3DSA Bulletin nº 32: LOA Conditional Extension for Products Migrating to 2.4.0.0

countries.

EMV® 3-D Secure Approval Bulletin No. 32 First Edition July 2026 LOA Conditional Extension for Products Migrating to 2.4.0.0

Applicability

This approval bulletin applies to EMV® 3-D Secure (3DS) product approval process. Related specification documents

• 3DS Secure Approval – Administrative Process latest version
• 3DS Approval Bulletin 31 - Sunset of EMVCo 3DS Approval for 2.2.0

Effective Date

Immediately

Description

EMVCo has already published the first draft of the EMV® 3-D Secure Protocol and Core Functions Specification version 2.4.0.0 on the EMVCo website (restricted audience). The intention is to publish the final Specification in the first quarter of 2027. Product Providers that have 3DS products expiring just after the release of the 3DS specification 2.4.0.0 may not have enough time to migrate to this new version of specification before the expiration of their Letter of Approval (LOA) when they will re approve their product. For this reason, EMVCo has exceptionally decided to grant a Letter of Approval (LOA) conditional extension to product providers that have a 3DS product expiring from the publication date of the 3DS Specification 2.4.0.0 until the end of year 2027 and that intend to migrate to 3DS specification v2.4.0.0. The extension will be granted upon payment of a specific LOA extension fee. The eligibility criteria to this LOA conditional extension are detailed below:

• Any 2.2.0 or 2.3.1 3DS product (ACS, 3DS Server, DS, Default-SDK or Split-SDK) that has a LOA with an expiry date between the release date of the 3DS specification v2.4.0.0 and 31 December 2027, is eligible. Note that release date of the 3DS specification v2.4.0.0 will be communicated by EMVCo at a later time
• The product provider has to sign a letter of intention committing to upgrade their 3DS component covered by the expiring LOA to support the latest 3DS specification v2.4.0.0 and have it approved before the new LOA expiration date. The table below defines the LOA conditional extension options: Extension Duration Extension Fee Comment 3 months $1,400 for ACS, 3DSS and DS $700 for Default-SDK and Split-SDK 6 months $2,800 for ACS, 3DSS and DS $1,400 for Default-SDK and Split-SDK 9 months $4,200 for ACS, 3DSS and DS $2,100 for Default-SDK and Split-SDK Only applicable for LOAs expiring before 1 October 2027 countries. EMVCo plans to start offering testing against 3DS Core specification v2.4.0.0 from Q3 2027 (milestone date subject to change and depending on the publication of the specification). The above conditional extension durations have been defined to let the product providers define the adequate time required after the activation of the testing against 3DS Specification 2.4.0.0 to obtain a new LOA based on this version of 3DS Specification. Any product provider interested in obtaining a LOA conditional extension must contact the EMVCo 3DS Secretariat at 3ds_approval@emvco.com to request the LOA extension and to obtain a letter of intention for them to review and sign. Conditional extension will be granted following EMVCo’s receipt of the signed letter of intention, confirmation of the eligibility of the product provider and payment of the LOA conditional extension fee. Following the conditional extension being granted, a new LOA will be issued to the product provider with the revised expiration date and the EMVCo web site will be updated accordingly. Should a product provider, after receiving a LOA conditional extension, decide later to not implement the 3DS specification v2.4.0.0 and to recertify this product against 3DS specification v2.2.0 or v2.3.1, the LOA conditional extension will be cancelled immediately and the LOA with be re-issued with an immediate expiration date. For additional questions, please submit a query to our 3DS Secretariat at 3ds_approval@emvco.com. countries.

Legal Notice

This document is subject to change by EMVCo at any time. This document does not create any binding obligations upon EMVCo or any third party regarding the subject matter of this document, which obligations will exist, if at all, only to the extent set forth in separate written agreements executed by EMVCo or such third parties. In the absence of such a written agreement, no product provider, test laboratory or any other third party should rely on this document, and EMVCo shall not be liable for any such reliance. No product provider, test laboratory or other third party may refer to a product, service or facility as EMVCo approved, in form or in substance, nor otherwise state or imply that EMVCo (or any agent of EMVCo) has in whole or part approved a product provider, test laboratory or other third party or its products, services, or facilities, except to the extent and subject to the terms, conditions and restrictions expressly set forth in a written agreement with EMVCo, or in an approval letter, compliance certificate or similar document issued by EMVCo. All other references to EMVCo approval are strictly prohibited by EMVCo. Under no circumstances should EMVCo approvals, when granted, be construed to imply any endorsement or warranty regarding the security, functionality, quality, or performance of any particular product or service, and no party shall state or imply anything to the contrary. EMVCo specifically disclaims any and all representations and warranties with respect to products that have received evaluations or approvals, and to the evaluation process generally, including, without limitation, any implied warranties of merchantability, fitness for purpose or non-infringement. All warranties, rights and remedies relating to products and services that have undergone evaluation by EMVCo are provided solely by the parties selling or otherwise providing such products or services, and not by EMVCo, and EMVCo will have no liability whatsoever in connection with such products and services. This document is provided "AS IS" without warranties of any kind, and EMVCo neither assumes nor accepts any liability for any errors or omissions contained in this document. EMVCO DISCLAIMS ALL REPRESENTATIONS AND WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON -INFRINGEMENT, AS TO THIS DOCUMENT. EMVCo makes no representations or warranties with respect to intellectual property rights of any third parties in or in relation to this document. EMVCo undertakes no responsibility to determine whether any implementation of this document may violate, infringe, or otherwise exercise the patent, copyright, trademark, trade secret, know-how, or other intellectual property rights of third parties, and thus any person who implements any part of this document should consult an intellectual property attorney before any such implementation. Without limiting the foregoing, this document may provide for the use of public key encryption and other technology, which may be the subject matter of patents in several countries. Any party seeking to implement this document is solely responsible for determining whether its activities require a license to any such technology, including for patents on public key encryption technology. EMVCo shall not be liable under any theory for any party's infringement of any intellectual property rights in connection with this document.