Skip to content

EMVCo

EMVCo is an international technical consortium that develops global standards for the interoperability and security of card payments. These standards form the basis for secure card payments at the point-of-sale and online. They are used by card schemes such as Mastercard, Visa, and American Express. The Dutch Payments Association is also affiliated with EMVCo, where it represents the interests of its Dutch members.

EMVCo stood for Eurocard Mastercard Visa Consortium. Eurocard no longer exists and many other card schemes have joined EMVCo, such as American Express, Discover, JCB, and UnionPay.

What does EMVCo do?

EMVCo develops, manages, and maintains technical standards for both physical and online card payments. This is done in close collaboration with card and terminal manufacturers and with international card schemes.

Important activities include:

  • Drawing up and updating global EMV specifications for payment cards and payment terminals.
  • Maintaining certification programs for suppliers of cards, terminals, and e-commerce solutions.
  • Accrediting specialized testing organizations that test products against EMV standards.
  • Conducting market consultations prior to new versions of standards.
  • Organizing a Board of Advisors, in which market parties provide feedback on developments and vote on recommendations. The Dutch Payments Association sits on this Board as a Business Associate.
  • An annual community meeting in which stakeholders meet and exchange information.

EMVCo itself does not enforce the implementation of standards; that is the responsibility of the affiliated card schemes.

Key EMV standards

Contact card payments
The original EMV specifications were developed for payment chips in payment cards to combat the sharp increase in skimming of magnetic strips on payment cards. They describe exactly how a payment chip and a payment terminal communicate with each other and how the terminal checks the authenticity of the payment chip.

Contactless chip card payments
EMVCo also maintains the EMVc specifications for contactless data exchange between a payment card with a payment chip and a payment terminal, based on ISO 14443. This allows the card and terminal to communicate wirelessly at a distance of up to a few centimeters. In addition, each card scheme has its own contactless core specifications. EMVCo published generic contactless core specifications (C-8) in 2023, but their adoption remains limited.

EMV 3-D Secure (EMV3DS)
This authentication protocol is used for e-commerce card payments. It supports both frictionless flows (where the cardholder does not have to do anything) and step-ups where authentication is mandatory via 2FA (two-factor authentication). This protocol fully complies with the rules for Strong Customer Authentication (SCA) from the European PSD2 directive for payment services. A recent development is the support of the EU Digital Identity Wallet (EUDIW) for online card payments.

Secure Remote Commerce (SRC)
SRC enables a uniform, secure, and simple online checkout, for example for easy, fast, and secure ordering and payment in web shops. It prevents consumers from having to manually enter address and card details.

Consumers use a digital profile in which cards and address details are stored securely. Payments are secured by dynamic cryptography. Click-to-Pay is an online ecosystem of card schemes based on SRC.

Tokenisation Framework
Tokens replace card numbers (PANs) with unique surrogate numbers that are only valid in a specific context, for example, only on one device or only at one online store. This makes intercepting a token pointless.

In this framework, EMVCo describes the roles and processes of, among others, Token Requestors (such as Apple Pay and Click-to-Pay) and Token Service Providers (such as MDES and VTS). Card issuers (banks) also play a role in approving each token request for a specific payment card.

Innovation and new use cases

EMVCo is constantly further developing the EMV standards, while also keeping an eye on new applications and technological developments that may impact card payments.

Paying for Electric Vehicle Charging

An example of a new application is Electronic Vehicle Charging (EV charging). By combining Secure Remote Commerce with the ISO 15118 Plug and Charge standard, consumers can charge their cars anywhere (open loop) without having to register in advance with EV operators. The car automatically identifies the linked payment card, and the payment is processed via e-commerce channels, eliminating the need for charging stations to include additional hardware for physical card payments.

Quantum Computing

EMVCo is also closely monitoring developments related to quantum computing. In the longer term—expected to be after 2040—quantum computers could pose a threat to asymmetric cryptography (public key algorithms). This could, for example, allow counterfeit EMV cards to be used in offline situations, such as on public transportation.

However, the vast majority of EMV transactions take place online and use symmetric cryptography. Algorithms such as AES-128 are much less vulnerable to attacks by quantum computers. EMVCo is currently working on measures to mitigate the risks of quantum computing to asymmetric algorithms.

Significance of EMVCo for cardholders and merchants

Cardholders and merchants do not need to know anything about EMV specifications, but they do experience the benefits every day:

  • tap-to-pay works the same everywhere thanks to EMV standards;
  • easy and secure online payments via Click-to-Pay and EMV3DS;
  • tokenized payments in apps and wallets such as Apple Pay and Google Pay.

The complexity remains under the hood, with the standards ensuring security, interoperability, and global acceptance.interoperabiliteit en wereldwijde acceptatie.

Recognizable symbols

Contactless symbol on payment terminals
Click-to-Pay symbol in online stores

Perspective

EMVCo remains the vehicle for global standards in card payments. As long as card payments remain important in payments, EMVCo will continue to play an essential role. The Dutch Payments Association actively participates in EMVCo and follows the standards that are relevant to the Dutch market.