PCI Watch

Tracking changes across the Payment Card Industry

SB nº AN-39 : CPA Transaction Logging Controls in Application Control (Clarification)

v1.0 Specification Bulletins

Application Note Bulletin No. 39 First Edition February 2008 CPA Transaction Logging Controls in Application Control This Application Note Bulletin clarifies the EMV Common Payment Application (CPA) Specification to indicate that issuers should not modify the transaction logging controls in the Application Control data element after issuance of the card.

Applicability

This Application Note Bulletin applies to:

  • EMV Common Payment Application Specification Version 1.0 December 2005

Related Documents

  • Specification Update bulletin 56 – CPA Corrections and Changes

Description

This Application Note Bulletin clarifies the EMV Common Payment Application Specification to state that issuers should not modify post-issuance the setting of the bits in Application Control that indicate whether to log internal CPA application data as part of Transaction Logging. The format of the Transaction Log is personalised in Log Format, and cannot be modified by postissuance commands (not supported by CPA). The personalisation of Log Format must be consistent with the setting of the following bits in the Application Control data element for CPA:

  • Log the ATC
  • Log the CID
  • Log the CVR
  • Log the Profile ID If an update to the Application Control data element changes the setting of any of the bits listed above from the values set during personalisation to correspond with the Log Format, then transaction information logged in the transaction log could be misinterpreted. Specification Clarification Notice Please make the following clarification to EMV Common Payment Application Version 1.0. Add the following note in Annex L, page L-18, in the Meaning column of Table L-10: Application Control, Byte 3 for the bits ‘Log the ATC’, ‘Log the CID’, ‘Log the CVR’, and ‘Log the Profile ID’: “Because updates to Log Format are not supported by CPA, issuers should not change the setting of this bit post-issuance. Otherwise the contents of the transaction log may be misinterpreted because the setting in Application Control is not consistent with the contents personalised in Log Format.”