EMVCo

EMVCo is an international technical consortium that develops global standards for the interoperability and security of card payments. These standards form the basis for secure card payments at the point-of-sale and online. They are used by card schemes such as Mastercard, Visa, and American Express. The Dutch Payments Association is also affiliated with EMVCo, where it represents the interests of its Dutch members.

EMVCo stood for Eurocard Mastercard Visa Consortium. Eurocard no longer exists and many other card schemes have joined EMVCo, such as American Express, Discover, JCB, and UnionPay.

What does EMVCo do?

EMVCo develops, manages, and maintains technical standards for both physical and online card payments. This is done in close collaboration with card and terminal manufacturers and with international card schemes.

Important activities include:

Drawing up and updating global EMV specifications for payment cards and payment terminals.
Maintaining certification programs for suppliers of cards, terminals, and e-commerce solutions.
Accrediting specialized testing organizations that test products against EMV standards.
Conducting market consultations prior to new versions of standards.
Organizing a Board of Advisors, in which market parties provide feedback on developments and vote on recommendations. The Dutch Payments Association sits on this Board as a Business Associate.
An annual community meeting in which stakeholders meet and exchange information.

EMVCo itself does not enforce the implementation of standards; that is the responsibility of the affiliated card schemes.

Key EMV standards

Contact card payments
The original EMV specifications were developed for payment chips in payment cards to combat the sharp increase in skimming of magnetic strips on payment cards. They describe exactly how a payment chip and a payment terminal communicate with each other and how the terminal checks the authenticity of the payment chip.

Contactless chip card payments
EMVCo also maintains the EMVc specifications for contactless data exchange between a payment card with a payment chip and a payment terminal, based on ISO 14443. This allows the card and terminal to communicate wirelessly at a distance of up to a few centimeters. Until now, each card scheme has used its own contactless specifications. EMVCo published its own royalty-free specifications (C-8) for this in 2023, but actual use of these is still rare.

EMV 3-D Secure (EMV3DS)
This authentication protocol is used for e-commerce card payments. It supports both frictionless flows (where the cardholder does not have to do anything) and step-ups where authentication is mandatory via 2FA (two-factor authentication). This protocol fully complies with the rules for Strong Customer Authentication (SCA) from the European PSD2 directive for payment services. A recent development is the support of the EU Digital Identity Wallet (EUDIW) for online card payments.

Secure Remote Commerce (SRC)
SRC enables a uniform, secure, and simple online checkout, for example for easy, fast, and secure ordering and payment in web shops. It prevents consumers from having to manually enter address and card details.

Consumers use a digital profile in which cards and address details are stored securely. Payments are secured by dynamic cryptography. Click-to-Pay is an online ecosystem of card schemes based on SRC.

Tokenisation Framework
Tokens replace card numbers (PANs) with unique surrogate numbers that are only valid in a specific context, for example, only on one device or only at one online store. This makes intercepting a token pointless.

In this framework, EMVCo describes the roles and processes of, among others, Token Requestors (such as Apple Pay and Click-to-Pay) and Token Service Providers (such as MDES and VTS). Card issuers (banks) also play a role in approving each token request for a specific payment card.

Innovation and new use cases

EMVCo not only looks at existing standards, but also investigates new applications. An important example is Electronic Vehicle Charging (EV charging).

By combining Secure Remote Commerce with the ISO 15118 Plug and Charge standard, consumers can charge their cars anywhere without separate registrations. The car automatically identifies the linked payment card, and payment is processed via e-commerce rails, without the need for charging stations to contain additional hardware.

Significance of EMVCo for cardholders and merchants

Cardholders and merchants do not need to know anything about EMV specifications, but they do experience the benefits every day:

tap-to-pay works the same everywhere thanks to EMV standards;
easy and secure online payments via Click-to-Pay and EMV3DS;
tokenized payments in apps and wallets such as Apple Pay and Google Pay.

The complexity remains under the hood, with the standards ensuring security, interoperability, and global acceptance.interoperabiliteit en wereldwijde acceptatie.

Recognizable symbols

Perspective

EMVCo remains the vehicle for global standards in card payments. As long as card payments remain important in payments, EMVCo will continue to play an essential role. The Dutch Payments Association actively participates in EMVCo and follows the standards that are relevant to the Dutch market.