EMVCo — Payment Product Security Evaluation

EMVCo is the technical body co-owned by American Express, Discover, JCB, Mastercard, UnionPay, and Visa. It publishes the EMV specifications and operates security evaluation programmes for payment hardware and software components used in card and mobile payments.

Key facts

  • Authorizing body: EMVCo, co-owned by the six global payment networks
  • Country / region: Global
  • Year established: EMVCo was founded in 1999 to manage the EMV chip card specifications; security evaluation programmes have evolved over time
  • Product types: contact and contactless payment terminals, payment ICs, payment software (including Software-Based Mobile Payments, SBMP, and Software POI)
  • CCRA status: EMVCo is not a CCRA scheme; many evaluated products also carry Common Criteria certificates from national schemes
  • Canonical portal: https://www.emvco.com/processes-forms/product-approval/

Overview

EMVCo operates multiple security evaluation programmes, including Terminal Security Evaluations (TSE) for PIN entry devices and payment terminals, IC security evaluations, and software evaluation frameworks such as SBMP and Software POI. While EMVCo’s methodology is distinct from Common Criteria, evaluations often complement national CC certifications for the same hardware — particularly for payment ICs, which are frequently evaluated under both BSI CC (at high EAL+VAN.5) and EMVCo’s IC security programme.

How evaluations work under this scheme

Accredited laboratories perform evaluations against EMVCo security guidelines and attack potential tables. EMVCo reviews the results and issues letters of approval, which are listed on the EMVCo public approval search. Approvals have validity periods and are subject to re-evaluation when underlying components change.

Notable product categories

  • Point-of-interaction devices (PED, PIN-on-Glass, contactless payment terminals)
  • Payment ICs used in EMV chip cards and mobile secure elements
  • Software-based mobile payment applications
  • HCE and cloud-based payment components

Relationship to CC baseline

EMVCo security evaluations use a methodology inspired by but distinct from the CEM. Attack potential ratings and evaluation work share conceptual roots with Common Criteria, particularly for smart card ICs. Many EMVCo-approved payment ICs also hold Common Criteria certificates under BSI, ANSSI, or other schemes; NenkinTracker treats EMVCo approvals as a distinct record linked to the underlying product.

Where to find official records

See also: MIFARE, BSI, Glossary.