What an EMVCo Letter of Approval Means for a 3DS Product
Vendors of 3DS Servers, Access Control Servers (ACS) and 3DS SDKs routinely describe their products as ‘EMVCo certified’. The phrase sounds like a single fact. In practice, EMVCo approval is granted to a specific product version, against a specific specification version and test suite, with a stated set of supported options, and for a limited time. Those details decide whether the approval means what a buyer assumes it means.
What EMVCo approval is
EMVCo tests 3DS products for conformance with the EMV 3DS Protocol and Core Functions Specification. When a product passes, EMVCo issues a Letter of Approval (LoA) stating that the product sufficiently conforms to the specification, and lists it among approved 3DS products on its website. The process is governed by EMVCo’s 3DS Approval Administrative Process, which EMVCo lists among its published documents (EMVCo newsletter).
Approval is about protocol conformance. It shows that the product sends and handles EMV 3DS messages as the specification requires. It does not by itself show that the product is connected to a particular card scheme, that its operating environment is secure, or that it will perform well under load.
How to read a Letter of Approval
EMVCo’s published letters follow a consistent format. The fields worth checking are:
| Field | What it tells you | What to check |
|---|---|---|
| Product type, name and version | Which component and which release was tested | That the version matches the release you will run |
| EMV 3DS specification version | The protocol version the product conforms to, such as 2.2.0 or 2.3.1.x | That it covers the versions your counterparties use (EMV 3DS version management) |
| SDK device information versions | Which versions of device information the product was tested with | That recent versions are included if you rely on app-based flows |
| Test plan or test suite version | The exact test material used | Later letters name a test suite version; compare like with like |
| Supported options and tested extensions | Optional features and message extensions covered by the approval | That the features you need were actually tested |
| Approval and expiration dates | When approval was granted and when it lapses | That approval will not expire during your project |
Each letter states that it is valid while the approval number is posted on the EMVCo website, so the published list is the reference point rather than a PDF in a sales pack. Letters reviewed for this article show expiration dates roughly two years after approval, and some note an extension of six months under the rules of the Approval Administrative Process.
How approval differs from scheme testing, PCI 3DS and pre-compliance testing
| Activity | Who runs it | What it establishes |
|---|---|---|
| EMVCo approval | EMVCo | The product conforms to the EMV 3DS specification for the stated versions and options |
| Card scheme testing | Each card scheme | A specific implementation works with that scheme’s Directory Server and programme rules |
| PCI 3DS assessment | A PCI 3DS assessor, under PCI Security Standards Council standards | The environment running the component meets PCI 3DS security requirements |
| Pre-compliance and integration testing | The implementer, often in a dedicated test environment | The implementation behaves correctly, including in error cases, before formal testing |
An EMVCo-approved product still needs scheme testing for each scheme it will connect to, and the organisation running it still needs to meet PCI 3DS. A test environment such as GPayments’ TestLabs supports the last row; it does not approve or certify anything. How to build 3DS negative testing into your test plan covers that preparation.
What buyers should ask
- Which approval numbers cover the product version we will deploy, and are they listed on the EMVCo website today?
- Which specification versions, device information versions and options does each approval cover?
- When do those approvals expire, and what is the plan for renewal?
- Which card schemes has the implementation completed testing with?
- Who holds the PCI 3DS attestation for the environment that will run it?
Frequently asked questions
Does EMVCo approval mean a 3DS Server works with every card scheme?
No. Approval shows conformance to the EMV 3DS specification. Each card scheme runs its own testing before an implementation can connect to its Directory Server.
How long does EMVCo approval last?
Each Letter of Approval carries an expiration date, and remains valid only while the approval number is listed on the EMVCo website. Letters we reviewed show validity of roughly two years, with some extended by six months under EMVCo’s administrative rules.
Is the approval for the product or for my deployment?
For the product version tested. Your deployment still needs scheme testing and a secure environment that meets PCI 3DS.
Do 3DS SDKs need EMVCo approval as well?
Yes. EMVCo approves SDK products separately, and the PCI Security Standards Council publishes a separate PCI 3DS SDK Security Standard for SDK developers.
Can a test environment certify a 3DS implementation?
No. Test environments support preparation and regression testing. Approval comes from EMVCo, scheme acceptance from each scheme, and PCI 3DS attestation from a qualified assessor.
Preparing for approval and scheme testing
GPayments’ TestLabs is a 3DS testing environment. To discuss how to prepare an implementation before formal approval and scheme testing, contact GPayments to discuss your testing requirements.
