EMV Contactless Specifications for Payments Systems

1 EMV Contactless Book C-7 Kernel 7 Spec February 2016 Page i 2011-2016 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the EMVCo Terms of Use agreement found at , as supplemented by the Legal Notice on Page ii of this document, or such other separate agreement that the user may have with EMVCo or the applicable payment system. EMV is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. EMV Contactless Specifications for Payment Systems Book C-7 Kernel 7 specification Version February 2016 EMV Contactless Book C-7 Kernel 7 Spec Page ii February 2016 2011-2016 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the EMVCo Terms of Use agreement found at , as supplemented by the Legal Notice on Page ii of this document, or such other separate agreement that the user may have with EMVCo or the applicable payment system.

2 EMV is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. Legal Notice Unless the user has an applicable separate agreement with EMVCo or with the applicable payment system, any and all uses of these Specifications is subject to the terms and conditions of the EMVCo Terms of Use agreement available at and the following supplemental terms and conditions. Except as otherwise may be expressly provided in a separate agreement with EMVCo, the license granted in the EMVCo Terms of Use specifically excludes (a) the right to disclose, distribute or publicly display these Specifications or otherwise make these Specifications available to any third party, and (b) the right to make, use, sell, offer for sale, or import any software or hardware that practices, in whole or in part, these Specifications .

3 Further, EMVCo does not grant any right to use the Kernel Specifications to develop Contactless payment applications designed for use on a Card (or components of such applications). As used in these supplemental terms and conditions, the term Card means a proximity integrated circuit card or other device containing an integrated circuit chip designed to facilitate Contactless payment transactions. Additionally, a Card may include a contact interface and/or magnetic stripe used to facilitate payment transactions. To use the Specifications to develop Contactless payment applications designed for use on a Card (or components of such applications), please contact the applicable payment system. To use the Specifications to develop or manufacture products, or in any other manner not provided in the EMVCo Terms of Use, please contact EMVCo.

4 These Specifications are provided "AS IS" without warranties of any kind, and EMVCo neither assumes nor accepts any liability for any errors or omissions contained in these Specifications . EMVCO DISCLAIMS ALL REPRESENTATIONS AND WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT, AS TO THESE Specifications . EMVCo makes no representations or warranties with respect to intellectual property rights of any third parties in or in relation to the Specifications . EMVCo undertakes no responsibility to determine whether any implementation of these Specifications may violate, infringe, or otherwise exercise the patent, copyright, trademark, trade secret, know-how, or other intellectual property rights of third parties, and thus any person who implements any part of these Specifications should consult an intellectual property attorney before any such implementation.

5 Without limiting the foregoing, the Specifications may provide for the use of public key encryption and other technology, which may be the subject matter of patents in several countries. Any party seeking to implement these Specifications is solely responsible for determining whether its activities require a license to any such technology, including for patents on public key encryption technology. EMVCo shall not be liable under any theory for any party's infringement of any intellectual property rights in connection with these Specifications . EMV Contactless Book C-7 Kernel 7 Spec February 2016 Page iii 2011-2016 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the EMVCo Terms of Use agreement found at , as supplemented by the Legal Notice on Page ii of this document, or such other separate agreement that the user may have with EMVCo or the applicable payment system.

6 EMV is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. Contents 1 General .. 7 Scope .. 7 Audience .. 7 Volumes of the Contactless Specifications .. 7 Reference Materials .. 8 Overview .. 8 2 POS System .. 10 3 Processing Overview .. 12 General 12 Overview of Transaction Processing .. 13 Kernel Activation .. 13 Application Initialization .. 13 Read Application Data .. 15 Offline Data Authentication .. 16 Online 16 Transaction Completion .. 17 General Transaction Flow .. 18 4 Transaction Processing .. 20 Application Initialization .. 20 Input .. 20 Commands .. 21 Flow Chart .. 22 Kernel 23 Read Application Data .. 30 Input .. 30 Commands .. 31 Flow Chart .. 32 Kernel 33 Offline Data Authentication .. 37 Input.

7 37 Kernel 39 Cardholder Verification .. 43 General Requirements .. 43 CVM Processing .. 43 Outcome .. 45 Approved .. 45 Online Request .. 46 EMV Contactless Book C-7 Kernel 7 Spec Page iv February 2016 2011-2016 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the EMVCo Terms of Use agreement found at , as supplemented by the Legal Notice on Page ii of this document, or such other separate agreement that the user may have with EMVCo or the applicable payment system. EMV is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. Try again (1) .. 48 Declined .. 49 Try Another Interface .. 50 Select Next .. 51 End Application .. 52 Try again (2) .. 53 EMV Contactless Book C-7 Kernel 7 Spec February 2016 Page v 2011-2016 EMVCo, LLC.

8 All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the EMVCo Terms of Use agreement found at , as supplemented by the Legal Notice on Page ii of this document, or such other separate agreement that the user may have with EMVCo or the applicable payment system. EMV is a registered trademark or trademark of EMVCo, LLC in the United States and other countries. Figures Figure 2-1 Logical Architecture .. 11 Figure 3-1 Sample of EMV Mode Transaction Flow .. 19 Figure 4-1 GPO Processing .. 23 Figure 4-2 Read Application Data .. 32 Figure B-1 Sample of Data Exchange Related to fDDA .. 61 Tables Table 3-1 Terminal Transaction Qualifiers .. 14 Table 4-1 Response of SELECT AID .. 20 Table 4-2 GPO Command Message .. 21 Table 4-3 GPO Response Data if The Card s Transaction Disposition is an ARQC or 27 Table 4-4 GPO Response Data if The Card s Transaction Disposition is a TC.

9 29 Table 4-5 Card Data used in Read Application Data .. 31 Table 4-6 Offline Data Authentication--Terminal Data .. 37 Table 4-7 Offline Data Authentication--Card Data .. 37 Table 4-8 Dynamic Kernel Data to be Hashed .. 40 Table 4-9 IC Card Dynamic Data to be Hashed .. 41 Table A-1 Data Dictionary .. 56 Table C-1 Clearing Data Element .. 62 EMV Contactless Book C-7 Kernel 7 Spec Page vi February 2016 2011-2016 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the EMVCo Terms of Use agreement found at , as supplemented by the Legal Notice on Page ii of this document, or such other separate agreement that the user may have with EMVCo or the applicable payment system. EMV is a registered trademark or trademark of EMVCo, LLC in the United States and other countries.

10 Requirements Requirement Online Authorization .. 17 Requirement PDOL 23 Requirement TTQ Resetting .. 23 Requirement Processing of Status Code .. 23 Requirement Transaction Disposition .. 25 Requirement Mandatory-Data Check .. 26 Requirement L1 Errors in Reading Application Data .. 33 Requirement Processing of READ RECORD Response .. 33 Requirement Exception File .. 35 Requirement Other Exception Handlings .. 35 Requirement fDDA Version Check .. 39 Requirement fDDA Data Check .. 40 Requirement fDDA Verification .. 41 Requirement fDDA Failed or Not Performed .. 42 Requirement CVM Check .. 43 Requirement CVM Check .. 44 Requirement APPROVED Outcome .. 45 Requirement ONLINE REQUEST Outcome .. 47 Requirement TRY AGAIN Outcome .. 49 Requirement DECLINED Outcome .. 50 Requirement TRY ANOTHER INTERFACE Outcome.