PCI Watch

Tracking changes across the Payment Card Industry

EMV® 3-D Secure Approval – Test Platform Provider Recognition and Test Platform Qualification Process

v1.3 Service Provider Recognition/Qualification
3-D Secure

EMV® 3-D Secure Approval Test Platform Provider Recognition and Test Platform Qualification Process Version 1.3 July 2026 EMV® 3-D Secure Approval Test Platform Provider Recognition and Test Platform Qualification Process v1.3 Page i / v

Legal Notice

This document is subject to change by EMVCo at any time. This document does not create any binding obligations upon EMVCo or any third party regarding the subject matter of this document, which obligations will exist, if at all, only to the extent set forth in separate written agreements executed by EMVCo or such third parties. In the absence of such a written agreement, no product provider, test laboratory or any other third party should rely on this document, and EMVCo shall not be liable for any such reliance. No product provider, test laboratory or other third party may refer to a product, service or facility as EMVCo approved, in form or in substance, nor otherwise state or imply that EMVCo (or any agent of EMVCo) has in whole or part approved a product provider, test laboratory or other third party or its products, services, or facilities, except to the extent and subject to the terms, conditions and restrictions expressly set forth in a written agreement with EMVCo, or in an approval letter, compliance certificate or similar document issued by EMVCo. All other references to EMVCo approval are strictly prohibited by EMVCo. Under no circumstances should EMVCo approvals, when granted, be construed to imply any endorsement or warranty regarding the security, functionality, quality, or performance of any particular product or service, and no party shall state or imply anything to the contrary. EMVCo specifically disclaims any and all representations and warranties with respect to products that have received evaluations or approvals, and to the evaluation process generally, including, without limitation, any implied warranties of merchantability, fitness for purpose or non- infringement. All warranties, rights and remedies relating to products and services that have undergone evaluation by EMVCo are provided solely by the parties selling or otherwise providing such products or services, and not by EMVCo, and EMVCo will have no liability whatsoever in connection with such products and services. This document is provided "AS IS" without warranties of any kind, and EMVCo neither assumes nor accepts any liability for any errors or omissions contained in this document. EMVCO DISCLAIMS ALL REPRESENTATIONS AND WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON - INFRINGEMENT, AS TO THIS DOCUMENT. EMVCo makes no representations or warranties with respect to intellectual property rights of any third parties in or in relation to this document. EMVCo undertakes no responsibility to determine whether any implementation of this document may violate, infringe, or otherwise exercise the patent, copyright, trademark, trade secret, know-how, or other intellectual property rights of third parties, and thus any person who implements any part of this document should consult an intellectual property attorney before any such implementation. Without limiting the foregoing, this document may provide for the use of public key encryption and other technology, which may be the subject matter of patents in several countries. Any party seeking to implement this document is solely responsible for determining whether its activities require a license to any such technology, including for patents on public key encryption technology. EMVCo shall not be liable under any theory for any party's infringement of any intellectual property rights in connection with this document. EMV® 3-D Secure Approval Test Platform Provider Recognition and Test Platform Qualification Process v1.3

/ v

Revision Log – Version 1.3 The following changes have been made to the document since the publication of Version 1.2.r. Some of the numbering and cross references in this version have been updated to reflect changes introduced by the published bulletins. The numbering of existing requirements did not change, unless explicitly stated otherwise. Incorporated changes described as follows:

  • References to ISO 17025 removed.
  • Update in Table 2.1 regarding providing material to EMVCo.
  • Section 2.3.3, update on the LoQ & website updating process.
  • Section 3.2.2: Added conditions and steps for Interim Proficiency Audit.
  • Section 4.1, clarification on method of contacting EMVCo. Other editorial changes:
  • Minor update for Legal Notice.
  • Section 2.4.2.1.1, minor editorial update. EMV® 3-D Secure Approval Test Platform Provider Recognition and Test Platform Qualification Process v1.3 / v 1. 1. 1. 1. 1. 1.5. 1.5. 2. 2. 2. 2.3. 2.3. 2.3.2. 2.3.2. 2.3.2. 2.3. 2. 2.4. 2.4. 2.4.2. 2.4.2. 2.4.2. 2.4.2. 3. 3.1. 3.1. 3.1. 3. 3.2. 3.2. EMV® 3-D Secure Approval Test Platform Provider Recognition and Test Platform Qualification Process v1.3 / v 4. 4. 4. EMV® 3-D Secure Approval Test Platform Provider Recognition and Test Platform Qualification Process v1.3 Page v / v Tables Table 1. Table 1. Table 1. Table 1. Table 1. Table 1. Table 2. Table 2. Table 2. Table 3. Table 3. Table 4. Figures Figure 2. Figure 3. Figure 3. EMV® 3-D Secure Approval Test Platform Provider Recognition and Test Platform Qualification Process v1.3 / 39 1 Introduction 1.1

Purpose

This document describes the 3DS Test Platform Provider recognition process and the 3DS Test Platform qualification process that EMVCo uses to assess whether a 3DS Test Platform Provider has implemented its Test Platform, in compliance with EMV Test Platform Requirements. The document also outlines a set of requirements that an EMVCo Qualified Auditor will use along with the EMV Test Platform Requirements to assess a Test Platform Provider’s capabilities. The resulting audit report will enable EMVCo to judge whether a Test Platform Provider has the proper competencies and the proper administrative structure to perform and offer 3DS testing services.

1.2 Audience This document is intended for parties who are willing to develop and host a 3DS Test Platform and are seeking EMV recognition. This document is also intended for EMVCo Qualified Auditors that will perform Test Platform Provider recognition audits.

1.3 Normative Reference Table 1.1: 3-D Secure Specifications Ref. Document Title Version Distribution [PCF 3DS] EMV® 3-D Secure Protocol and Core Functions Specification Latest Available per Protocol Version Publicly Available [SDK 3DS] EMV® 3-D Secure SDK Specification Latest Available per Protocol Version Publicly Available [SPLIT 3DS] EMV® 3-D Secure Split-SDK Specification Latest Available Publicly Available [DEV 3DS] EMV® 3-D Secure SDK Device Information Latest version Publicly Available [VER 3DS] EMV® 3DS Version Number Management

  • Protocol Version 2.3.0 & above Latest Available Publicly Available [SB 3DS] EMV® 3-D Secure Specification Bulletins (SB Bulletins) All Publicly Available EMV® 3-D Secure Approval Test Platform Provider Recognition and Test Platform Qualification Process v1.3 / 39 Ref. Document Title Version Distribution [SB 3DS 255] EMV® 3-D Secure Specification Bulletins 255 – 3DS Specification Version Configuration Latest Available Publicly Available Table 1.2: 3-D Secure Approval Documents Ref. Document Title Version Distribution [AP 3DS] EMV® 3-D Secure Approval Administrative Process Latest Available Publicly Available [TP REQ] EMV® 3-D Secure
  • Test Platform Requirements Latest Available Publicly Available [TC 3DS] EMV® 3-D Secure Test Suite (which includes EMV® 3-D Secure Test Plan) Latest Available per Protocol Version Restricted to Laboratories and Test Platform Providers [SUT REQ] Test Requirements - for all Systems Under Test - for ACS as System Under Test - for 3DS Default-SDK and Split- SDK as System Under Test - for DS as System Under Test - for 3DS Server as System Under Test Last Applicable version Publicly Available [HARNES] Test Harness for Split-SDK as System Under Test Last Applicable version Publicly Available TPP_REQ Additional test requirements for Test Platform Providers Latest Available Restricted to Laboratories and Test Platform Providers [CM 3DS] EMV® 3-D Secure
  • Change Management and Notification Process Latest Available Restricted to Laboratories and Test Platform Providers [AB 3DS 04] EMV® 3-D Secure Approval Bulletin n°4 – 3-D Secure Test Platform Fees and Invoicing Process Latest Available Restricted to Test Platform Providers [AB 3DS 19] EMV® 3-D Secure Approval Bulletin n°19 – Selectable EMV® 3-D Secure Specification Versions During an Approval Latest Available Publicly Available [AB 3DS] EMV® 3-D Secure Application Bulletins (AB Bulletins) All Publicly Available EMV® 3-D Secure Approval Test Platform Provider Recognition and Test Platform Qualification Process v1.3 / 39 Ref. Document Title Version Distribution [APP COM 03] EMV® 3-D Secure Approval Communication n°3 – Test Plan Implementation Qualification (Step 2c) – ACS, 3DS Server, DS components Latest Available Restricted to Test Platform Providers [APP COM 04] EMV® 3-D Secure Approval Communication n°3 – Test Plan Implementation Qualification (Step 2c) – 3DS SDK component Latest Available Restricted to Test Platform Providers [APP COMS] EMV® 3-D Secure Approval Communications All Restricted to Test Platform Providers Test Document License Agreement Latest Available Restricted to Laboratories and Test Platform Providers Test Platform Provider Agreement Latest Available Restricted to Test Platform Providers Table 1.3: 3-D Secure Test Platform Forms Ref. Document Title Version Distribution [ICS 3DS] 3-D Secure
  • Implementation Conformance Statement Latest Available Publicly Available 3-D Secure Report Template Latest Available Restricted to Laboratories and Test Platform Providers [TPP RRF] 3-D Secure – Test Platform Provider Request for Registration Form Latest Available Publicly Available 3-D Secure – Test Platform Qualification Declaration Latest Available Restricted to Test Platform Providers Table 1.4: External

References

Ref. Document Title Version Distribution [ISO27001] ISO/IEC 27001 Security techniques / Information security management systems Requirements Latest Available Publicly Available [SSAE18] AICPA Statement on Standards for Attestation Engagements no. 18 Latest Available Publicly Available EMV® 3-D Secure Approval Test Platform Provider Recognition and Test Platform Qualification Process v1.3

/ 39

1.4

Definitions

Table 1.5 defines selected terms used in this document. Table 1.5: Definitions Term Definition 3DS Approval Bulletin Public notification released to communicate updates to the 3-D Secure Approval Process (Test Plan activation date or process updates). 3DS Approval Communication Restricted notification released to communicate to the Laboratories and/or Test Platform Providers updates to the 3-D Secure Approval Process (Test Plan activation dates, test case or Test Platform issues, testing guidelines, or process updates). 3DS Component There are 4 3DS components:

  • 3DS SDK (Default-SDK or Split-SDK variants)
  • 3DS Server
  • Directory Server (DS)
  • Access Control Server (ACS) Recognition Formal recognition by EMVCo that a Test Platform Provider is competent to operate 3DS Test Platform services for one or more categories of testing defined by EMVCo 3-D Secure Approval procedures. Active/Activation Refers to the condition that a Protocol Version, Test Plan version or a specific Test Plan Implementation is deployed on an EMVCo Recognised Test Platform and becomes available for Product Provider to execute. Active Protocol The list of the active Protocol Versions is provided in the latest 3DS Specification Bulletin 255 [SB 3DS 255]. Approval Acknowledgment by EMVCo that the specified product has demonstrated sufficient compliance to the EMV Specifications for its stated purpose. EMVCo The organization that manages the EMV specifications and their related testing processes. EMVCo Recognised Laboratory (or Test Laboratory or Laboratory) An independent, impartial entity that has been audited by an EMVCo Qualified Auditor for compliance with EMVCo 3DS Laboratory requirements and has received a Letter of Recognition from EMVCo, entitling it to perform 3DS testing. EMVCo Recognised Test Platform Provider (or Test Platform Provider) An independent, impartial entity that has been audited by an EMVCo Qualified Auditor for compliance with EMVCo 3DS Test Platform requirements and has received a Letter of Recognition from EMVCo, entitling it to offer 3DS Test Platform services. EMV® 3-D Secure Approval Test Platform Provider Recognition and Test Platform Qualification Process v1.3 / 39 EMVCo 3DS Approval Secretariat The EMVCo entity that manages the 3-D Secure Approval process defined in [AP 3DS] and related documents. EMVCo 3DS Laboratory Document Repository A digital file repository, used for distributing material from EMVCo to Laboratories, for example Test Plans. Currently referred to as Thrive. EMVCo Qualified Auditor An independent, impartial entity that has received a Letter of Qualification from EMVCo, entitling it to verify conformance to EMV defined Approval procedures. EMVCo Qualified Test Platform A Test Platform for which the Test Platform Provider has received a Letter of Qualification from EMVCo. Letter of Recognition Written statement that documents the decision of EMVCo that a 3DS Test Platform Provider has been audited and recognised by EMVCo and is competent to carry out specific functions as defined by EMVCo type approval procedures and EMV Test Platform requirements. Letter of Qualification Written statement that documents the decision of EMVCo that a 3DS Test Platform has demonstrated sufficient compliance to support and operate EMV test plans and requirements. Letter of Revocation Written statement that documents the decision of EMVCo that a Test Platform is no longer an EMVCo Qualified Test Platform and that the Test Platform Provider’s EMVCo Test Document License Agreement is terminated. Licensee An entity that has executed a Test Document License Agreement with EMVCo. Multi-Protocol Version Support 3DS components are required to support all active Protocol Versions as defined in [PCF 3DS] Requirement 311 and in the latest 3DS Specification Bulletin 255 [SB 3DS 255]. This rule is applied in Compliance testing to include the highest Protocol Version selected and all lessor active Protocol Versions. Overlapping Period Period where both the Incoming and Outgoing Test Plans under a single Protocol Version are active and supported on the Test Platform. This period ends when the Outgoing Test Plan Version becomes Inactive. Protocol Version Protocol Version defines the interoperability between the 3DS Secure components. Protocol Version format is MAJOR.MINOR.PATCH and it is defined in [VER 3DS]. Product Provider The entity that submits a 3-D Secure component for approval. EMV® 3-D Secure Approval Test Platform Provider Recognition and Test Platform Qualification Process v1.3 / 39 Qualification Process to obtain formal recognition by EMVCo that a Test Platform has sufficiently implemented the test cases for a particular EMVCo Test Plan or type of EMVCo testing. Qualification Reference Number A unique identification number that EMVCo assigns to a specific version of the Test Platform once that version of the Test Platform has been qualified. Registration Number Unique identification number that EMVCo assigns to a Test Platform Provider, to be used on all communication and reports sent to EMVCo. Selectable Protocol The list of the selectable Protocol Versions for a 3DS approval is provided in [AB 3DS 19] Specification Bulletin Notification released to communicate updates to the EMV specifications. System Under Test The 3-D Secure Component (may include hardware with identified Operating System) that is being evaluated for its compliance with EMVCo specification and for receipt of LOA Test Case A description of the actions required to achieve a specific test objective. Test Plan Specification describing all Test Cases that have to be run to verify the compliance of a 3DS component to a version of 3DS Secure protocol and Core Functions Specification and 3DS Secure SDK Specification. Test Plan Implementation Implementation of a Test Plan by a Test Platform Provider in its testing environment. Test Platform (or 3DS Test Platform) An online test system that has been EMVCo recognised for 3DS testing. The Test Platform executes 3-D Secure test plans and test cases which SUTs use for 3DS compliance approval. Test Platform Recognition Manager An independent, impartial entity that has been selected by EMVCo to supervise the recognition of a Test Platform Provider and to conduct qualification evaluations. Test Platform Provider Entity developing and hosting the Test Platform, in accordance with EMVCo Test requirements. Test Platform Qualification Declaration Form in which the Test Platform Provider indicates for which Test Plan Version and 3DS Components he wants to submit its Test Platform for qualification Test Platform Under Test A Test Platform that is in the process of qualification by EMVCo Test Script The implementation of an individual test case. EMV® 3-D Secure Approval Test Platform Provider Recognition and Test Platform Qualification Process v1.3 / 39 Test Suite The total collection of all test scripts that implement the individual test cases for a particular Test Plan version. The Test Suite also includes the documentation as well as the System Under Test Requirements. EMV® 3-D Secure Approval Test Platform Provider Recognition and Test Platform Qualification Process v1.3 / 39

1.5 Notational Conventions 1.5.1 Abbreviations The abbreviations listed in Table 1.6 are used in this document. Table 1.6: Abbreviations Abbreviation Description 3DS EMV 3-D Secure 3DSS 3DS Server 3DS TG EMVCo 3DS Testing Group DS Directory Server ACS Access Control Server ICS Implementation Conformance Statement LoA Letter of Recognition LoQ Letter of Qualification SDK Software Development Kit TPAM Test Platform Recognition Manager TPP Test Platform Provider TPQD Test Platform Qualification Declaration TPUT Test Platform Under Test 1.5.2 Terminology and Conventions The following words are used often in these specifications and have a specific meaning: Shall Defines a product or system capability which is mandatory. May Defines a product or system capability which is optional or a statement which is informative only and is out of scope for these specifications. Should Defines a product or system capability which is recommended. EMV® 3-D Secure Approval Test Platform Provider Recognition and Test Platform Qualification Process v1.3

/ 39

2 Obtain Test Platform Provider Recognition A 3DS Test Platform Provider shall obtain EMV recognition in order to prove compliance to the Test Platform Provider requirements described in the Test Platform Requirements [TP REQ]. The EMV Test Platform Provider recognition process comprises three different steps that have to be performed according to the sequence below: After completing steps 1, 2 and 3 successfully, EMVCo issue a Letter of Qualification for the Test Platform and a Letter of Recognition to the Test Platform Provider. With both letters, the Test Platform Provider is authorised to offer 3DS testing services. Note: Please refer to Appendix A –

Requirement

Matrix for the detailed list of requirements that will be evaluated during the recognition process. Note: EMVCo reserves the right, at its own discretion and without providing a detailed explanation, to deny a Test Platform Provider the right to proceed through the recognition process. Note: Test Platform Provider recognition is subject to fees (See Appendix B – Test Platform Provider Fees). Note: Step 3 may start before the completion of Step 2C at the discretion of EMVCo. Step 1- Registration and Legal Agreements Step 3 – Initial Recognition Audit Step 2 – Test Platform « Recognition » Qualification

  • Step 2A: Functionalities and User Interface
  • Step 2B: Platform Design and Implementation
  • Step 2C: Test Plan Implementation EMV® 3-D Secure Approval Test Platform Provider Recognition and Test Platform Qualification Process v1.3 / 39

2.1 Test Platform Recognition Manager A Test Platform Recognition Manager (TPAM) is assigned by EMVCo to supervise the recognition of a Test Platform Provider. The TPAM can be contacted at tpam@emvco.com when a Test Platform Provider is in preparing for the recognition. The Test Platform Recognition Manager:

  • Follows up the registration and the signature of the legal agreement by the Test Platform Provider (Step 1)
  • Is the main interface to the Test Platform Provider during the Test Platform qualification (Step 2),
  • Shall be informed by the TPP of the selected Product Provider participants and the schedule of the Test Platform qualification,
  • Is authorised by EMVCo to access the Test Platform Under Test (TPUT) and to request TPUT documentation in order to perform the “Recognition” qualification Steps 2A and 2B described in this document (see sections 2.3.2.1 and 2.3.2.2),
  • Discusses and reviews test report discrepancies where the outcome of a test case does not match what was expected during the Step 2C (see section 2.3.2.3),
  • Analyses results of qualification steps 2A, 2B and 2C and provides recommendation to 3DS TG for review and conclusion on the qualification of the TPUT in an evaluation report.
  • Supervises the Initial Recognition Audit of the Test Platform Provider (Step 3) Note: TPAM remains the main interface of a Test Platform Provider in case of other qualification processes as described in section 3.1. EMV® 3-D Secure Approval Test Platform Provider Recognition and Test Platform Qualification Process v1.3 / 39

2.2 Step 1- Registration and Legal Agreements Each new Test Platform Provider that wants to be recognised by EMVCo for 3-D Secure Functional Evaluations shall register with EMVCo and sign agreements. This process is described in Table 2.1. Note: Before applying to Test Platform Provider recognition according to the process described in Table 2.1, a candidate Test Platform Provider may obtain the 3DS Test Plan [TC 3DS] as well as the 3-D Secure Approval Bulletin n°4 [AB 3DS 04] related to Test Platform Provider Fees upon signature of an NDA with EMVCo. Table 2.1: Registration and Contracts Procedure Entity Process Test Platform Provider Sends email request to the EMVCo Secretariat at EMVCo Secretariat to begin the recognition process; the request shall include the following:

  • Executive and financial summary
  • Technical expertise summary, including experience with EMV 3DS Specifications
  • Test Platform Provider background
  • 3DS Request for Registration Form [TPP RRF] Note: If the entity is already known by EMVCo as a recognised Laboratory or a qualified Test Tool Provider for any EMVCo Approval, the executive and financial summary as well as the Test Platform Provider background may not be required if relevant materials have been previously provided to EMVCo. The documents provided shall permit a verification of the compliance to the requirements described in [TP REQ] sections:
  • 3.1.1 Partnership
  • 3.1.2 Financial
  • 3.1.3 Legal Entity
  • 3.1.5 Independence
  • 3.7.2 Personnel Management EMV® 3-D Secure Approval Test Platform Provider Recognition and Test Platform Qualification Process v1.3 / 39 Entity Process EMVCo 3DS Secretariat Evaluates whether Test Platform Provider qualifies to be accepted for consideration as a potential EMVCo Recognised Test Platform Provider
  • Informs Test Platform Provider if it may proceed with recognition
  • Provides Test Platform Provider with:
  • The EMVCo 3DS Test Platform Provider Agreement for signature
  • The EMVCo Test Document License Agreement for signature Test Platform Provider
  • Signs the Test Platform Provider License Agreement (using docusign)
  • Signs the EMVCo Test Document License Agreement (using docusign) EMVCo 3DS Secretariat
  • Signs the Test Platform Provider Agreement (using docusign)
  • Signs the Test Document License Agreement (using docusign)
  • Provides Test Platform Provider with a Registration Letter including a Registration Number, to be used on all communications and reports sent to EMVCo
  • Provides credentials to access Thrive containing documents and communication restricted to Test Platform Providers
  • Provides credentials to access the 3DS Knowledge Database (that list and describe Pass* and Knowledge Items) Test Platform Provider
  • Requests a “Recognition” qualification of the Test Platform (see section 2.3)
  • Starts the initial recognition audit of the Test Platform Provider (see section 2.4) EMV® 3-D Secure Approval Test Platform Provider Recognition and Test Platform Qualification Process v1.3 / 39

2.3 Step 2- Test Platform “Recognition” Qualification The Test Platform “Recognition” Qualification process includes 3 verification steps that are performed on the Test Platform:

  • Step 2A - Test Platform Functionalities and User Interface Verification (through live access to the Test Platform) – see section 2.3.2.1.
  • Step 2B – Platform Design and Implementation Verification (Document based) – see section 2.3.2.2.
  • Step 2C - Verification of the Test Plan implementation(s) using 3DS Components having a valid LoA – see section 2.3.2.3. The Test Platform Recognition Manager (TPAM) is responsible for the organization and management of the three qualification Steps 2A, 2B and 2C. The Test Platform Provider will interface with the TPAM for the qualification of its Test Platform. The Test Platform submitted for qualification is called Test Platform Under Test (TPUT).

2.3.1 Test Platform Qualification Declaration Before starting the Test Platform “Recognition” Qualification of the TPUT (or any Test Platform Qualification described in section 3.1), the Test Platform Provider (TPP) shall fill and submit a Test Platform Qualification Declaration (TPQD) to EMVCo 3DS Secretariat and TPAM. This form is available on Thrive. This form will indicate:

  • For which Protocol Version(s) / Test Plan version(s) TPP wants its Test Platform to be recognised for. Note: For each Protocol Version listed, the latest Test Plan version available when the TPQD is submitted shall at minimum be documented in the TPQD and used during the qualification.
  • For which 3DS Component TPP requests its Test Platform to be recognised for.
  • The 3DS Components selected for the Qualification step 2C. At reception of the TPQD, the TPAM verifies that it is consistent. A qualification session starts at the acceptance of the TPQD by the TPAM and the scope of the qualification session is defined by the content of the TPQD. Note: The TPP may decide to have separate qualification of its Test Platform for each active Protocol Version. In this case the qualification shall start from the lowest Protocol Version(s) to the highest Protocol Version(s). Note: The TPP may decide to have separate qualification of its Test Platform for each component the TPP intends to support. Note: Invoicing for qualification fee as described in Appendix B – Test Platform Provider Fees, occurs at the start of the Test Platform Qualification or Specification Bulletin Qualification session. EMV® 3-D Secure Approval Test Platform Provider Recognition and Test Platform Qualification Process v1.3 / 39 2.3.2 “Recognition” Qualification Process The following sections describe the process to perform the three steps of the Test Platform “Recognition” Qualification: 2.3.2.1 “Recognition” Qualification Step 2A - Platform Functionalities and User Interface Verification The Test Platform Provider shall give remote access to its TPUT to the TPAM so that the TPAM can verify the conformance to functional requirements detailed in the section 3.2.5 to 3.2.11 of the Test Platform Requirements [TP REQ]:
  • Test Session and User interface,
  • PKI Management,
  • Test Plan Selection,
  • Multi-Protocol Version Support,
  • ICS import/export,
  • Report generation,
  • Documentation. A demonstration may be required to facilitate the verification. The conclusion of this review is provided to both TPP and EMVCo by the TPAM. 2.3.2.2 “Recognition” Qualification Step 2B – Platform Design and Implementation Verification The Test Platform Provider shall respond to a self-assessment questionnaire and upon request deliver the appropriate specification and implementation documentations including any validation and test result reports of its TPUT to the TPAM so that TPAM can verify the conformance to requirements 3.2.1, 3.2.3, 3.2.4, 3.4.1, 3.4.2, 3.5.1 and 3.5.2 of the Test Platform Requirements [TP REQ]:
  • Architecture,
  • Harness and SUT Requirements,
  • Reference/Requestor Application,
  • Application & Platform Management,
  • Application & Platform Resilience,
  • Performance,
  • Service Availability. The conclusion of this review is provided to both TPP and EMVCo by the TPAM. EMV® 3-D Secure Approval Test Platform Provider Recognition and Test Platform Qualification Process v1.3 / 39 2.3.2.3 “Recognition” Qualification Step 2C - Verification of the Test Plan(s) implementation In this step, EMVCo ensures that the 3DS Test Plan(s) released by EMVCo and supported by the TPUT are implemented correctly on the TPUT to ensure a good verification of 3DS product component submitted for 3DS approval. The Test Platform Provider shall perform required test sessions on 3DS products (components) having a valid Letter of Approval from EMVCo and shall submit the reports generated by the platform to the TPAM for review. If several Protocol Versions are listed in the TPQD, the verification of the Test Plan Implementation will be performed for each Protocol Version. The different steps of this verification are described in Table 2.2. Table 2.2: Verification of the Test Plan(s) implementation Entity Process Test Platform Provider
  • Identifies and selects Product Providers for each 3DS component it wants its TPUT to be qualified for. The detailed rules to select Product Providers for a qualification are described in the latest version of [APP COM 03] and [APP COM 04]
  • Informs the TPAM of the schedule planned for the 3DS component testing and provides a read access (or equivalent) to the testing environment to control the test results. Note: If the candidate Product Provider’s does not meet EMVCo requirements, EMVCo may reject it at its own discretion Note: If the qualification highlights a Test Plan issue or a Product issue that was not identified during the approval process of the product, the issue will be managed as part of EMVCo’s business as usual defect/issue management process as described in [TP REQ] and its impact will be evaluated. Note: The selected 3DS components will be used to test each Protocol Version listed in the TPQD. Product Provider Connects to the Test Platform for the selected 3DS Component to be tested and performs a full 3DS test session for the selected product component(s). Note: Assistance of the Test Platform Provider to the Product Provider is required during this step. Note: The process may require several iterations of test session. Note: TPAM may participate during this step by monitoring the test session. EMV® 3-D Secure Approval Test Platform Provider Recognition and Test Platform Qualification Process v1.3 / 39 Entity Process Test Platform Provider Checks the test report obtained for the 3DS Component tested on the TPUT. The objective is to obtain:
  • No Fail results
  • N/A results (in case of options not supported by the product)
  • Pass or Pass* results (**) the Pass and Pass* results may be different between the product’s LOA test report and the TPUT test report on the same 3DS component because the Test Plan may have been updated in between the two testing sessions (to fix some Pass* for instance) Once the test report is available and compliant with the above objectives, sends it to the TPAM for review and approval. Note: During this phase, the TPP may interface with TPAM in case of questions on the output of a Test Case. Note: Test reports can be submitted to the TPAM a maximum of 3 times over a maximum period of 3 months in a qualification session (regardless of the number of components supported in TPQD). Test reports submitted in batch for several components are considered as a single submission. Test Platform Recognition Manager
  • Following the execution of the testing, checks the test reports generated by the TPUT for the 3DS Component.
  • Submit the evaluation report to the 3DS TG for final acceptance The above steps shall be repeated for each 3DS component and each Protocol Version supported EMV® 3-D Secure Approval Test Platform Provider Recognition and Test Platform Qualification Process v1.3 / 39

2.3.3 EMVCo Review and Delivery of Letter of Qualification Once the 3 steps 2A, 2B and 2C of the Test Platform “Recognition” qualification have been completed for the TPUT, the TPAM combines the outputs of these steps and evaluates the results in an evaluation report. The TPAM analysis and recommendation is provided to 3DS TG that reviews them and concludes on the qualification of the TPUT:

  • If all the results are compliant with the requirements, 3DS TG informs the Test Platform Provider of the qualification of its Test Platform. A Letter of Qualification indicating supported Test Plan is created for the tested component(s) and delivered to the Test Platform Provider. In case the qualification was performed for the first time, publication on the web site will be on hold by 3DS TG until the Test Platform Provider has successfully concluded its initial recognition audit (see section 2.4).
  • 3DS TG may accept non-compliant results if a resolution plan is provided by the Test Platform Provider and it is considered acceptable by EMVCo. In this case, EMVCo may create a provisional Letter of Qualification. Criteria to deliver a provisional Letter of Qualification and its validity are at the discretion of EMVCo but is generally matching the time plan agreed in the resolution plan. A final Letter of Qualification is delivered when all non-compliance results have been fixed. In case the qualification was performed for the first time, publication on the web site will be on hold by 3DS TG until the Test Platform Provider has successfully concluded its initial recognition audit (see section 2.4).
  • If one or more report is not acceptable, 3DS TG informs the Test Platform Provider of the qualification conclusion. In this case, the Test Platform Provider shall fix the issues and run qualification again. Note: the qualification fee may apply again according to the limits defined in Table 2.2 EMV® 3-D Secure Approval Test Platform Provider Recognition and Test Platform Qualification Process v1.3 / 39

2.4 Step 3 - Initial Recognition Audit 2.4.1 Initial Recognition Audit

Description

Test Platform Provider will follow an Audit process as described in Table 2.3. The recognition audit can only take place once the Test Platform has obtained at minimum a provisional LoQ. Note: Payment of fees for audit tasks undertaken by EMVCo Qualified Auditors is the responsibility of the Platform Provider requesting EMVCo’s recognition. EMVCo is not responsible for auditor fees. Table 2.3: Initial Recognition Audit process Entity Process Test Platform Provider (TPP)

  • Selects an auditor from the list of EMVCo Qualified Auditors available on EMVCo website and makes financial and legal arrangements with the auditor for the TPP to be audited
  • Informs EMVCo of Qualified Auditor selected
  • Provides to the Qualified Auditor the information and documents required to meet the audit requirements.
  • Demonstrates how the Test Platform is operated (as described in section 2.4.2.3). EMVCo Qualified Auditor
  • Performs audit in accordance with 3DS requirements described in section 2.4.2:
  • Ensures TPP meets all requirements detailed in [TP REQ] Note: Some requirements may already have been checked during Registration and Contract step or during the Test Platform Qualification and the auditor may not check them again.
  • Provides audit findings to the TPP
  • If a corrective action plan (as described in section 2.4.2.4) is NOT necessary: Provides audit report to EMVCo Test Platform Provider If a corrective action plan (as described in section 2.4.2.4) is necessary:
  • Defines the action plan with deliverables and due dates to meet all EMV requirements
  • Provide action plan to EMVCo Qualified Auditor EMVCo Qualified Auditor If a corrective action plan is necessary:
  • Reviews and validates the action plan defined by the TPP
  • May ask the TPP to update its plan if necessary,
  • Provides a copy of the validated TPP action plan in its audit report to EMVCo EMV® 3-D Secure Approval Test Platform Provider Recognition and Test Platform Qualification Process v1.3 / 39 Entity Process EMVCo 3DS TG Reviews audit report (and action plan, if any) and determines whether the TPP may be recognised or whether follow-up action is required Note: EMVCo reserves the right to deny recognition at its own discretion and without detailed explanation.
  • If audit report is acceptable to EMVCo AND the Test Platform has been qualified (LoQ or provisional LoQ granted):
  • Sends the Test Platform Provider an initial Letter of Recognition with a validity of typically nine months
  • Adds the TPP to the list of recognised Test Platform Providers on the EMVCo website
  • If audit report is acceptable AND the Test Platform has been qualified (LoQ or provisional LoQ granted) but action items of the TPP are required (e.g. a corrective action plan is pending), EMVCo 3DS TG may grant recognition on a provisional basis, as follows:
  • Sends the TPP a provisional Letter of Recognition with conditions (with a validity of nine months maximum). The letter will include the list of action items and a date by which they shall be completed.
  • Adds the TPP to the list of recognised TPPs on the EMVCo website Note: EMVCo reserves the right to extend the duration of the provisional Letter of Recognition at its own discretion. Test Platform Provider
  • Before the expiration of the initial or provisional Letter of Recognition, the TPP shall organise an Interim Proficiency Audit (as described in section 3.2.2). EMVCo Qualified Auditor
  • Performs Interim Proficiency Audit on: o the TPP’s operational review and validation activities during the period of the initial or provisional Letter of Recognition, o the results of the action plan if it had been requested during the initial recognition audit. Note: Additional check points will be organised remotely by the EMVCo Qualified Auditor before the Interim Proficiency audit to follow up the implementation of the action plan (see details in section 2.4.2.4)
  • Provides audit report to EMVCo. EMVCo 3DS TG If no issues have been detected during the review by EMVCo of the report from the TPP or from the EMVCo Qualified Auditor and if no corrective actions have been identified during the Interim Proficiency Audit, then the Test Platform Provider’s recognition is extended to three years from the initial recognition date. If issues and/or corrective action items have been identified, depending on the severity and number of deviations, a new interim proficiency audit may be required and the extension of the TPP recognition may be reduced by one to two years at EMVCo discretion. EMV® 3-D Secure Approval Test Platform Provider Recognition and Test Platform Qualification Process v1.3 / 39 Figure 2.1: Process Flow 1 - Initial Recognition Audit Process Auditor: Performs audit as per this document Provides audit findings to TPP N Y Corrective action plan needed? TPP sends audit report to EMVCo TPP defines action plan Auditor reviews and validates action plan No with action items Audit report is acceptable to EMVCo and Test Platform has been qualified? End Yes EMVCo: Sends TPP Initial Letter of Recognition Adds TPP to list of recognised TPPs on the EMVCo website EMVCo: Sends TPP Provisional Letter of Recognition Adds TPP to list of recognised TPPs on the EMVCo website TPP must complete Interim Proficiency Audit on the TPP s operational activities and complete pending action items (within 9 months) TPP provides requested written evidences TPP must complete Interim Proficiency Audit on the TPP s operational activities (within 9 months) TPP selects EMVCo Qualified Auditor If no major issues detected during the report review, and no corrective actions identified during the Interim Proficiency audit, EMVCo extends TPP recognition to 3 years EMV® 3-D Secure Approval Test Platform Provider Recognition and Test Platform Qualification Process v1.3 / 39

2.4.2 Audit Requirements In order to prove conformance to the Test Platform Requirements described in [TP REQ], the Test Platform Provider shall do the following:

  • Provide written evidence to the EMVCo Qualified Auditor before or during the audit
  • Complete a physical site visit
  • Demonstrate that the Test Platform and test Platform personnel are operational in accordance to the Test Platform requirements
  • Demonstrate use of EMVCo 3DS Knowledge Database and EMVCo 3DS Ticketing Process
  • Complete a corrective action plan, if applicable This section describes information that the Test Platform Provider is required to supply to the EMVCo Qualified Auditor, and the level of detail required in the audit reports. The EMVCo Qualified Auditor, in reviewing the documentation, may request additional information from the Test Platform Provider prior to or during the site visit and/or the demonstration of testing capabilities. In preparation for the audit, the Test Platform Provider shall provide written consent for disclosure of this information to EMVCo and to the EMVCo Qualified Auditor during the site visit. The audit report that EMVCo receives from the EMVCo Qualified Auditor shall have the level of detail specified in this section.

2.4.2.1 Written Evidence 2.4.2.1.1 Business Conformance The Test Platform Provider provides the EMVCo Qualified Auditor with evidence of conformance to the Test Platform Provider business requirements. This evidence may be in the form of a written report describing:

  • Services of the organization
  • Structure of the organization, demonstrating the isolation between the Test Platform Provider and other areas of the organization (e.g. design area)
  • Percentage of revenue received from each of the Test Platform Provider’s top ten Product Provider customers relative to the total revenue of the Test Platform Provider
  • Organization legal information
  • Certificate of ownership and/or tax identification number In addition, the Test Platform Provider must provide the EMVCo 3DS Approval Secretariat with the following:
  • Audited financial statements for the organization
  • Official Annual Report as required by national or international law and/or regulation Note: A financial Statement is not required when the Test Platform Provider site is already recognised by EMVCo for another activity not listed in the present document. Note: The Auditor may not request some business conformance evidences if they have already been checked during the registration step. EMV® 3-D Secure Approval Test Platform Provider Recognition and Test Platform Qualification Process v1.3 / 39 2.4.2.1.2 Security Conformance The Test Platform Provider provides to the EMVCo Qualified Auditor evidence of physical and logical security conformance for the Test Platform Location. This evidence must be in the form of an audit result report compliant with an information security standards such as ISO 27001, SSAE 16 or SSAE 18. This report shall cover the detailed aspects described in [TP REQ]. Additionally, the Test Platform Provider provides the vulnerability scan checks, penetration tests and secure code scan as requested in [TP REQ]. 2.4.2.1.3 Operational, Performance and Maintenance Conformance The Test Platform Provider provides to the EMVCo Qualified Auditor evidence of the processes and procedure in place to conform to the operational, performance and maintenance requirement described in [TP REQ]. This evidence must include:
  • Service availability control procedures
  • Incident management and ticketing procedures
  • Change management procedures
  • Disaster Recovery procedures
  • Backup procedures 2.4.2.1.4 Administrative Conformance The Test Platform Provider provides to the EMVCo Qualified Auditor evidence of administrative conformance. This evidence may be in the form of a written report describing:
  • Formal recognitions
  • The Test Platform Provider’s quality assurance system. The quality assurance system must comply with the requirements of the EMV approval process. As such, the description shall contain, for instance:
  • An Overview of the Test Platform Provider personnel and the qualifications of Test Platform Provider personnel involved in the performing of any testing or administrative duties related with approval testing using the Test Platform. These duties include test result validation, test report generation, review as well as maintaining records for each approval session to provide during auditing, if requested
  • Overview of the Test Platform Provider techniques
  • Overview of Test Platform Provider asset management system for documentation
  • Overview of Test Platform software configuration management or version control 2.4.2.1.5 Communication Conformance The Test Platform Provider provides to the EMVCo Qualified Auditor evidence of communication conformance (To and from EMVCo) as defined in [TP REQ]. This evidence shall be included within Test Platform Provider’s procedures and documentation. EMV® 3-D Secure Approval Test Platform Provider Recognition and Test Platform Qualification Process v1.3 / 39

2.4.2.2 Site Visit EMVCo requires the auditor to conduct a visit at the Location for which the Test Platform Provider is seeking recognition. The objectives of the site visit are to:

  • Verify that Test Platform Provider documentation and actual Test Platform Provider implementation are consistent
  • Observe the physical environment of the organization and the physical security measures taken
  • Verify the application of the service availability control procedures
  • Verify the application of the incident management procedures
  • Verify the application of the change management procedures including the software configuration management or version control
  • Verify the physical and logical security compliance
  • Verify the technical expertise of the Test Platform Provider’s personnel
  • Verify the Test Platform Provider’s business requirements including Independency, Impartiality, Confidentiality
  • Verify the Test Platform Provider’s Resource requirements (Personnel, Facilities, systems and support services necessary to manage and perform the Test Platform Provider activities)
  • Verify the Test Platform Provider’s quality assurance procedures.

2.4.2.3 Demonstration of Test Platform in Operation EMVCo may require a demonstration of the Test Platform Provider’s actual verification capabilities. This may be done through witnessing the Test Platform Provider’s verification of a product or through pilot testing. Pilot testing is defined as the Test Platform Provider’s performing verification of test result on a previously approved EMVCo product or on a simulation product and providing a test report to the EMVCo Qualified Auditor to review. The choice of subject for this pilot validation is at the discretion of EMVCo and EMVCo reserves the right to witness a part of this validation. EMV® 3-D Secure Approval Test Platform Provider Recognition and Test Platform Qualification Process v1.3

/ 39

2.4.2.4 Corrective Action Plan An audit report may indicate that the Test Platform Provider does not meet all necessary requirements but has demonstrated sufficient capabilities that with specific corrective actions, it would do so. If so:

  • The Test Platform Provider will define an action plan with deliverables and estimated due dates for each deviation to meet all EMV requirements. Action plan shall include a brief analysis of the issue (root cause). When appropriate, preventive action may be described in addition to the corrective action. Test Platform Provider may use the template provided in Appendix C to report their action plan.
  • The EMVCo Qualified Auditor will review and validate the action plan, then provide a copy of the validated action plan in its audit report to EMVCo.
  • EMVCo, when reviewing the audit report, will review the action plan and, if the plan is acceptable, may grant recognition on a provisional basis and set a date when an Interim Proficiency Audit will be required, see 3.2.2.
  • After the delivery of the provisional recognition, the EMVCo Qualified Auditor will follow up the implementation of the action plan according to the following rules:
  • Three checks will be made over one year. The first review will take place three months after the audit report, the second review after six months and the third review after one year.
  • At each checkpoint, the EMVCo Qualified Auditor will ask the Test Platform Provider to provide a status on the open corrective actions and the evidence of the implementation of the closed corrective actions. Evidences can consist in screenshot, document's extract or even full document. In such case, Test Platform Provider shall precisely indicate what was fixed. Ideally, all evidences for a given deviation should be gathered in a unique location (sheet of xls file, folder) named with the deviation's reference.
  • The EMVCo Qualified Auditor will review the evidences and will provide feedback to the Test Platform Provider.
  • Corrective actions that have not been fully implemented after one year will be reported to EMVCo for decision on the next step. EMV® 3-D Secure Approval Test Platform Provider Recognition and Test Platform Qualification Process v1.3 / 39 3 Maintain Test Platform Provider Recognition A Test Platform Provider shall maintain current functional qualification for its Test Platform. Therefore, several types of 3DS Test Platform qualification may be required in addition to the Test Platform “Recognition” qualification. The Test Platform Recognition Manager is the main interface of the Test Platform Providers during the qualification processes described in this section.

3.1 Additional Types of Qualification Processes Each type of Test Platform qualification process described in this section requires the submission of a Test Platform Qualification Declaration (see section 2.3.1).

3.1.1 Protocol or Component Qualification As indicated in the 3DS Test Platform Requirements, the Test Platform Provider may choose the 3DS Components as well as the version of Active Protocols its Test Platform will support. Consequently, a Test Platform Provider may perform an “Recognition” Qualification for one 3DS component only or for one version of Active Protocol only, and request a Protocol Version or Component qualification for additional 3DS component or additional Protocol Version at a later stage In this case the same process as described in section 2.3 applies. However, EMVCo may decide that some items listed in section 2.3.2.1 or 2.3.2.2 do not have to be performed again if they are not linked to a specific 3DS component or Protocol Version. TPAM will communicate the details of qualification with the Test Platform Provider. Note: Protocol Version or Component Qualification is subject to fees (See Appendix B – Test Platform Provider Fees).

3.1.2 Test Plan Implementation Qualification requested by EMVCo EMVCo is updating released Test Plan on a regular basis. This can be due to a specification bulletin of 3DS protocol being released or to enhancement of the existing test plan. Type Approval Bulletins and/or new test plan releases detail any necessary updates to the EMVCo test cases. The Test Platform Provider shall update its Test Platform to support the updates to the test plan on the required date agreed with EMVCo. Depending on the number and complexity of the changes introduced by EMVCo, the requested Test Platform qualification may vary from a self-qualification by the Test Platform Provider and the delivery of the self-qualification evidence, to a formal verification of the Test Plan(s) implementation as described in section 2.3.2.3. EMVCo will inform the Test Platform Provider of the qualification requirements. If a Test Platform Provider cannot meet the timeframe defined by EMVCo, the Test Platform still maintains its qualification for the previous version of the test cases. However, when the previous version of the test cases is deactivated at the end of the overlapping period, EMVCo Recognised Laboratories will not be able to use the Test Platform that does not contain the latest updates, for EMVCo approval testing. Note: Test Plan Implementation Qualification may be subject to fees (See Appendix B – Test Platform Provider Fees). EMV® 3-D Secure Approval Test Platform Provider Recognition and Test Platform Qualification Process v1.3

/ 39

3.1.3 Qualification requested by EMVCo – Test Platform or Script Update If the Test Platform Providers implements changes on the Test Platform or on the script for maintenance reasons (without Test Plan update), it has to inform EMVCo of the reason of the changes with sufficient notice (See [TP REQ]). EMVCo will assess on a case by case basis the Test Platform qualification requirements. Note: Test Platform or script update Qualification may be subject to fees (See Appendix B – Test Platform Provider Fees). Note: When EMVCo grants a new Letter of Qualification to the Test Platform, this latest LoQ shall replace and revoke any previous LoQ(s) granted for the Protocol Version. The latest LoQ(s) for the Protocol Version shall be used in Test Platform and laboratory- related materials.

3.2 Additional Types of Recognition Audit Additional types of audits may be required during a Platform Provider’s agreement with EMVCo

  • Recognition Renewal Audit
  • Interim Proficiency Audit 3.2.1 Recognition Renewal Audit A Test Platform Provider shall be audited as specified in the recognition letter to renew its EMV recognition. The requirements for the Recognition Renewal Audit are determined by EMVCo at the time of renewal. The audit may include all items identified in section 2.4.2 or EMVCo may select specific items for the auditor to cover. The audit shall be completed before the expiration date of the Test Platform Provider’s recognition. If a Test Platform Provider wishes to renew its recognition with EMVCo, the Test Platform Provider should contact EMVCo at least four months prior to the expiration date of the Test Platform Provider’s recognition. It is the responsibility of the Test Platform Provider to renew its recognition before it expires. If a Test Platform Provider does not renew its recognition, EMVCo may revoke its recognition. See section 4.2 and 4.3. If the recognition renewal has not been granted by EMVCo before the expiration date, the Approval Secretariat will stop reviewing any Test Report from the concerned Test Platform Provider. Table 3.1 outlines the steps in the recognition renewal process. Table 3.1: Recognition Renewal Audit process Entity Process Test Platform Provider (TPP) Sends email request to EMVCo Secretariat to begin the recognition renewal process Note: If a TPP wishes to renew its recognition with EMVCo, the TPP should contact EMVCo at least four months prior to the expiration date of the TPP’s recognition. EMV® 3-D Secure Approval Test Platform Provider Recognition and Test Platform Qualification Process v1.3 / 39 Entity Process EMVCo 3DS TG
  • Informs the TPP if it may proceed with the recognition renewal Note: EMVCo reserves the right, at its own discretion and without providing a detailed explanation, to deny a TPP the right to proceed through the recognition renewal process.
  • Identifies the audit requirements, which may be a subset of [TP REQ] section 3, and informs the TPP Test Platform Provider
  • Selects an auditor from the list of EMVCo Qualified Auditors and makes financial and legal arrangements with the auditor for the TPP to be audited
  • Provides to the EMVCo Qualified Auditor the information required to meet the audit requirements identified by EMVCo
  • Demonstrates how the Test Platform is operated (as described in section 2.4.2.3) if requested by EMVCo EMVCo Qualified Auditor
  • Performs audit in accordance with 3DS requirements (or subset of 3DS requirements) described in section 2.4.2.:
  • Ensures TPP meets all requirements identified by EMVCo in [TP REQ]
  • Provides audit findings to the TPP
  • If a corrective action plan (as described in section 2.4.2.4) is NOT necessary: Provides audit report to EMVCo Test Platform Provider If a corrective action plan (as described in section 2.4.2.4) is necessary:
  • Defines the action plan with deliverables and due dates to meet all EMV requirements
  • Provides action plan to EMVCo Qualified Auditor EMVCo Qualified Auditor If a corrective action plan is necessary:
  • Reviews and validates the action plan defined by the TPP
  • Provides a copy of the validated TPP action plan in its audit report to EMVCo EMV® 3-D Secure Approval Test Platform Provider Recognition and Test Platform Qualification Process v1.3 / 39 Entity Process EMVCo 3DS TG Reviews audit report (and action plan, if any) and determines whether the TPP’s recognition may be renewed or whether follow-up action is required Note: EMVCo reserves the right to deny recognition at its own discretion and without detailed explanation.
  • If audit report is acceptable to EMVCo, sends a new Letter of Recognition to the TPP with the recognition period following conditions defined in Table 2.3, starting from the expiration of the currently valid recognition.
  • If audit report is acceptable but TPP action items are pending,
  • May renew recognition on a provisional basis, as follows:
  • Sends the TPP a provisional Letter of Recognition with conditions The letter will include the requirements for an Interim Proficiency Audit (as described in section 3.2.2) and a date by which it must be completed. Recognition duration follows conditions defined in Table 2.3, starting from the expiration of the currently valid recognition. EMVCo Qualified Auditor If TPP’s action items are pending when the new Letter of Recognition is granted, organises remote check points with the TPP to fo

Shown in part. Read the original for the full text.