In the rapidly evolving digital payment ecosystem, the role of security and compliance has never been more critical. With the growth in card-based transactions and contactless payments organizations that develop payment terminals, point-of-sale (POS) systems and card readers must adhere to global security standards. One of the most vital compliance benchmarks is EMV Level 2 certification. This certification ensures that payment applications can securely and correctly process transactions using EMV cards, whether via contact or contactless interfaces.
EazyPay Tech supports global OEMs, payment terminal manufacturers, banks and fintech companies by offering robust EMV Kernels and EMV software designed to meet stringent EMV Level 2 requirements.
Key Objectives of Level 2 Kernel Testing
1. Ensure EMV Compliance and Interoperability
- Level 2 kernel testing aims to validate that the EMV software strictly adheres to the specifications defined by EMVCo, ensuring that it can successfully interoperate with a wide range of EMV-compliant cards, terminals and acquiring systems in both domestic and international markets.
- This objective guarantees that the kernel logic functions as intended in all certified environments, reducing interoperability issues and transaction failures.
2. Certify Kernel Functionality Across All Scenarios
- The kernel must be tested to ensure it supports all mandatory EMV transaction flows and is also capable of handling a broad range of optional processing scenarios, including offline approvals, online authorizations and issuer authentication steps.
- It should demonstrate robust handling of various transaction types under different conditions, including fallback, decline and recovery situations, thereby simulating real-world card-present payment flows.
3. Verify Terminal Card Communication Accuracy
- Testing ensures the EMV kernel handles APDU (Application Protocol Data Unit) command and response exchanges correctly between the terminal and the smart card, using proper data formats, response codes and error handling routines.
- This objective verifies the accuracy of ISO 7816 (for contact) and ISO 14443 (for contactless) protocol compliance and helps prevent miscommunication between the terminal and card that could otherwise lead to transaction rejections or data corruption.
4. Meet Global Brand Certification Requirements
- The Level 2 kernel must satisfy all compliance checkpoints defined by global payment schemes such as Visa, Mastercard, American Express, Discover, RuPay and others, including their brand-specific rules for CVM support, AID handling and transaction sequencing.
- Successful L2 testing ensures that the kernel is ready for subsequent Level 3 testing and that it can support scheme certification workflows in multiple geographies without requiring major modifications.
5. Enhance Security and Fraud Prevention
- The EMV kernel must implement strong card authentication mechanisms such as Static Data Authentication (SDA), Dynamic Data Authentication (DDA) and Combined DDA with Application Cryptogram (CDA), all of which are tested during the L2 process.
- Additionally, the kernel is expected to enforce terminal-based risk management strategies like velocity checks, transaction floor limits and Terminal Action Codes (TAC), which help prevent card cloning, replay attacks and offline fraud.
6. Test for Performance, Latency and Efficiency
- Testing includes evaluating the kernel’s transaction processing speed, memory usage and overall responsiveness on the terminal’s hardware and OS, especially under resource-constrained environments such as embedded systems or SoftPOS platforms.
- This ensures that payment experiences remain fast and frictionless even in high-volume retail, transportation or quick-service merchant settings, where latency directly impacts customer satisfaction.
7. Support for Multiple Applications and AIDs
- The kernel must be tested for its capability to detect, prioritize and correctly select the appropriate Application Identifier (AID) when multiple applications are present on the card, such as debit, credit or loyalty programs.
- This also includes verifying support for Payment System Environment (PSE) and Proximity Payment System Environment (PPSE) mechanisms, which facilitate the user-friendly display and selection of applications.
8. Ensure Portability and OS Compatibility
- The kernel should be designed and tested to operate consistently across different hardware architectures (ARM, x86, etc.) and operating systems (Android, Linux, RTOS), maintaining consistent behavior and compliance outcomes.
- Portability ensures that vendors can reuse the same certified kernel across multiple devices and product lines, reducing development time and simplifying global rollouts.
9. Achieve EMVCo Type Approval
- The EMVCo Type Approval process requires the kernel to undergo testing in an accredited laboratory using official EMV test tools, where it must successfully pass all mandatory and optional test cases for both functional and protocol compliance.
- Passing this certification is essential for manufacturers and solution providers seeking to sell their payment terminals or integrate EMV software in regulated markets.
10. Facilitate Rapid Integration with POS Applications
- The kernel should expose a clean, modular and well-documented set of APIs that allow terminal application developers to easily integrate payment processing logic without needing to understand or modify the low-level EMV logic.
- This ease of integration accelerates development timelines and minimizes bugs or errors that could arise during terminal certification and deployment.
11. Comply with Contact and Contactless Protocols
- The kernel must be tested for compatibility with both contact-based (via chip cards using ISO/IEC 7816) and contactless interfaces (via NFC and ISO/IEC 14443) to accommodate modern cardholder preferences for Tap-to-Pay and mobile payments.
- This dual-interface compliance ensures that the payment device remains versatile and future-ready, especially in regions transitioning toward contactless-first ecosystems.
12. Meet Acquirer and Local Regulatory Requirements
- The kernel must demonstrate flexibility to conform with acquiring banks custom parameters, country-specific transaction rules and local regulations that may impact offline limits, CVM enforcement or terminal configuration.
- This includes support for local card schemes (e.g., RuPay in India, Troy in Turkey, Interac in Canada) and unique acquirer profiles that dictate how the kernel should behave in a regional context.
13. Enable Customization and Future-Proofing
- A key objective is to ensure that the kernel is modular and adaptable, enabling vendors to implement custom features such as loyalty programs, transit payments, value-added services or OTA (Over-the-Air) kernel updates, without losing EMV compliance.
- Future proofing also includes supporting new EMVCo specifications and rapid updates for upcoming payment regulations or scheme mandates, such as Tap on Mobile, biometric CVMs or tokenized transactions.
Contact Kernel Testing Step
Step 1: Terminal Initialization
This Step evaluates how the kernel initializes terminal parameters such as Application Identifiers (AIDs), Certification Authority Public Keys (CAPKs), floor limits, terminal capabilities and risk parameters. The testing ensures that the kernel correctly reads, validates and stores these configurations, even when files are incomplete, corrupted or include optional fields. It confirms that the kernel behavior remains predictable and functional under all initialization conditions.
Step 2: Application Selection
During this phase, the test verifies how the kernel builds the candidate list of available applications from the card and selects the most appropriate one based on terminal configuration, card priority and scheme preferences. It simulates scenarios with multiple AIDs, conflicting priority indicators and unsupported applications to ensure that the kernel handles selection logic and fallbacks correctly, as defined by EMV specifications.
Step 3: Processing Restrictions
The kernel is tested for its ability to apply card usage rules based on criteria like expiration date, country-specific restrictions and service code limitations.
This Step confirms that the kernel can block transactions when the card has expired, restricted for specific use cases (e.g., ATM-only) or presents an invalid status while still allowing legitimate transactions to proceed without false rejections.
Step 4: Cardholder Verification Methods (CVM)
This segment assesses the kernel’s handling of various CVM options such as offline PIN, online PIN, signature or no CVM required.
Tests include complex flows such as partial PIN attempts (where offline PIN fails and online PIN is required), blocked PIN entries and CVM fallback rules.
The kernel must apply the correct CVM rules for each transaction and record the results in the final outcome.
Step 5: Terminal Risk Management
In this Step , the kernel’s capability to enforce risk management policies is thoroughly examined. This includes applying floor limits, performing random transaction selections and checking exception file contents.
The test verifies that the terminal correctly identifies low-risk transactions that can be approved offline and high-risk cases that must be escalated to online authorization or be declined altogether.
Step 6: Terminal Action Analysis
This test phase confirms that the terminal correctly analyzes all data collected during earlier stages such as card risk flags, CVM results and terminal risk assessment and derives a logical action outcome.
Whether the transaction is approved offline, sent online for authorization or declined locally, the decision must align with the predefined terminal action codes and transaction flow rules.
Step 7: Online Processing
The kernel is evaluated on how it initiates and handles online authorization requests. This includes the formatting of Authorization Request Cryptograms (ARQCs), inclusion of proper data elements and handling of issuer responses such as approvals, declines or partial authorizations.
The kernel must also manage communication errors, timeouts and cardholder messaging in a secure and user-friendly manner.
Step 8: Issuer-to-Card Script Processing
This Step verifies that the kernel can process issuer scripts returned during online authorizations.
These scripts may contain instructions for updating card parameters, changing security keys or controlling future transaction behavior.
The test ensures scripts are correctly parsed, validated and executed in sequence without compromising transaction integrity or security.
Step 9: Outcome Processing
Finally, this test Step ensures that the kernel compiles and presents the correct transaction outcome both in data and in user-facing messages.
It validates that CVM results, cryptographic decisions and issuer instructions are reflected in the final APDUs and that all logs, receipts and status codes accurately represent the transaction’s conclusion.
Contactless Kernel Testing Steps
Visa Contactless (VCPS)
This testing suite validates the kernel’s handling of Visa’s contactless specifications, including pre-processing of the candidate list, data element formatting andCAPK validation.
Special emphasis is placed on correct terminal behavior during low-value, no-CVM transactions and how the kernel enforces Visa-specific risk management rules. Fallback to contact or magstripe is also evaluated to ensure seamless recovery from contactless failures.
Mastercard Contactless (MCL/PayPass)
The Mastercard test suite places particular focus on the Transaction-Outcome Reuse Notification (TORN) mechanism.
The kernel must correctly identify incomplete or interrupted transactions and reprocess them without duplicating authorizations. It must also correctly apply CVM policies based on transaction amount thresholds and process cryptographic authentication flows (SDA, DDA, CDA) under varying conditions.
RuPay Contactless (qSPARC)
This Step emphasizes domestic use cases, such as transport fare systems, with frequent use of no-CVM, tap-and-go payments. The test cases evaluate how the kernel handles fast, low-value transactions, card reloads and CVM escalations based on cumulative amounts.
It also verifies that the kernel adheres to Indian standards for Common Mobility Card implementations, including tag mapping and file handling.
American Express Contactless (AEIPS/Expresspay)
AEIPS certification involves verifying that the terminal supports AmEx-specific CVM sequences and data formats.
This includes signature-only flows, combined CVM fallbacks and support for issuer-specific outcome messages. The test also validates the presence of required tags, proper outcome display and correct cryptographic flows.
Discover Contactless (D‑PAS)
The D‑PAS test suite examines the kernel’s implementation of Discover-specific authentication and risk management logic.
It verifies data formats, tag encoding, profile activation and proper outcome determination. Emphasis is placed on handling exceptions, alternate profiles and accurate transaction logs for later auditing.
JCB Contactless (J/Speedy)
For JCB, the kernel is tested under high-speed transaction conditions with tight timing windows. It must handle rapid tag exchanges, short APDU sequences and multiple JCB application profiles.
Fallback handling, timing thresholds and user messaging are evaluated to ensure a smooth experience for JCB cardholders.
EazyPay Tech is a trusted provider of EMV Kernels, EMV Software solutions and certification assistance. With vast experience in supporting contact and contactless certifications across card brands and geographies, EazyPay Tech empowers OEMs, acquirers and terminal vendors to launch secure, compliant and market-ready solutions.
By partnering with EazyPay Tech, businesses gain access to:
- Ready-to-integrate EMV Level 2 Kernels
- Documentation and integration toolkits
- Technical support throughout certification
- Pre-certification audits
- Long-term maintenance and update plans
Achieving EMV Level 2 certification is not just a regulatory requirement it is a strategic imperative for secure transaction processing. From detailed test cases to integration guidance and lab certification, the process is multi-phased and complex. However, with the right partner like EazyPay Tech, your organization can streamline development, ensure compliance and stay ahead in the competitive payments industry.
Leverage the power of certified EMV Kernel and software solutions today to build trust, ensure compliance and accelerate time to market.