ContactlessSpecifications for Payment Systems

1 2011-2016 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the EMVCo Terms of Use agreement found at , as supplemented by the Legal Notice on Page ii of this document, or such other separate agreement that the user may have with EMVCo or the applicable Payment system. EMV is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV ContactlessSpecifications for Payment Systems Book C-4 Kernel 4 Specification Version February 2016 EMV ContactlessBook C-4 Kernel 4 February 2016 Page ii 2011-2016 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the EMVCo Terms of Use agreement found at , as supplemented by the Legal Notice on Page ii of this document, or such other separate agreement that the user may have with EMVCo or the applicable Payment system. EMV is a registered trademark or trademark of EMVCo, LLC in the United States and other countries.

2 Legal Notice Unless the user has an applicable separate agreement with EMVCo or with the applicable Payment system, any and all uses of these Specifications is subject to the terms and conditions of the EMVCo Terms of Use agreement available at and the following supplemental terms and conditions. Except as otherwise may be expressly provided in a separate agreement with EMVCo, the license granted in the EMVCo Terms of Use specifically excludes (a) the right to disclose, distribute or publicly display these Specifications or otherwise make these Specifications available to any third party, and (b) the right to make, use, sell, offer for sale, or import any software or hardware that practices, in whole or in part, these Specifications. Further, EMVCo does not grant any right to use the Kernel Specifications to develop contactless Payment applications designed for use on a Card (or components of such applications). As used in these supplemental terms and conditions, the term Card means a proximity integrated circuit card or other device containing an integrated circuit chip designed to facilitate contactless Payment transactions.

3 Additionally, a Card may include a contact interface and/or magnetic stripe used to facilitate Payment transactions. To use the Specifications to develop contactless Payment applications designed for use on a Card (or components of such applications), please contact the applicable Payment system. To use the Specifications to develop or manufacture products, or in any other manner not provided in the EMVCo Terms of Use, please contact EMVCo. These Specifications are provided "AS IS" without warranties of any kind, and EMVCo neither assumes nor accepts any liability for any errors or omissions contained in these Specifications. EMVCO DISCLAIMS ALL REPRESENTATIONS AND WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT, AS TO THESE SPECIFICATIONS. EMVCo makes no representations or warranties with respect to intellectual property rights of any third parties in or in relation to the Specifications.

4 EMVCo undertakes no responsibility to determine whether any implementation of these Specifications may violate, infringe, or otherwise exercise the patent, copyright, trademark, trade secret, know-how, or other intellectual property rights of third parties, and thus any person who implements any part of these Specifications should consult an intellectual property attorney before any such implementation. Without limiting the foregoing, the Specifications may provide for the use of public key encryption and other technology, which may be the subject matter of patents in several countries. Any party seeking to implement these Specifications is solely responsible for determining whether its activities require a license to any such technology, including for patents on public key encryption technology. EMVCo shall not be liable under any theory for any party's infringement of any intellectual property rights in connection with these Specifications. EMV ContactlessBook C-4 Revision Log Version Kernel 4 February 2016 Page iii 2011-2016 EMVCo, LLC.

5 All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the EMVCo Terms of Use agreement found at , as supplemented by the Legal Notice on Page ii of this document, or such other separate agreement that the user may have with EMVCo or the applicable Payment system. EMV is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. Revision Log Version The following changes have been made to this document since the publication of Version Some of the numbering and cross references in this version have been updated to reflect changes introduced by the published bulletins. The numbering of existing requirements did not change, unless explicitly stated otherwise. Incorporated changes described in the following Specification Updates: Specification Bulletin 176: EMV Book C-4, Version Other editorial changes: 1. Updated Section to clarify the transaction outcome in the case that a transaction mode cannot be determined by the reader.

6 2. Updated the condition check for Contactless Transaction Limit to greater than or equal to in Section 3. Included checks to ensure that both the reader and the card support a contact interface when determining support for an alternative interface in Section and Section 4. Updated Table 12-4 with correct values for parameter settings Start and Online Response Data . 5. Included a note for Table 4-4 : Enhanced Contactless Reader Capabilities EMV Tag '9F6E' to clarify the purpose of Tag 9F6E Byte 1 bit 6 (Contactless EMV Full Online not supported). 6. Updated UI Request on Outcome Present parameter setting for Try Another Interface to display message with identifier: '1D' ( Please insert card ). EMV ContactlessBook C-4 Kernel 4 February 2016 Page iv 2011-2016 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the EMVCo Terms of Use agreement found at , as supplemented by the Legal Notice on Page ii of this document, or such other separate agreement that the user may have with EMVCo or the applicable Payment system.

7 EMV is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. Contents 1 Introduction .. 1 Scope .. 1 Audience .. 1 Volumes of Contactless Specifications .. 1 Reference Material .. 2 Notational Conventions .. 3 Use of Terms .. 3 Reserved for Future Use (RFU) .. 3 Overview .. 4 2 Contactless Modes and Transaction Flows .. 5 Contactless Modes of Operation .. 5 Support for Contactless Modes of Operation .. 5 Card Risk Management Data Object List (CDOL) Switch .. 7 Contactless Mag-Stripe Mode Transaction .. 7 Contactless EMV Mode Transactions .. 8 Contactless Mobile Transaction .. 8 Contactless Transaction Processing .. 8 Premature card removal .. 9 Offline Transaction .. 11 Partial Online Transaction .. 11 Delayed Authorisation .. 13 Contactless Transaction Configurations .. 14 3 Processing Overview .. 19 4 Initiate Application Processing .. 20 Overview .. 20 Commands .. 20 Processing Requirements.

8 21 Pre-PDOL Processing .. 21 PDOL Processing .. 22 Terminal Type Modified .. 23 Enhanced Contactless Reader Capabilities .. 26 Terminal Type .. 28 GPO Response Check .. 29 Determination of Operating Mode .. 29 Determination of Transaction Support for Contactless Mobile .. 30 EMV ContactlessBook C-4 Kernel 4 February 2016 Page v 2011-2016 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the EMVCo Terms of Use agreement found at , as supplemented by the Legal Notice on Page ii of this document, or such other separate agreement that the user may have with EMVCo or the applicable Payment system. EMV is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. 5 Read Application Data .. 31 Overview .. 31 Commands .. 31 Processing Requirements .. 31 GET DATA .. 35 6 Offline Data Authentication .. 36 Overview .. 36 Processing Requirements.

9 36 Offline Data Authentication not performed .. 36 Single ODA Method Supported .. 37 Multiple ODA Methods Supported .. 38 Scheme Certification Authority Public Keys .. 38 Static Data Authentication .. 38 Combined Dynamic Data Authentication / AC Generation .. 39 7 Processing Restrictions .. 40 Overview .. 40 Processing Requirements .. 40 Apply Dynamic Transaction Limits .. 41 EMV Processing Restrictions .. 48 Supplementary Processing Restrictions .. 52 Data Elements for Mag-Stripe Mode .. 54 8 Cardholder Verification .. 55 Overview .. 55 Processing Requirements .. 55 Process Control .. 55 CVM Processing .. 57 CVM List Processing .. 59 Contactless Mobile CVM Processing .. 61 Cardholder Verification Unable To Complete over Contactless Interface .. 68 Reader CVM Required Limit Exceeded Indicator Not Set .. 73 9 Terminal Risk Management .. 85 Overview .. 85 Processing Requirements .. 86 Floor Limit Checking .. 86 Random Transaction Selection.

10 86 EMV ContactlessBook C-4 Kernel 4 February 2016 Page vi 2011-2016 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the EMVCo Terms of Use agreement found at , as supplemented by the Legal Notice on Page ii of this document, or such other separate agreement that the user may have with EMVCo or the applicable Payment system. EMV is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. Velocity Checking .. 86 Exception File Checking .. 87 10 1st Terminal Action Analysis .. 88 Overview .. 88 Processing Requirements .. 89 Offline Processing Results .. 89 Zero Amount Allowed and Status Check Requested Validation .. 97 Additional Processing for Contactless Mag-Stripe Mode .. 99 Request AC in First GENERATE AC .. 101 11 1st Card Action Analysis .. 102 Overview .. 102 Processing Requirements .. 103 Format of the Response to GENERATE AC Command.