EMV 3-D Secure—Testing FAQs

General Questions
1. Is there a testing program for EMV 3-D Secure Product approvals?
Yes. EMVCo supports the functional testing of EMV 3-D Secure (3DS) Products to confirm that they
are compliant to the EMV 3-D Secure Protocol and Core Functions Specification. A list of EMVCo
accredited 3DS Test Platform Providers can be found by selecting the List of Test Platform Providers
link found within the following URL:
https://www.emvco.com/processes-forms/product-approval/authentication/3ds/.

Additionally, the PCI Security Standards Council will use the 3DS functional specification created by
EMVCo, to deliver data security requirements, testing procedures, assessor training and reporting
templates to address the environmental security. A list of PCI 3DS security documents can be found
within the following URL (use filter by “3DS”):
https://www.pcisecuritystandards.org/document_library

2. What Products are supported by the EMVCo 3DS Product Approval Process?
The EMVCo 3DS Approval Process applies to the 3DS Product components listed below:
- 3DS SDK
- 3DS Access Control Server (ACS)
- 3DS Server
- 3DS Directory Server (DS)

3. Where can I find information about EMVCo 3DS Testing?

The complete EMVCo 3DS approval process can be found in the EMVCo 3-D Secure Approval -
Administrative Process document. This document is available for download on the EMVCo website
by selecting the 3-D Secure Admin Process link found within the following URL:
https://www.emvco.com/processes-forms/product-approval/authentication/3ds/.

4. What does the EMV 3DS Approval Administrative Process describe?

The EMV 3-D Secure Approval - Administrative Process, describes the 3-D Secure Approval process
and also describes the forms to be completed by all parties involved in the process.

5. Where can I locate the forms described in the EMV 3DS Approval Administrative Process
document?
The forms described in the EMV 3DS Approval Administrative Process document can be found on
the EMVCo website by following each link (Registration form, Implementation Conformance
Statement [ICS] form and Request for Approval form) found within the following URL:
https://www.emvco.com/processes-forms/product-approval/authentication/3ds/.

6. Where can I ask questions about EMVCo 3DS Testing?

There are several communication channels available for inquiries. The ‘EMVCo public queries’ is the
preferred channel. A link can be found within the following URL:
https://www.emvco.com/about/contact-us/.

© 2019 EMVCo, LLC. All rights reserved

Page 1
 For more detailed questions we recommend that you become an EMVCo Subscriber or an EMVCo
Technical Associate. Subscriber or Technical Associate registration can be made from the following
URL:
https://www.emvco.com/get-involved/ways-to-participate/

For any questions during the 3DS testing phase, please contact your 3DS Test Laboratory and/or
3DS Test Platform Provider.

7. How do I register for 3DS Testing?

Please visit the following URL for a quick start guide on how to begin the registration process:
https://www.emvco.com/processes-forms/product-approval/authentication/3ds/

The online registration form can be accessed via the Registration Form link within this website.

8. Do the fees described in the EMV 3DS Product Approval Fees bulletin include 3DS Test
Laboratory or 3DS Test Platform fees?
The EMV 3-D Secure Approval Bulletin No. 001 (Product Approval Fees) available here describes
EMVCo’s fees for the EMV 3DS Approval Administrative Process. Other fees would be described and
charged by the 3DS Test Laboratory and/or 3DS Test Platform Provider. Please contact the 3DS Test
Laboratory and/or 3DS Test Platform Provider for more details regarding their fees and services.

Any other cost(s) associated with the 3DS Product Providers development of their 3DS Product is
out of scope for EMVCo.

9. What happens after my EMVCo 3DS Testing is done?

When 3DS Compliance Testing is performed successfully, the 3DS Product Provider requests the
approval of the 3DS Product(s) and at that time pays the corresponding fees for Approval to EMVCo.
The 3DS Laboratory, on behalf of the 3DS Product Provider, then submits the Test Report to the
EMVCo 3DS Approval Secretariat for review and subsequent approval. EMVCo will then issue a 3DS
Letter of Approval (3DS LOA) to the 3DS Product Provider, and add the 3DS Product Provider’s
Product to the EMVCo 3DS Approved Product List.
The List is available by selecting the Search Approved Products link found within the following URL:
https://www.emvco.com/processes-forms/product-approval/authentication/3ds/

10. What is the 3DS LOA and what is its benefit?

3DS LOA (Letter of Approval) is a written statement that documents the decision of EMVCo that a
specified 3DS Product component has demonstrated sufficient compliance to the EMV 3DS
Specifications on the date of testing.
An EMVCo Approval fee applies to the 3DS Product Providers. Refer to question 8 for the details of
the Approval fee.

© 2019 EMVCo, LLC. All rights reserved

Page 2
11. What is an EMVCo Approval / Reference Number and how can I get one?
Within the 3DS LOA letter, EMVCo will include an EMVCo Reference Number also called EMVCo
Approval Number that is unique for the Product Provider’s 3DS Product.
The EMVCo Reference Number is updated each time the 3DS Product Provider submits their Product
for 3DS testing.
The EMVCo Reference Number is a field element described in the EMV 3DS specification, and is
used in 3DS message exchanges.

12. What is an EMVCo Product Provider Registration Number and how can I get one?
To test with EMVCo’s 3DS Test Process a 3DS Product Provider needs an EMVCo Product Provider
Registration Number. An EMVCo Product Provider Registration Number is assigned by EMVCo to a
Product Provider as part of EMVCo’s Product Provider registration process, described under the 3-D
Secure Approval Process found here: https://www.emvco.com/processes-forms/product-
approval/authentication/3ds/

The online registration form can be accessed via the Registration Form link within this website.

3DS Product Providers with a valid EMVCo Product Provider Registration Number can use that ID
for EMVCo’s 3DS Test Process.

13. Once I have completed EMVCo 3DS Testing for my 3DS Product when do I need to retest my
3DS Product?
Product Providers may test either based on their business priorities or closer to the expiration of their
existing LOA.
EMVCo reserves the right to require 3DS Products with LOAs be tested again when needed (e.g.
when there are 3DS security or interoperability changes).

14. What are 3DS Specification Bulletins and 3DS Approval Bulletins?
3DS Specification Bulletins are EMVCo communications on updates to the EMV 3DS specifications.
3DS Specification Bulletins can be found here on EMVCo’s Search website.
3DS Approval Bulletins are EMVCo communications on updates on the 3DS Approval Process
regarding EMVCo’s 3DS testing or EMVCo’s 3DS approval process. 3DS Approval Bulletins can be
found here on EMVCo’s Search website.

15. I am a 3DS Product Provider with multiple 3DS components, do I need multiple registrations
with EMVCo?
EMVCo’s 3DS testing process recognizes that 3DS Product Providers may develop or offer multiple
3DS Product components, or have different business units or lines of business that support different
3DS Product components.
A 3DS Product Provider may want to list all their 3DS Products under one business, in this case, a
single EMVCo Product Provider Registration is needed.

© 2019 EMVCo, LLC. All rights reserved

Page 3
 A 3DS Product Provider may want to list their 3DS Products under different lines of business with
different business names, in this case a separate EMVCo Product Provider Registration is needed
for each business name. Each separate registration will be assigned a different EMVCo Product
Provider Registration Number.

16. Where can I find a list of the bulletins that my 3DS Product must support?
All 3DS bulletins are available here on the EMVCo Document Search website.

17. How can I find out which 3DS protocol versions a 3DS Product supports?
The EMVCo Reference or Approval Number of a 3DS approved Product indicates the highest version
of 3DS protocol, a 3DS Product has been certified against. The format of this number is
3DS_LOA_XXX_YYYY_020m00_nnnnn where:
- XXX describes the type of 3DS Product
o XXX= SER for 3DS Server
o XXX=ACS for 3DS Access Control Server (ACS)
o XXX=SDK for 3DS SDK
o XXX=DIS for 3DS Directory Server
- m describes the 3DS protocol version for which the 3DS Product has been certified
o m=1 for protocol version 2.1.0
o m=2 for protocol version 2.2.0
The list of the approved 3DS Products can be found by selecting the Search Approved Products link
found within the following URL:
https://www.emvco.com/processes-forms/product-approval/authentication/3ds/.

© 2019 EMVCo, LLC. All rights reserved

Page 4
3DS Testing Process
18. How do I become 3DS Test Laboratory?
If you are EMVCo subscriber, you can access the 3DS Test Laboratory Requirement document to
become the 3DS Test Laboratory. 3DS Test Laboratory Requirement document is available here.
If not, please contact to 3DS secretariat.

19. How do I become 3DS Test Platform provider?

If you are EMVCo subscriber, you can access the 3DS Test Platform Requirement document to
become the 3DS Test Platform Provider. 3DS Test Platform Requirement document is available here
If not, please contact to 3DS secretariat.

20. How can we get the Test Plan/Test Cases?

Test Plan and Test Cases can be accessed and used on the 3DS Test Platform after Product Provider
registration is completed but they are not available to 3DS Product Providers outside the 3DS testing
environment.

21. How can I find EMVCo-qualified Service Providers that offer 3DS Testing?
Service Providers that have successfully completed EMVCo’s qualification and accreditation process
for providing 3DS Test Platform can be found by selecting the List of Test Platform Providers link
found within the following URL:
https://www.emvco.com/processes-forms/product-approval/authentication/3ds/

22. How can I find EMVCo-qualified Service Providers that offer 3DS Laboratory services?
3DS Laboratories that have successfully completed EMVCo’s accreditation process for providing 3DS
Laboratory services can be found by selecting the List of Laboratories link found within the following
URL:
https://www.emvco.com/processes-forms/product-approval/authentication/3ds/

23. What is the difference between 3DS Pre-Compliance and Compliance testing?
3DS Compliance testing consists of the execution by a 3DS Test Platform of a defined set of tests
against requirements described in a version of 3DS specification to determine official compliance with
that version of 3DS specification.
3DS Pre-Compliance testing is a phase where 3DS Product Providers can access the same defined
set of Compliance tests allowing debug, analysis and review of the compliance with that 3DS
specification. Pre-Compliance is outside control of EMVCo.

24. What is an Implementation Conformance Statement (ICS) form?

An Implementation Conformance Statement (ICS) form is a form completed by the 3DS Product
Provider which identifies the protocol level supported and which is listing all optional functions as
specified in the reference 3DS specifications supported by the 3DS Product to be approved.

© 2019 EMVCo, LLC. All rights reserved

Page 5
25. When can we submit an ICS form to EMVCo?
The ICS form can be submitted only after your 3DS Pre-Compliance testing is complete prior going
into 3DS Compliance testing session. Compliance phase starts when the Laboratory submits the ICS
Form to EMVCo (assuming ICS is correct).

26. What does “multi-protocol version support” mean when referring to 3DS Product testing?
A 3DS Product shall support all "Active Protocols" that precede the protocol version selected by the
3DS Product Provider. During the Approval Process, the 3DS Product will be tested against all these
active protocol versions and against the protocol version selected by the 3DS Product Provider.
An "Active Protocol" does not necessarily mean the protocol version is still selectable for 3DS testing
on the 3DS Test Platform. A protocol may remain active after the migration period for this protocol.
The deactivation of a protocol will be announced by EMVCo.

27. What is the process to renew the 3DS LOA after the 2 year period?
Before a 3DS Product’s LOA expires, 3DS Product Providers can submit their 3DS Products for 3DS
testing and approval process utilizing the available protocol versions. The 3DS testing and approval
process will be a "new testing process" instead of "renewal" and shall use the same process followed
to receive the prior 3DS LOA.

28. How do I test during the Migration Period?

The migration period is where both a newer protocol version and an older protocol version are
available for selection by the 3DS Product Provider to perform 3DS testing for a Letter of Approval.
EMVCo determines the date when the older Protocol Version is no longer available for selection. After
this date, the older protocol version can no longer be selected for 3DS approval testing (but may
remain an active protocol).
3DS Product Providers creating new test project during the Migration Period will be able to select
either protocol.

29. How long does it take to complete the testing and get a 3DS LOA?
The time it takes to receive a 3DS LOA from EMVCo can vary for 3DS Product Providers and includes
the following process steps: EMVCo vendor registration, connectivity setup to the 3DS Test Platform
including test harness setup to this 3DS Test Platform, 3DS Pre-Compliance and 3DS Compliance
testing.
Details about each process step can be found on the EMVCo website by selecting the 3-D Secure
Admin Process link found within the following URL:
https://www.emvco.com/processes-forms/product-approval/authentication/3ds/.

30. How do I complete the onboarding Compliance test (with Payment System)?
For onboarding your 3DS component with a DS, please contact your Payment System or the DS
operator.

© 2019 EMVCo, LLC. All rights reserved

Page 6
31. How long is an ICS valid once approved by EMVCo?
An approved ICS is valid for 45 calendar days. If the related Request For Approval is not submitted
and the invoice is not paid within that period, all related documents to this approval request are no
longer valid (ICS, RFA, report) and the 3DS Product Provider needs to restart a new process from
the beginning by submitting a new ICS.

3DS 2.2.0 Compliance Testing

32. Which 3DS protocols does EMVCo’s 3DS Testing Programme support?
EMVCo’s 3DS Testing Program supports 3DS 2.1.0 and 2.2.0 Protocols.

33. How to begin 3DS 2.2.0 testing?

The process for testing a 3DS Product for 3DS 2.2.0 is the same as for 3DS 2.1.0. The EMVCo 3DS
Approval Administrative Process document describes the EMV 3-DS Secure Approval process and
can be found on the EMVCo website by selecting the 3-D Secure Admin Process link found within
the following URL:
https://www.emvco.com/processes-forms/product-approval/authentication/3ds/
3DS Product Providers with existing EMVCo 3DS LOAs can contact their 3DS Test Platform Provider
for details.

34. Are EMVCo 3DS 2.2.0 Products required to implement 3DS 2.1.0 Protocol?
Yes, EMV 3DS 2.2.0 Product must implement 3DS 2.1.0 Protocol to receive 3DS 2.2.0 letter of
approval from EMVCo.

35. My 3DS Product has already received an EMV 3DS 2.1.0 3DS Letter of Approval (3DS LOA),
why do I need to go through 3DS 2.1.0 testing again when testing for 3DS 2.2.0?
When a 3DS Product is submitted for 3DS 2.2 Compliance testing, it will be tested against both 3DS
2.2.0 and the latest 3DS 2.1.0 test plan. The latest 3DS 2.1.0 test plan may include updates and
changes from the time that your Product received its 3DS 2.1.0 LOA.

36. If my 3DS Product has already received an EMV 3DS 2.1.0 3DS Letter of Approval (3DS LOA),
what are my options to have my 3DS Product listed under 3DS 2.2.0?
If you want to have a single entry for your 3DS Product on the EMVCo website, Submission Type has
to be set to ‘Change Product’ in the ICS form. Your 3DS Product’s 3DS 2.1.0 information on the
EMVCo website will be updated to show its new 3DS 2.2.0 information.
If you want to have a separate entry for your 3DS 2.2.0 Product and keep the 3DS 2.1.0 Product entry
on the EMVCo website, Submission Type has to be set to ‘Initial’ in the ICS form. A separate line will
be added on the EMVCo website for the newly 3DS 2.2.0 approved Product.
In both cases, when 3DS 2.2 testing is successfully completed, your 3DS Product will receive a 3DS
2.2.0 LOA with a 2 year expiration date and new EMVCo approval number.

© 2019 EMVCo, LLC. All rights reserved

Page 7
37. How does EMVCo list 3DS 2.2.0 approved Products on the EMVCo website?
The “approval number” (3DS_LOA_XXX_YYYY_020200_nnnnn) of 3DS 2.2.0 approved Products
includes the 3DS protocol specification version that the 3DS Product was tested against on the
EMVCo website.

38. Will EMVCo 3DS 2.2.0 certified Products works with EMVCo 3DS 2.1.0 approved Products?
Yes. Note that v2.2.0 features/enhancements are available if all 3DS components involved in the
transaction have updated their software to support v2.2.0.

39. Do I need to develop all 3DS 2.2 features (for example Whitelisting and Decoupled
Authentication) even though I do not plan to use these features in production?
A 3DS Product must be able to successfully process all fields described in the 3DS 2.2.0 specification,
such as Whitelisting and Decoupled Authentication, in order to receive a 3DS 2.2.0 3DS Letter of
Approval (3DS LOA) from EMVCo.

40. What Native UI and HTML UI Device Rendering Options does my 3DS SDK and ACS Products
need to support?
The 3DS SDK must support all Device Rendering Options (Native and HTML).
The ACS must support all ACS Rendering Types for the ACS supported authentication methods, at a
minimum at least one ACS UI Template for each ACS interface (Native UI and HTML UI).

© 2019 EMVCo, LLC. All rights reserved

Page 8