EMV certification levels L1, L2 and L3 explained for POS terminals

EMV certification for a POS terminal happens in three layers. Level 1 tests the physical card interface (the chip reader and contactless antenna), and Level 2 tests the EMV kernel software; both go through EMVCo type approval at accredited labs. Level 3 tests the terminal as it is actually deployed, with a specific payment application, configuration and acquirer host, under each card network's own rules. The terminal vendor owns L1 and L2, while the acquirer, usually with the software integrator, owns L3.

What do EMV Level 1, Level 2 and Level 3 test?

Sources for the L1 and L2 split: test lab UL describes L1 as covering the contact and contactless interfaces, and L2 as the kernel software, excluding functions such as the printer, display and building host messages. It also notes that contact L2 is managed by EMVCo while contactless L2 has been handled by the individual networks. UL: EMVCo terminal type approval EMVCo now also runs approval testing for its own EMV Contactless Kernel. EMVCo: contactless kernel testing PCI security is a different program; the PCI standards list shows which applies to which device. For what the chip and kernel actually do, see what is EMV.

Who certifies L1 and L2?

The terminal vendor submits each product to an EMVCo-accredited lab and, on passing, receives a Letter of Approval. The letters themselves state that the approval is valid while the approval number is posted on the EMVCo website, and renewal letters carry a printed expiry date after which some kernels cannot be renewed again. EMVCo: example Level 2 Letter of Approval Before you choose hardware, ask the vendor for the current letters for both the L1 interface and the L2 kernel, and check their expiry dates.

Who certifies L3, and what does it involve?

EMVCo describes Level 3 as testing that a terminal which already has L1 and L2 approval works with the merchant's or bank's systems. It says L3 content is defined by each payment system's policies, while EMVCo manages the L3 testing framework and qualifies the test tools that acquirers use. EMVCo: what is Level 3 terminal integration testing, EMVCo: EMV Level 3 testing

Each network runs its own process:

• Mastercard (M-TIP). Mastercard describes the Terminal Integration Process as Level 3 certification: it checks that the device software configuration and the acquiring chain, including the acquirer host and its connection to Mastercard, meet brand requirements. The acquirer uses an accredited M-TIP service provider and a qualified test tool, and Mastercard issues a Letter of Approval after reviewing the report. Mastercard: Tap on Phone implementation guide Mastercard also recommends extensive pretesting with a qualified tool before the formal run to avoid delays and cost. Mastercard: contactless acquirer toolkit
• Visa (ADVT and CDET). Visa's US requirements describe the Acquirer Device Validation Toolkit for contact chip and the Contactless Device Evaluation Toolkit as test cards and scripts for terminals that already have L1 and L2 approval and are configured for deployment. Visa adds that using the toolkits does not guarantee a terminal is fully compliant. Visa: U.S. EMV chip terminal testing requirements
• Domestic schemes. EMVCo's Participant System Identifier service lets domestic payment systems add their own integration requirements to qualified L3 tools. EMVCo: Level 3 testing PSI If you also accept a domestic scheme, ask whether it needs its own L3 run.

What changes trigger EMV recertification?

Visa's guidance is the most explicit public source. It says ADVT and CDET must be rerun for new hardware, new payment application software or configuration, significant hardware or software changes, and major kernel or interface module changes. Minor kernel changes generally do not require retesting unless they affect chip processing. Visa: U.S. EMV chip terminal testing requirements Visa's kernel guidance adds that a selectable kernel needs testing for each unique configuration, and that standardizing on one configuration reduces testing. Visa: kernel management guidelines

Use this as a planning checklist, and confirm each line with your acquirer and every network you accept:

How long does certification take and who pays?

The networks do not publish one timeline or fee that applies to everyone, and costs depend on contracts. Treat these as questions for your acquirer and terminal vendor rather than assumptions:

• Which networks require L3 for this exact device, application and configuration, and which qualified test tool will be used?
• Does the acquirer run L3, or do we as the integrator? Who pays the test lab, M-TIP service provider and tool licenses?
• How many unique configurations will we deploy, and can we reduce them to one?
• What is the lead time for a test slot, and how many retest rounds are included?
• When do the vendor's L1 and L2 letters expire, and what is the upgrade path?

The fastest certifications usually come from freezing scope early and pretesting. Payment partner certification readiness covers how to run the evidence and defect process, and ISO 8583 implementation profile checks covers the host message side.

How does certification work for mPOS and SoftPOS?

The same layers apply with different packaging. Mastercard's older mobile POS guidance says that if an mPOS reader supports chip, M-TIP must happen before it can be deployed. Mastercard: mobile POS certification overview For tap on phone, Mastercard says M-TIP can start once the solution is listed by PCI under MPoC, and that the listing must be for a full solution, not a component. Mastercard: Tap on Phone implementation guide With Tap to Pay on iPhone, Apple says the payment service provider handles the necessary certifications. Apple Developer: Tap to Pay on iPhone POS vs mPOS vs SoftPOS compares the options.

FAQ

What is EMV Level 3 certification?

It is testing of a terminal as deployed with a specific acquirer, payment application and configuration, run under each card network's rules, such as Mastercard's M-TIP and Visa's ADVT and CDET.

Does a merchant need EMV certification?

Usually not directly. The terminal vendor holds L1 and L2 approvals, and the acquirer or integrator handles L3. A merchant that builds its own payment application or connects terminals directly to a processor takes on more of that work.

Is PCI certification the same as EMV certification?

No. EMV certification tests that the terminal processes chip transactions correctly; PCI programs test how card data and PINs are protected. Most deployments need both.

Do I need to recertify when I change acquirer?

Plan for it. Level 3 covers the acquiring chain, including the acquirer host, so a new acquirer normally means a new L3 run.

How long does an EMVCo approval last?

Each Letter of Approval states its own terms, including any expiry date, and remains valid while its number is listed on the EMVCo website. Check the specific letter for the product you are buying.