EMVCo Type Approval. Terminal ESD Evaluation Administrative Process. Version 2.3. July 2014

Transcription

1 EMVCo Type Approval Terminal ESD Evaluation Administrative Process Version 2.3 July 2014 Page 1

2

3 Legal Notice This document summarizes EMVCo s present plans for type approval testing services and policies and is subject to change by EMVCo at any time without notice to any party. Neither this document nor any other document or communication creates any binding obligations upon EMVCo or any test laboratory, vendor or other third party regarding testing services or EMVCo approval, which obligations will exist, if at all, pursuant to separate written agreements executed by EMVCo and such test laboratories, vendors or other third parties. In the absence of a written binding agreement pursuant to which EMVCo has agreed to perform testing services for a vendor or to permit a third party to act as a test laboratory, no vendor, test laboratory or any other third party should detrimentally rely on this document, and EMVCo shall not be liable for any such reliance. No vendor, test laboratory or other third party may refer to a product, service or facility as EMVCo approved, in form or in substance, nor otherwise state or imply that EMVCo (or any agent of EMVCo) has in whole or part approved a vendor, test laboratory or other third party or its products, services, or facilities, except to the extent and subject to the terms, conditions and restrictions expressly set forth in a written agreement with EMVCo, or in an approval letter issued by EMVCo. All other references to EMVCo approval are strictly and actively prohibited by EMVCo. Under no circumstances should EMVCo type approval, when granted, be construed to imply any endorsement or warranty regarding the functionality, quality, or performance of any particular product or service, and no party shall state or imply anything to the contrary. EMVCo specifically disclaims any and all representations and warranties with respect to products that have received approval and to the type approval process generally, including, without limitation, any implied warranties of merchantability, fitness for purpose or noninfringement. All rights and remedies relating to products and services that have received EMVCo type approval are provided solely by the parties selling or otherwise providing such products or services, and not by EMVCo, and EMVCo accepts no liability whatsoever in connection with such products and services. Any and all uses of this document is subject to the terms and conditions of the EMVCo Terms of Use agreement available at This document is provided "AS IS" without warranties of any kind, and EMVCo neither assumes nor accepts any liability for any errors or omissions contained in this document. EMVCO DISCLAIMS ALL REPRESENTATIONS AND WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT, AS TO THIS DOCUMENT. EMVCo makes no representations or warranties with respect to intellectual property rights of any third parties in or in relation to this document. EMVCo undertakes no responsibility to determine whether any implementation of this document may violate, infringe, or otherwise exercise the patent, copyright, trademark, trade secret, know-how, or other intellectual property rights of third parties, and thus any person who implements any part of this document should consult an intellectual property attorney before any such implementation. Without limiting the foregoing, this document may provide for the use of public key encryption and other technology, which may be the subject matter of patents in several countries. Any party seeking to implement this document is solely responsible for Page 3

4 determining whether its activities require a license to any such technology, including for patents on public key encryption technology. EMVCo shall not be liable under any theory for any party's infringement of any intellectual property rights in connection with this document. Page 4

5 Revision History First Version Section Reason for change Page 5

6 1 SCOPE NORMATIVE REFERENCES GLOSSARY OF TERMS ABBREVIATIONS AND NOTATIONS DEFINITIONS ESD EVALUATION OVERVIEW SCOPE OF ESD EVALUATION ESD EVALUATION DOCUMENTATION PRODUCT ESD EVALUATION FEE STRUCTURE ROLES & RESPONSIBILITIES EMVCO EMVCO CATA SECRETARIAT LABORATORY PRODUCT PROVIDER ESD EVALUATION PROCEDURES REGISTRATION CONTRACT WITH EMVCO REQUEST FOR EVALUATION Product Provider and Laboratory Operations Product Provider Preparation for Evaluation Request Product Provider Request for Evaluation EMVCo Evaluation ESD EVALUATION RENEWAL PROCESS Basic Policy for renewal Laboratories for Renewal testing Samples submission ICS Submission TEST VERSION CHANGE TEST CHANGES TESTING APPLICABILITY PRODUCT CHANGES CHANGE IN CONTACT INFORMATION APPENDIX Page 6

7 1 SCOPE EMVCo, LLC ( EMVCo ) manages and maintains the EMV Integrated Circuit Card (ICC) Specifications for Payment Systems, hereinafter called the EMV Specifications. This document describes the administrative process used to have Terminals tested for evaluation with ESD resilience. The Terminal ESD Evaluation is for CHIP reader and Magnetic Stripe Reader located in an IFM and/or in Terminal. The document outlines the fundamental concepts upon which ESD Evaluation is based, provides a summary of participating entities and their respective roles, and the detailed procedures by which a Product Provider can obtain Terminal ESD Evaluation. The target audience of this document is: Product Providers, Laboratory (accredited to perform the type approval tests), Auditors (qualified to verify that laboratories comply with the EMVCo processes and procedures). Readers are reminded that evaluation, when granted by EMVCo, shall not be construed as a warranty or representation of any sort, nor may it be relied upon by any party as an assurance of quality or functionality of any product or service. Please note the details of the legal notice incorporated in the front of this document for important limitations on the scope of ESD Evaluation. Page 7

8 2 NORMATIVE REFERENCES [N1] EMV Integrated Circuit Card Specification for Payment Systems Book 1 Application Independent ICC to Terminal Interface Requirements [N2] EMV Integrated Circuit Card Application Specification for Payment Systems Book 2 Security and Key Management [N3] EMV Integrated Circuit Card Terminal Specification for Payment Systems Book 3 Application Specification [N4] EMV Integrated Circuit Card Terminal Specification for Payment Systems Book 4 Cardholder, Attendant, and Acquirer Interface Requirements [ICS] EMVCo Type Approval Terminal ESD Evaluation - Implementation Conformance Statement [TA EMVCo Type Approval Terminal ESD Evaluation ESD] [TA ACC] Test Plan EMVCo Type Approval Accreditation Requirements for EMVCo Terminal Type Approval Laboratories Version 4.3 November 2011 Version 4.3 November 2011 Version 4.3 November 2011 Version 4.3 November 2011 Version 2.3 July 2014 Version 2.3 July 2014 Version 0.9 November 2009 Page 8

9 3 GLOSSARY OF TERMS 3.1 ABBREVIATIONS AND NOTATIONS The following abbreviations and notations are used in this document: APDU CATA ESD ICS IFD IFM ISO Lab LoE TTA PRP Application protocol data unit Card and Terminal Type Approval Secretariat Electrical Static Discharge Implementation conformance statement Interface device Interface module International Organization for Standardization Laboratory Letter of Evaluation Terminal type approval Product Provider 3.2 DEFINITIONS The following terms are used in this document/relevant to the testing process: Accreditation: formal recognition by EMVCo that an auditor or testing laboratory is competent to carry out specific functions defined as defined by EMVCo type approval procedures. Card: a payment card as defined by a payment system. Compliance: see conformance. Conformance: meeting all the requirements including implemented optional requirements. Delta Testing: the difference between the test plan versions the Product was evaluated against versus the current version of the test plan when the Product is reaching its Renewal date. Page 9

10 EMVCo: a Limited Liability Company established to maintain the EMV specifications and administer type approval against those specifications. Implementation conformance statement (ICS): a form completed by the Product Provider listing all optional functions supported by the Product. Interface device (IFD): that part of a terminal into which the ICC is inserted, including such mechanical and electrical devices that may be considered part of it. Interface module (IFM): a virtual or abstract device that contains the necessary hardware and software to power the ICC and support communication between the terminal and the ICC up to the transport layer. The three main functional components are the mechanical, electrical and logical ICC interfaces. International Organization for Standardization (ISO): an international body that provides standards for financial transactions and telecommunication messages. ISO works in conjunction with the International Telecommunication Union (ITU) for standards that affect telecommunications. ISO supports specific technical committees and work groups to promulgate and maintain financial service industry standards. Laboratory: a facility that performs evaluation testing in compliance with EMVCo defined requirements and procedures. Letter of accreditation: written statement that confirms a testing laboratory is performing evaluation tests in conformance with the rules defined by EMVCo according to [TA ACC]. Letter of Evaluation: written statement that documents the decision of EMVCo that a specified Product has demonstrated a level of protection against ESD on the date of it being tested. Magnetic stripe: the stripe on the physical card containing magnetically encoded information. Procedure: specified way to perform a set of tasks. Product: refer to section 4.3, which defines the Product to be evaluated during the EMVCo ESD Evaluation process. Proficiency: ability of a testing laboratory to perform the specified tests in an exact and reproducible fashion and to provide an accurate test report. Registration number: a unique identification number assigned by EMVCo to an IFM or Product Provider. Renewal: extension given to the Letter of Evaluation at the end of its validity date after evaluation that the Product has demonstrated sufficient conformance at the time of the Renewal. Request for Evaluation: a form that accompanies the results from a tested EMV Product submitted to EMVCo for ESD Evaluation. Sample: a Terminal picked out of production for testing. Page 10

11 Terminal: the card acceptance device used in conjunction with the ICC at the point of transaction to perform a financial transaction. It incorporates the IFD and may also include other components and interfaces, such as host communications. It is the Product, which will be evaluated. Test: any activity that aims at verifying the conformance of a Product or process to a given requirement under a given set of conditions. Test case: a description of the actions required to achieve a specific test objective. Test Report: the report containing the results of testing performed on a Product by an EMVCo accredited test laboratory. ESD Evaluation: acknowledgment by EMVCo that the Product has demonstrated a sufficient level of ESD protection. ESD Evaluation documentation: full set of documents and procedures issued by EMVCo to enable the ESD Evaluation process. Section 4.2 provides the list of documents associated with terminal ESD Evaluation. Page 11

12 4 ESD EVALUATION OVERVIEW 4.1 SCOPE OF ESD EVALUATION The purpose of the ESD Evaluation present process is to perform evaluations of Terminals with Chip reader and Magstripe reader against ESD discharges. The Terminal ESD will be evaluated by performing Chip reader and Magstripe reader ESD testing, with several types of ESD discharges and several levels of ESD voltages. Based on the result of such testing, EMVCo will give an ESD evaluation with an associated level of ESD protection of the Terminal. The present process applies to any Terminal Type other than the following specific cases: ATM, Terminals with motorized reader. These specific cases will be covered in a future separate process document dedicated to Terminal with specific readers. 4.2 ESD EVALUATION DOCUMENTATION The ESD Evaluation process is based on a set of documents referred to as ESD Evaluation documentation : EMVCo Type Approval - Terminal ESD Evaluation - Administrative Process, EMVCo Type Approval Terminal ESD Evaluation - Test Cases, EMVCo Type Approval Terminal ESD Evaluation Implementation Conformance Statement. 4.3 PRODUCT The EMVCo ESD Evaluation consists of an evaluation of the Product on its ESD protection. The Product that will be evaluated for ESD is a Terminal containing at least an approved Level 1 contact IFM or an IFM that will be Level 1 approved at the same time as the ESD Evaluation. If the Terminal submitted contains a magnetic stripe reader (optional), the magnetic stripe reader will also be evaluated for ESD. Note: the ESD evaluation must be granted for each Product, even if the multiple Products contain the same IFM (Evaluation is not granted on the L1 approved IFM, but on the Terminal containing the IFM). Page 12

13 4.4 ESD EVALUATION FEE STRUCTURE The following fee structure applies: Submission: US$ 500 Renewal: US$ 500 If the IFM of the Product is submitted for L1 Approval simultaneously with ESD evaluation of the Product, then ESD fees are waived (so only L1 approval fee apply). This waiver is applicable until June 30, Page 13

14 5 ROLES & RESPONSIBILITIES The following sections define the roles and responsibilities of the various participants in the ESD Evaluation process. 5.1 EMVCO EMVCo defines ESD Evaluation requirements and evaluates operational results. EMVCo provides the following services: Defines the Administrative Process. Operates the Evaluation Process. Qualifies companies that perform audits to establish Laboratory accreditation. Defines Laboratory accreditation requirements in [TA ACC]. Evaluates Laboratory audit results and determines if the EMVCo accreditation should be granted to a Laboratory. Defines Tool Qualification Process. Qualifies Test Tool and maintains a list of Qualified Test Tools on the EMVCo web site. Manages Laboratory appeals process and resolves accreditation disputes. Defines test cases appropriate to test ESD protection. Defines procedures used to perform testing, submits test results for evaluation, and communicates evaluation results. Defines the test tools and evaluation criteria thereof. Evaluates ESD test results to determine whether evaluation should be granted. Notifies appropriate EMVCo working group of warranted specification corrections, clarifications, and enhancements where appropriate. Evaluates terminal and card failure complaints to determine if ESD Evaluation revocation for a particular Product is appropriate. Provides result response to Product Provider s type approval test result evaluation request. Maintains and publishes (via EMVCo web-site) a list of Product that have received EMVCo ESD Evaluation notification. Issues the Letter of Evaluation. 5.2 EMVCO CATA SECRETARIAT The EMVCo Terminal Type Approval Secretariat (CATA Secretariat) is responsible for managing the EMVCo ESD Evaluation process. This includes the administrative functions associated with Product Provider s registration, completion of contracts, processing evaluation requests and fees, issuing letters of evaluation or decline, etc. The role also includes communicating ESD Evaluation status to third parties and the maintenance of a database that provides the following: Qualified Auditors. Accredited Laboratories. Qualified EMVCo Tools. ESD Evaluation and compliance requirements and test cases. Evaluated EMVCo ESD Product. Page 14

15 5.3 LABORATORY The Laboratory is a test facility accredited by EMVCo to conduct testing of the Product in accordance with the EMVCo ESD test cases. It shall also: Verify the Implementation Conformance Statement provided by the Product Provider. Perform the test session. Analyze the test results. Verify that after the completion of the test session, 4 functional Terminal samples are available for future sessions. Communicate the test results to the Product Provider. Send the test results to EMVCo upon Product Provider approval, Eventually send the Request for Evaluation on behalf of the Product Provider. 5.4 PRODUCT PROVIDER The Product Provider shall provide the Product to be tested by the Laboratory: Sign appropriate contracts. Select the Laboratory to run the test session(s). Fill out the Request for Evaluation and Implementation Conformance Statement Forms. Submit the ICS for review to the Laboratory. Submits the final Product for testing to the Laboratory. Verify and approve the test results provided by the Laboratory. Submit the Request for Evaluation form to EMVCo (the Laboratory can submit the Request for Evaluation form on behalf of the Product Provider). Page 15

16 6 ESD EVALUATION PROCEDURES The ESD Evaluation procedure applied by the Product Providers, the Laboratories and EMVCo includes the following: Product Providers conclude the contract with EMVCo. A contract between EMVCo and the Product Providers must be completed before test results are submitted to EMVCo for evaluation. Product Providers obtain registration forms from the EMVCo web site or from an EMVCo accredited Laboratory. Product Providers submit a completed registration template to the EMVCo CATA Secretariat. Product Providers obtain the ESD EMVCo/Product Provider contract from the EMVCo web site. Product Providers select an accredited Laboratory from the list of accredited Laboratories published on the EMVCo web site. Product Providers conclude a contract with the Laboratory selected in respect of the Product to be tested for ESD. Product Providers and selected Laboratory complete the ESD ICS statement. The Laboratory performs appropriate testing of the submitted Product against the published test requirements and test cases. Product Providers submit a completed Request for Evaluation form to EMVCo. Based on the RFE form, EMVCo will provide Product Provider with an invoice. Based on the received invoice, the Product Providers settle the administrative fees with EMVCo. Upon the Product Provider s request, the Laboratories submit the ICSs and the test results to the EMVCo CATA Secretariat. Once the fee payment is confirmed by EMVCo Financial Secretariat, ICS and test results are reviewed by EMVCo and, if appropriate, issue Evaluation notification. Evaluated Products are posted on the EMVCo web site after evaluation notification. The Laboratory retains evaluated Products for a period of 4 years as of the date of evaluation. The Product Provider is responsible for providing support as necessary to maintain the Products in an operational state to accommodate any subsequent testing or analysis that may be deemed necessary by EMVCo. Page 16

17 below shows the diagram of ESD Evaluation Processes: Page 17

18 6.1 REGISTRATION Registration provides the Product Provider with entry to the EMVCo ESD Evaluation process in order to make the Product Provider aware of all formalities that need to be finalized prior to submitting their final test report to EMVCo for evaluation. The registration process includes the following steps: The Product Provider submits a registration request to the EMVCo CATA Secretariat. The EMVCo CATA Secretariat will send to the Product Provider a response with the following: Registration reference number, Contract between EMVCo and Product Provider, Appropriate contact information, Administrative fees charged for EMVCo ESD Evaluation and payment instructions. 6.2 CONTRACT WITH EMVCO The Product Provider must complete and sign the EMVCo defined ESD contract before final test results are submitted to EMVCo for evaluation. This contract governs the relationship between EMVCo and the Product Provider and includes the Product Provider s acceptance of all requirements, procedures, terms and conditions governing EMVCo ESD Evaluation. The contract is standard for all Product Providers to ensure consistent requirements for all participants. Contract customization for individual Product Providers is not possible. Page 18

19 6.3 REQUEST FOR EVALUATION Product Provider and Laboratory Operations The following operations are performed by the Product Provider and the Laboratory as per the EMVCo Evaluation procedure: The Product Provider is free to select any EMVCo accredited Laboratories for the purpose of achieving EMVCo ESD Evaluation. A list of accredited Laboratories is published on the EMVCo web site. Once Laboratory is selected, the Product Provider and the Laboratory execute a contract defining the individual rights and obligations of the contracting parties. The provisions of Product Provider/Laboratory contract are up to the contracting entities and entirely out of EMVCo s scope. Any fees payable to the Laboratory in respect of the tests to be conducted are solely at the discretion of the Laboratory. Product Provider sends the appropriate ESD Implementation Conformance Statement (ICS) to the chosen Laboratory for each Product under test that it submits. The ICS formats and content requirements are determined by EMVCo. The Laboratory tests the Products in accordance with EMVCo test procedures. The Product Provider prepares the Request for Evaluation form with the ICS and submits it to the EMVCo CATA Secretariat. EMVCo then issues the invoice for the Product Provider. Product Provider submits payment to EMVCo based on the received invoice. The Laboratory sends the final test reports to the Product Provider being the owner of the test results. The Laboratory must advise EMVCo of any failures that have been encountered during testing. The Laboratory submits an original copy of the test results report to the EMVCo CATA Secretariat, and ensures that the Product Provider has already submitted his completed Request For Evaluation form Contracts between Laboratories and Product Provider The provisions of the contract entered between Laboratories and Product Providers are entirely outside of EMVCo s scope. However, the likely areas for inclusion are mentioned below for information purposes only: Any Laboratory requirements needed for testing including any software application required interfacing with the Laboratory test equipment, e.g., host emulator, etc. Reference to the contract between the Product Provider and EMVCo. Agreement of mutual cooperation in providing information and assistance where needed. Lead-time for the execution of the type approval tests. The number of samples available for testing (At least 4 samples shall be provided). Arrangement for the preparation and delivery of samples. Right to keep all samples for the duration of the test procedure. Right to keep all approved samples for a period of 4 years after the conclusion of testing. Note: samples are retained for subsequent testing purposes and the Product Page 19

20 Provider must provide the necessary support to the Laboratory to ensure the Product remains fully functional. After the test session, 4 functional samples shall be available. These samples shall be identified for ESD testing purposes only (so different samples than for Level 1 or Level 2 testing) and stored separately. Recognition that no infringement on the independence or impartiality of the Laboratory will be allowed during or after testing. Agreement on the boundaries of use of the test report. Provisions for conflict resolution Evaluation Test Report The results of the Terminal ESD Evaluation tests are combined in one signed test report that is submitted to EMVCo in electronic format by the Laboratory for review. The test reports must include the following information: Identification of the Laboratory. Identification of Product Provider. Identification of Product (IFM and Terminal). The test report shall be provided with the below information: o EMVCo test case version used for test, o Identification of all Laboratory test equipments and software versions used during the tests, o o o o o Dates the tests were performed, The test case execution results in the test reports for each test case: EMVCo defined test case number and title, Pass, Fail, or Not Applicable test result, For Not Applicable designated test case results, an explanation justifying this designation, Additional Laboratory comments, if appropriate, A detailed description of any exception test(s) performed or equipment utilized and a description of related test results, A detailed description of the Product Provider s modifications that may be required for the purpose of successfully executing the EMVCo test cases, Acknowledgment that 4 functional samples are available after the test session Product Provider Preparation for Evaluation Request The Product Provider determines whether test results resulting from Laboratory testing will be submitted to EMVCo for evaluation. Submitting test results to EMVCo for evaluation indicates Product Provider acceptance that the test results are a true representation of the Products. Test results may be submitted to EMVCo for evaluation up to 90 days from the date they are generated by the Laboratory. Test results older than 90 days are expired and cannot be submitted for evaluation. Product re-testing is required to create a current test report if the validity period is exceeded and EMVCo evaluation is desired. The Product Provider must ensure that the Product under test associated with test results submitted to EMVCo for evaluation remains unaltered and accessible in a timely manner during the evaluation process. It is recommended that the Product under test remain in the possession of the Laboratory until EMVCo has evaluated or declined the Request for Evaluation. Page 20

21 6.3.3 Product Provider Request for Evaluation The request for review will include: Letter requesting evaluation (RFE form). The complete ICS. The complete and unchanged test report as received from the Laboratory. EMVCo invoice settled. Any additional supporting documentation the Product Provider believes is appropriate EMVCo Evaluation Upon receiving the request, EMVCo will: Review the submitted test reports and determine if evaluation should be granted for the Product. Notify the Product Provider of evaluation or denial for the Product. Issue Letter of Evaluation, if appropriate. Provide notification of EMVCo Terminal ESD Evaluation. ESD Product LoE identifies the evaluated product with the following information: The hardware configuration of the Product (including the ICS detailed information). The Test Plan version against which it was tested. The renewal date. The level of protection of the Chip reader The level of protection of the Magstripe reader (if present) Note: The LoE will only be issued if an IFM Level 1 LoA was granted or is granted at the same time of the Product. 6.4 ESD EVALUATION RENEWAL PROCESS Basic Policy for renewal The initial Letter of Evaluation is valid for 4 years. At the time of the renewal, the following rules apply: If there are no critical changes in the ESD Test Plan [TA ESD], the Letter of Evaluation can be renewed for an additional 4 years without any testing. If there are critical changes in the ESD Test Plan [TA ESD], the Letter of Evaluation can be renewed for 4 additional years with a delta testing. The following rules will be applied to Renewal Request: The Product LoE must be valid at the time of renewal. The Level 1 LoA must be valid at the time of renewal. Six months before the renewal date of their Product, EMVCo will send a notification letter to the Product Provider. After the reception of this letter and prior to the renewal date, Page 21

22 Product Provider may request their renewal by submitting the originally evaluated Product to EMVCo for renewal testing. Note: Product Providers are not allowed to apply for renewal testing before receiving the notification letter. Renewal Test Plan 6 months before the renewal date: The objective of the renewal testing is to ensure these Products pass the latest EMVCo testing. By passing the renewal test, the Product will receive an extension to the Letter of Evaluation. If the Products fail to pass the renewal testing, they will be removed from the Product list and their Letter of Evaluation will be considered revoked. If the existing samples are no longer functional at the Laboratory, the Product Provider may submit the original sample to a Laboratory for renewal testing. The set of the renewal tests will be generated based on the newly added or modified test cases since the older test plans against and the most recent test plans at the time of testing (delta testing). The most recent test plan reference is the version available at the time of the ESD test session Laboratories for Renewal testing The Product Provider may select to have a different laboratory to perform Renewal testing. The Product Provider must take the necessary arrangements to have the originally approved Product transported between laboratories. The Product Provider is responsible for incurring the costs associated with this transfer Samples submission Renewal testing must be performed on Products already physically present at an EMVCo laboratory. If the Product is no longer present or is otherwise inoperable, EMVCo may accept a replacement Product from the Product Provider for testing; provided they have signed a disclaimer stating that the replacement Product is identical in all respects to the Product originally supplied to a laboratory for testing (without modification,..). For this reason, it is essential that Product Providers retain an exact and unaltered copy of the Product originally sent to the laboratory during the initial testing phase ICS Submission If the Product does not support mandatory features described in the latest version of the ICS, the Product is not eligible for renewal. ICS submitted for renewal testing must be based on the latest version available at the time of testing. Page 22

23 7 TEST VERSION CHANGE The following sections identify the process managing type approval test changes when the specifications or test cases change. 7.1 TEST CHANGES EMVCo reserves the right to change type approval tests at any time in order to increase the accuracy and integrity of the tests. Figure 7: Example of the timing for test changes EMVCo will inform all participants of the new tests and will fix the date(s) for activation of the new tests as well as deactivation of the old ones. EMVCo may determine a time period during which either the old or new test version may be used in the type approval process (see figure 7). However, EMVCo shall not be under any obligation to permit a phase-out of old tests. 7.2 TESTING APPLICABILITY All Products will be tested to the current version of the EMV ESD test cases. Test case applicability is defined by a date determined by EMVCo; any new Product submitted on or after this date will be tested according to the current test plan. Previous versions of the test plan may not be used and EMVCo will reject any testing performed using an old version of a test plan on or after the applicable date. Page 23

24 8 PRODUCT CHANGES EMVCo recognizes that from time to time minor changes may occur without affecting Product compliance to the ESD protection. However, EMVCo considers a major modification to be a change in a Product that affects the compliance to the ESD protection. A Product that undergoes a major modification shall be considered as new design and a new ESD Evaluation is required. A major change in a Product may generate a different level of ESD protection. In such cases, the modified Product shall be considered as new and new testing and ESD evaluation are required. The original unchanged Product remains ESD evaluated. A minor change in a Product does not generate a different level of ESD protection. In such cases, the Product shall not require new ESD Evaluation. It is the responsibility of the Product Provider to maintain all evidentiary documentation describing why the modification is minor in nature and does not negatively impact the ESD protection of the Product. The Product Provider is responsible for declaring a major or minor change. This declaration shall be supported with tangible evidences (design documents, test logs, etc.). Declarations should not be submitted to EMVCo; except if there is uncertainty as to whether a particular modification constitutes a major or minor change. If EMVCo identifies the change as a major change, it will be considered as a new Product and it will require ESD testing by an EMVCo laboratory. Detailed procedures relating to change management may be provided in future documentation as warranted. Page 24

25 9 CHANGE IN CONTACT INFORMATION The Product Provider shall inform the EMVCo CATA Secretariat in case of company name, address or contact information change, as stated in the Product Provider registration section. Changes impacting company names may require a new contract with EMVCo. Generally, evaluation notification letters are not reissued when name changes are the result of corporate mergers, sales or other events covered by the Assignment and Successors and Assigns sections in the contract between Product Provider and EMVCo. Modifications to company addresses and contact information will be applied to the EMVCo web site and subsequent communication (i.e. approval notification) with the Product Provider. Some organizations specify different contact information for various products. Contact information changes will be applied to all listed Product unless especially stated on the request. Page 25

26 10 APPENDIX Product Provider can find all forms on the EMVCo web site ( under Terminal ESD Evaluation: ESD Registration Form. ESD Product Provider Contract. ESD Implementation Conformance Statement. ESD Request for Evaluation. Page 26