report to EMVCo Y Parent Laboratory must verify at least 5 reports (per product type) from the laboratory under recognition, before the expiration of the initial recognition Parent Laboratory exists? N Audit report is acceptable to EMVCo? N If no major issues detected during the report review, and no corrective actions identified during the Interim Proficiency audit, EMVCo extends laboratory recognition to 3 years If corrective actions identified during the Interim Proficiency audit, EMVCo reduces the extension of the recognition to 1 or 2 years. Auditor must verify 3 reports (per product type) from the laboratory under recognition, before the expiration of the provisional recognition Y EndEMVCo: Sends laboratory Initial Letter of Recognition (typical duration: 9 months) Adds laboratory to the list of Recognised Laboratories B EMVCo: Sends laboratory Provisional Letter of Recognition (maximun duration: 9 months) Adds laboratory to the list of Recognised Laboratories Laboratory must complete Interim Proficiency Audit as specified in the Provisional Letter of Recognition, before the expiration of the provisional recognition With action items Laboratory must complete Interim Proficiency Audit on the laboratory s operational testing activities, before the expiration of the initial recognition Figure 2: Two Phases Initial Recognition Audit Process, continued EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.10 / 66

5.1.2 Single Phase Initial Recognition Audit Table 3 outlines the steps in the Single Phase Initial Recognition Audit process. (Section 5.1.1 describes the Two Phases Initial Recognition Audit process.) Laboratory Sends to EMVCo the request for recognition, using the EMV Terminal/Card/Mobile Type Approval Request for Registration form (available at www.emvco.com) EMVCo

Register the laboratory Request for Registration
Acknowledge that this registration is formally added this in EMVCo waiting list. EMVCo
When ready to process the request, confirms to the laboratory that the present recognition process can be initiated Note 1: The time between the previous step and this one, depends on various factors such as other projects managed by EMVCo Note 2: This confirmation is mandatory to start the process Note 3: In case multiple functional evaluations are requested by the laboratory, EMVCo may propose to split the recognition with different time frames Laboratory After EMVCo confirmation to proceed with the request, the laboratory, sends documentation to EMVCo to begin the recognition process:
Executive and financial summary
Technical expertise summary, including experience with EMV Specifications
Laboratory background
Desired audit approach: Single Phase Audit EMVCo Evaluates whether laboratory qualifies to be accepted for consideration as a potential EMVCo Recognised Laboratory
Informs laboratory if it may proceed with recognition Note: EMVCo reserves the right, at its own discretion and without providing a detailed explanation, to deny a laboratory the right to proceed through the recognition process.
Provides laboratory with:
The EMVCo Functional Evaluation Laboratory Relationship Agreement for signature
The EMVCo Test Document License Agreement for signature Table 3: Single Phase Initial Recognition Audit Process EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.10 / 66 Laboratory
Signs the Relationship Agreement with EMVCo and returns two signed copies to EMVCo Note: The laboratory may proceed with the audit once the Relationship Agreement has been received by EMVCo.
Signs the EMVCo Test Document License Agreement and returns two signed copies to EMVCo EMVCo
Signs the Relationship Agreement and returns one signed copy to the laboratory.
Signs the Test Document License Agreement and sends a signed version to the laboratory
Returns a Letter of Registration including a Registration Number, to be used on all communication and reports sent to EMVCo
Provides the laboratory access to the EMVCo repository of information
Requests a demonstration of testing capabilities as described in section 9.3 Laboratory
Purchases necessary EMVCo-qualified test tools or develops necessary test tools and applies for EMV qualification for the tools
Obtains adequate training on EMV Test Cases and test tools Note: Training is not the responsibility of EMVCo.
Selects an auditor from the list of EMVCo Qualified Auditors and makes financial and legal arrangements with the auditor for the laboratory to be audited
Informs EMVCo of auditor selected
Provides to the auditor the information required to meet the audit requirements defined in section 9.1
Demonstrates testing capabilities as described in section 9.3 for the supported functional evaluations EMVCo Qualified Auditor
Performs audit covering EMVCo requirements
Ensures laboratory meets all requirements detailed in sections 8 and 9
Audits the laboratory’s testing capabilities
Provides audit findings to the laboratory
If a corrective action plan (as described in section 9.4) is NOT necessary: Provides audit report to EMVCo Table 3: Single Phase Initial Recognition Audit Process, continued EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.10 / 66 Laboratory If a corrective action plan (as described in section 9.4) is necessary:
Defines the action plan with deliverables and due dates to meet all EMV requirements
Provide action plan to EMVCo Qualified Auditor EMVCo Qualified Auditor If a corrective action plan is necessary:
Reviews and validates the action plan defined by the laboratory
Provides a copy of the validated laboratory action plan in its audit report to EMVCo EMVCo
Reviews audit report (and action plan, if any) and determines whether the laboratory may be recognised or whether follow- up action is required Note: EMVCo reserves the right to deny recognition at its own discretion and without detailed explanation.
If audit report is acceptable to EMVCo, sends the laboratory an Initial Letter of Recognition with a validity of typically 9 months
If audit report is acceptable but laboratory action items are pending,
May grant recognition on a provisional basis,
Sends the laboratory a provisional Letter of Recognition with conditions: The letter will include the requirements for an Interim Proficiency Audit (as described in section 4.4) and a date by which it must be completed (with a validity of 9 months maximum).
Adds the laboratory to the list of recognised laboratories on the EMVCo website Table 3: Single Phase Initial Recognition Audit Process, continued EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.10 / 66 Laboratory During the validity of the Initial Letter of Recognition:
If the laboratory has a Parent Laboratory (for example the laboratory is a subsidiary of an already EMVCo recognised Laboratory): At least 5 reports issued (with at a minimum one report per product type for which the laboratory seeks for recognition) shall be reviewed and controlled by the Parent Laboratory to ensure correctness of these reports. Parent Laboratory shall report to EMVCo the result of these reviews. Failure to complete testing on 5 products in the allotted time, or poor quality audit results may trigger further interim proficiency audits and/or loss of recognition.
If the laboratory does not have a Parent Laboratory: the first 3 reports issued (per product type for which the laboratory seeks for recognition) shall be fully reviewed and controlled by an EMVCo Qualified Auditor to ensure correctness of these reports. The laboratory shall be responsible for all fees associated with such activity. The EMVCo Qualified Auditor shall report to EMVCo the result of these reviews. Failure to complete testing on 3 products per type approval in the allotted time, or poor quality audit results may trigger further interim proficiency audits and/or loss of recognition
Before the expiration of the Initial Letter of Recognition, the laboratory shall organise an Interim Proficiency Audit (as described in section 4.4.). EMVCo Qualified Auditor
Performs Interim Proficiency Audit on the laboratory’s operational testing activities during the period of the Initial Letter of Recognition
Performs Interim Proficiency Audit on the results of the action plan if a Provisional Letter of Recognition had been requested during the initial audit. Note: Additional check points will be organised remotely by the EMVCo qualified auditor before the Interim Proficiency audit to follow up the implementation of the action plan (see details in section 9.4)
Provides audit report to EMVCo. EMVCo If no major issues have been detected during the review by EMVCo of the report from the Parent Laboratory or from the EMVCo Qualified Auditor and if no corrective actions items have been identified during the Interim Proficiency Audit, then the laboratory’s recognition is extended to three years from the initial recognition date. If issues and/or corrective action items have been identified, depending on the severity and number of deviations, a new interim proficiency audit may be required and the extension of the laboratory recognition may be reduced to one to two years at EMVCo discretion. Table 3: Single Phase Initial Recognition Audit Process, continued EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.10 / 66 Laboratory sends Request for Registration to EMVCo C EMVCo acknowledges registration and add the laboratory to the waiting list Laboratory sends documentation to EMVCo to begin recognition process EMVCo authorises laboratory to begin? EMVCo confirms to the laboratory that its recognition can be initiated End Laboratory request rejected N EMVCo sends: Relationship Agreement Test Document License Agreement Laboratory signs and returns: Relationship Agreement Test Document License Agreement Y Laboratory selects an EMVCo Qualified Auditor Laboratory: Purchases EMVCo-qualified tools Laboratory: Develops Test Tools Applies for EMVCo qualification for tools EMVCo signs and returns: Relationship Agreement Test Document License Agreement Letter of Registration including Registration Number Figure 3: Single Phase Initial Recognition Audit Process EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.10 / 66 C Auditor: Performs audit as per Laboratory requirements Provides audit findings to the laboratory N YCorrective action plan needed? Auditor sends audit report to EMVCo Laboratory defines action plan Auditor reviews and validates action plan N With action items Audit report is acceptable to EMVCo? End Y EMVCo: Sends laboratory Initial Letter of Recognition (typical duration: 9 months Adds laboratory to the list of Recognised Laboratories EMVCo: Sends laboratory Provisional Letter of Recognition (maximum duration: 9 months) Adds laboratory to the list of Recognised Laboratories Laboratory must complete Interim Proficiency Audit as specified in Provisional Letter of Recognition, before the expiration of the provisional recognition Laboratory demonstrates testing capabilities Laboratory must complete Interim Proficiency Audit on the laboratory s operational testing activities, before the expiration of the initial recognition D EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.10 / 66 Laboratory sends Request for Registration to EMVCo C EMVCo acknowledges registration and add the laboratory to the waiting list Laboratory sends documentation to EMVCo to begin recognition process EMVCo authorises laboratory to begin? EMVCo confirms to the laboratory that its recognition can be initiated End Laboratory request rejected N EMVCo sends: Relationship Agreement Test Document License Agreement Laboratory signs and returns: Relationship Agreement Test Document License Agreement Y Laboratory selects an EMVCo Qualified Auditor Laboratory: Purchases EMVCo-qualified tools Laboratory: Develops Test Tools Applies for EMVCo qualification for tools EMVCo signs and returns: Relationship Agreement Test Document License Agreement Letter of Registration including Registration Number Figure 3: Single Phase Initial Recognition Audit Process, continued EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.10 / 66 D Parent Laboratory Exist? Y N If no major issues detected during the report review, and no corrective actions identified during the Interim Proficiency audit, EMVCo extends laboratory recognition to 3 years. If corrective actions identified during the Interim Proficiency audit, EMVCo reduces the extension of the recognition to 1 or 2 years. Auditor must verify 3 reports (per product type) from the laboratory under recognition, before the expiration of the provisional recognition Parent Laboratory must verify at least 5 reports (per product type) from the laboratory under recognition, before the expiration of the initial recognition EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.10 / 66 Laboratory sends Request for Registration to EMVCo C EMVCo acknowledges registration and add the laboratory to the waiting list Laboratory sends documentation to EMVCo to begin recognition process EMVCo authorises laboratory to begin? EMVCo confirms to the laboratory that its recognition can be initiated End Laboratory request rejected N EMVCo sends: Relationship Agreement Test Document License Agreement Laboratory signs and returns: Relationship Agreement Test Document License Agreement Y Laboratory selects an EMVCo Qualified Auditor Laboratory: Purchases EMVCo-qualified tools Laboratory: Develops Test Tools Applies for EMVCo qualification for tools EMVCo signs and returns: Relationship Agreement Test Document License Agreement Letter of Registration including Registration Number Figure 3: Single Phase Initial Recognition Audit Process, continued EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.10 / 66

5.2 Recognition Renewal Process Table 4 outlines the steps in the recognition renewal process. Laboratory Sends request to EMVCo to begin the recognition renewal process Note: If a laboratory wishes to renew its recognition with EMVCo, the laboratory should contact EMVCo at least four months prior to the expiration date of the laboratory’s recognition. EMVCo

Informs the laboratory if it may proceed with the recognition renewal Note: EMVCo reserves the right, at its own discretion and without providing a detailed explanation, to deny a laboratory the right to proceed through the recognition renewal process.
Identifies the audit requirements, which may be a subset of sections 8 and 9, and informs the laboratory Laboratory
Selects an auditor from the list of EMVCo Qualified Auditors and makes financial and legal arrangements with the auditor for the laboratory to be audited
Provides to the auditor the information required to meet the audit requirements identified by EMVCo
Demonstrates testing capabilities (as described in section 9.3) if requested by EMVCo EMVCo Qualified Auditor
Performs audit covering EMVCo requirements
Ensures laboratory meets all requirements identified by EMVCo
Audits the laboratory’s testing capabilities if requested by EMVCo
Provides audit findings to the laboratory
If a corrective action plan (as described in section 9.4) is NOT necessary: Provides audit report to EMVCo Laboratory If a corrective action plan is necessary:
Defines the action plan with deliverables and due dates to meet all EMV requirements
Provides action plan to EMVCo Qualified Auditor Table 4: Recognition Renewal Audit Process EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.10 / 66 EMVCo Qualified Auditor If a corrective action plan is necessary:
Reviews and validates the action plan defined by the laboratory
Provides a copy of the validated laboratory action plan in its audit report to EMVCo EMVCo
Reviews audit report (and action plan, if any) and determines whether the laboratory’s recognition may be renewed or whether follow-up action is required Note: EMVCo reserves the right to deny recognition at its own discretion and without detailed explanation.
If audit report is acceptable to EMVCo, sends a new Letter of Recognition to the laboratory
If audit report is acceptable but laboratory action items are pending,
May renew recognition on a provisional basis,
Sends the laboratory a provisional Letter of Recognition with a duration defined by EMVCo: The letter may include the requirements for an Interim Proficiency Audit (as described in section 4.4) and a date by which it must be completed EMVCo Qualified Auditor If laboratory action items are pending when the new Letter of Recognition is granted, organises remote check points with the laboratory to follow up the implementation of the action plan (see details in section 9.4) Table 4: Recognition Renewal Audit Process, continued EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.10 / 66 Laboratory sends request to EMVCo to begin recognition renewal process Y NEMVCo authorises laboratory to begin? End EMVCo identifies audit requirements Laboratory: Selects EMVCo Qualified Auditor Demonstrates testing capabilities E Auditor: Performs audit as per Laboratory requirements Provides audit findings to the laboratory N Y Corrective action plan needed? Auditor sends audit report to EMVCo Laboratory defines action plan Auditor reviews and validates action plan Figure 4: Recognition Renewal Audit Process EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.10 / 66 E N With action itemsAudit report is acceptable to EMVCo? End Y EMVCo sends laboratory a new Letter of Recognition EMVCo sends laboratory a provisional Letter of Recognition Laboratory may complete an Interim Proficiency Audit as specified in provisional Letter of Recognition Figure 4: Recognition Renewal Audit Process, continued EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.10 / 66

5.3 Incremental Recognition Process Table 5 outlines the steps in the incremental recognition process. Laboratory Sends request to EMVCo to begin the incremental recognition process using the EMV Terminal/Card/Mobile Type Approval Request for incremental recognition form (available at www.emvco.com) EMVCo

Informs the laboratory if it may proceed with the incremental recognition and the date by which the audit must be completed Note: EMVCo reserves the right, at its own discretion and without providing a detailed explanation, to deny a laboratory the right to proceed through the incremental recognition.
Identifies the audit requirements, which may be a subset of sections 8 and 9, and informs the laboratory Laboratory
Selects an auditor from the list of EMVCo Qualified Auditors and makes financial and legal arrangements with the auditor for the laboratory to be audited
Provides to the auditor the information required to meet the audit requirements identified by EMVCo
Demonstrates testing capabilities (as described in section 9.3) if requested by EMVCo EMVCo Qualified Auditor
Performs audit covering EMVCo requirements
Ensures laboratory meets all requirements identified by EMVCo
Audits the laboratory’s testing capabilities if requested by EMVCo
Provides audit findings to the laboratory
If a corrective action plan (as described in section 9.4) is NOT necessary: Provides audit report to EMVCo Laboratory If a corrective action plan is necessary:
Defines the action plan with deliverables and due dates to meet all EMV requirements
Provides action plan to EMVCo Qualified Auditor EMVCo Qualified Auditor If a corrective action plan is necessary:
Reviews and validates the action plan defined by the laboratory
Provides a copy of the validated laboratory action plan in its audit report to EMVCo Table 5: Incremental Recognition Audit Process EMV® Card and Terminal Type Approval Laboratory Recognition Requirements v2.10 / 66 EMVCo
Reviews audit report (and action plan, if any) and determines whether the laboratory may be recognised or whether follow- up action is required Note: EMVCo reserves the right to deny recognition at its own discretion and without detailed explanation.
If audit report is acceptable to EMVCo:
Updates the Relationship Agre

Shown in part. Read the original for the full text.