Glossary

EMV glossary

Plain-English definitions of the EMV terms used in our tools and articles, with the tag where one exists.

Search the glossary

AAC (Application Authentication Cryptogram) 9F26: The cryptogram a card returns to decline a transaction. The Cryptogram Information Data (9F27) shows when the card returned an AAC. Read more
AFL (Application File Locator) 94: A list returned by the card in GET PROCESSING OPTIONS that tells the terminal which files and records to read, and which records are used for offline data authentication.
AID (Application Identifier) 4F / 84 / 9F06: Identifies a payment application. It starts with a 5-byte Registered Application Provider Identifier (RID) that identifies the scheme, for example A000000003 for Visa or A000000004 for Mastercard.
AIP (Application Interchange Profile) 82: Two bytes from the card that state which functions it supports, such as offline data authentication methods, cardholder verification and issuer authentication. Kernel 8 redefines its layout.
Application Cryptogram 9F26: An 8-byte MAC computed by the card over transaction and card data. Depending on the type, it is an ARQC, a TC or an AAC. Read more
ARC (Authorisation Response Code) 8A: A two-character code from the issuer, or generated by the terminal, that gives the outcome of the authorisation, for example 00 for approved.
ARPC (Authorisation Response Cryptogram) 91: A cryptogram generated by the issuer and sent back in the Issuer Authentication Data so the card can check that the response came from its real issuer. Read more
ARQC (Authorisation Request Cryptogram) 9F26: The cryptogram a card returns when the transaction must go online. The issuer recomputes it to check that the card is genuine and the data was not altered. Read more
ATC (Application Transaction Counter) 9F36: A counter kept by the card and incremented on every transaction. It feeds the session key and helps the issuer detect replayed cryptograms.
BER-TLV: The Basic Encoding Rules variant of Tag-Length-Value encoding, defined in ISO/IEC 8825 and used by EMV for card data. It supports multi-byte tags, long lengths and nested templates. Read more
CA Public Key 8F (index): A payment scheme's certification authority key stored in the terminal. It is used to recover the issuer public key certificate during offline data authentication.
CDA (Combined DDA/Application Cryptogram Generation): An offline data authentication method where the card signs its dynamic data together with the application cryptogram in the GENERATE AC response.
CDCVM (Consumer Device Cardholder Verification Method): Cardholder verification performed on the consumer's own device, such as a phone or watch, for example with a fingerprint, face recognition or device passcode.
CDOL1 / CDOL2 (Card Risk Management Data Object Lists) 8C / 8D: Lists of tags and lengths that tell the terminal which data to send with the first and second GENERATE AC commands. Read more
CID (Cryptogram Information Data) 9F27: One byte from the card that indicates the type of cryptogram returned (AAC, TC or ARQC) and whether an advice is required.
Contactless kernel: The Level 2 software that processes a contactless transaction for a given scheme, selected by the Entry Point. Also called a Card Processing Application (CPA). Examples are Kernel 2 (Mastercard), Kernel 3 (Visa) and Kernel 8 (EMVCo). Read more
CPA (Card Processing Application): Another name for a contactless kernel: the Level 2 software that processes a contactless card transaction once the Entry Point has selected it. Not to be confused with the EMV Common Payment Application, a card application specification also abbreviated CPA. Read more
CTQ (Card Transaction Qualifiers) 9F6C: Data returned by a Visa contactless card that tells the reader which cardholder verification and online processing the card requires. Read more
CVM (Cardholder Verification Method): The way the cardholder is verified: online PIN, offline PIN, signature, consumer device verification or no CVM.
CVM List 8E: A card data object containing amounts X and Y followed by rules that tell the terminal which CVM to try under which conditions, in order of priority.
CVM Results 9F34: Three bytes recording the CVM performed, the condition that applied and whether it succeeded.
CVR (Card Verification Results): The card's own record of the checks it performed, carried inside the Issuer Application Data. Its layout depends on the scheme and cryptogram version. Read more
DDA (Dynamic Data Authentication): An offline data authentication method in which the card signs data that includes a terminal unpredictable number, proving the card holds its private key.
DOL (Data Object List): A list of tags and lengths, without values, that tells the other side which data to send and in which order. PDOL, CDOL1, CDOL2 and DDOL are DOLs.
ECC (Elliptic Curve Cryptography): Public key cryptography based on elliptic curves. It offers the same security as RSA with much shorter keys and faster operations. Kernel 8 uses ECC to set up a secure channel with the card, protecting the cardholder's data, and for local authentication with ECC certificates. Read more
Entry Point: The part of a contactless reader, defined in EMV Contactless Book B, that performs pre-processing, discovers the card's applications and starts the right kernel.
FCI (File Control Information) 6F: The template returned by the card in response to SELECT, containing the DF name and application data such as the label, priority and PDOL.
fDDA (fast Dynamic Data Authentication): Visa's offline data authentication method for contactless transactions, in which the card signs dynamic data that the reader verifies after the card has left the field. Read more
Field 55 (DE 55): The ISO 8583 data element that carries EMV chip data, as a list of TLV objects, from the terminal to the acquirer and issuer. Read more
GENERATE AC: The command the terminal sends to ask the card for an application cryptogram: an AAC, a TC or an ARQC. Read more
GPO (GET PROCESSING OPTIONS): The command that starts transaction processing on the card. The card returns its AIP and AFL; in Visa's qVSDC it also returns the cryptogram.
IAC (Issuer Action Codes) 9F0D / 9F0E / 9F0F: Default, Denial and Online codes personalised on the card. The terminal compares them with the TVR to decide whether to decline, go online or approve. Read more
IAD (Issuer Application Data) 9F10: Proprietary data from the card sent to the issuer in the authorisation, usually including the cryptogram version and the Card Verification Results.
ICC (Integrated Circuit Card): The EMV term for a chip card.
Issuer script 71 / 72: Commands sent by the issuer in the authorisation response, for example to update card parameters or block the application, executed before or after the final GENERATE AC.
Kernel: The Level 2 software that implements EMV transaction processing between the terminal and the card. Read more
Kernel 2: Mastercard's contactless kernel, defined in EMV Contactless Book C-2, with CDA, terminal action analysis and relay resistance. Read more
Kernel 3: Visa's contactless kernel, defined in EMV Contactless Book C-3. In its qVSDC path the card returns the cryptogram in the GPO response and the TVR is not used. Read more
Kernel 8: EMVCo's common contactless kernel, defined in EMV Contactless Book C-8, with ECC-based privacy protection, AES MACs and local authentication. Read more
Level 1: EMVCo testing and approval of the physical card interface: contact reader electrics and the contactless radio interface. Read more
Level 2: Testing and approval of the EMV kernel software against the EMV specifications. Read more
Level 3: End-to-end certification of a deployed solution, run through the payment schemes, covering configuration, messages and host connection. Read more
Mag-stripe mode / MSD: Legacy contactless modes that send track data instead of an EMV cryptogram: mag-stripe mode for Mastercard and MSD for Visa. Both are being retired.
ODA (Offline Data Authentication): Checks performed by the terminal to authenticate the card without going online, using SDA, DDA, CDA or, in Kernel 8, local authentication.
Outcome Parameter Set DF8129 / 9F8210: The data a contactless kernel uses to report its outcome to the terminal, such as approved, declined, online request, try again or try another interface.
PAN (Primary Account Number) 5A: The card number.
PAN Sequence Number 5F34: A number that distinguishes cards sharing the same PAN. It is used when deriving the card's keys.
PDOL (Processing Options Data Object List) 9F38: A list in the card's FCI telling the terminal which data to send in GET PROCESSING OPTIONS.
PPSE / PSE: Payment System Environment directories on the card that list its applications: PPSE (2PAY.SYS.DDF01) for contactless and PSE (1PAY.SYS.DDF01) for contact.
qVSDC: Visa's quick VSDC contactless path, in which the card makes its decision and returns the cryptogram in the GPO response. Read more
Relay resistance protocol (RRP): A timing check in which the reader measures how fast the card answers a special command, to detect relay attacks that forward the radio exchange over a distance.
SDA (Static Data Authentication): The original offline data authentication method, in which the terminal verifies a static signature on card data. It does not protect against cloning and has been retired by most schemes.
SoftPOS: Contactless card acceptance on a commercial off-the-shelf phone or tablet using its NFC reader, without a dedicated payment terminal.
TAC (Terminal Action Codes): Default, Denial and Online codes set in the terminal configuration by the acquirer or scheme and combined with the IACs in terminal action analysis. Read more
TC (Transaction Certificate) 9F26: The cryptogram a card returns to approve a transaction. It is also used as proof of the transaction in clearing. Read more
TEI (Test Environment Interface): Mastercard's Test Environment Interface, also called Test Equipment Interface, lets a Level 2 test tool drive a payment terminal automatically during contactless compliance testing, so test sessions run without manual steps. CA public keys and the terminal configuration are usually loaded before a TEI session starts. Read more
TLV (Tag-Length-Value): The encoding used for EMV data: a tag identifies the data, a length gives its size and the value holds the data. Read more
Track 2 Equivalent Data 57: The card's track 2 data in chip form: PAN, expiry date, service code and discretionary data.
TSI (Transaction Status Information) 9B: Two bytes recording which functions the terminal performed during the transaction, such as cardholder verification or issuer authentication. Read more
TTQ (Terminal Transaction Qualifiers) 9F66: Data the reader sends to a Visa contactless card describing its capabilities and requirements, such as online cryptogram required or CVM required. Read more
TVR (Terminal Verification Results) 95: Five bytes recording the outcome of the terminal's checks. Kernel 2 and Kernel 8 use their own layouts, and Visa's Kernel 3 does not use the TVR. Read more
Unpredictable Number 9F37: A random number generated by the terminal and included in the cryptogram so that each cryptogram is unique.
VCPS (Visa Contactless Payment Specification): Visa's specification for contactless card acceptance at retail points of sale, covering the qVSDC transaction path. Read more
VOQOS (Visa ODA for qVSDC Online Specification): A Visa specification for performing offline data authentication on online qVSDC transactions, historically used in transit. Transit readers used to support VCPS and VOQOS together, before Visa introduced the Visa Contactless Transit Kernel Specification (VCTKS).
VRTPKS (Visa Ready Tap to Phone Kernel Specification): Visa's kernel specification for Tap to Phone, the acceptance of Visa contactless cards on commercial off-the-shelf phones and tablets (SoftPOS).