or How Long does EMVCo certification take?

I had originally planned to talk about NFC project timelines in general, but the topic is too broad. Instead, I’m going to break it into multiple posts and today focus on EMVCo certification.

The area that generally presents the most surprise with customers is the timeline for EMVCo certification.  If you’re not familiar, EMVCo is a set of certifications required for payment terminals (those countertop units at merchants where you swipe, insert or tap your card), and payment devices (your phone, your watch, a credit card).  EMVCo was established to ensure compatibility and a good customer experience when performing a transaction, in other words, paying with a credit card, phone or watch should be fast and easy.  EMVCo is specific to chip-card and contactless transactions, magnetic stripe does not require EMVCo certification.  However, don’t think you’ll get in the market by just accepting magnetic stripe.  Due to fraud and severe lack of security, magnetic stripe is going away and the card brands are pushing it out as an accepted way to process a transaction.  Besides, you do want your product to be able to process transactions via ApplePay and Google Wallet and that means you need contactless, which is the focus here.

A payment terminal can have any combination of interfaces: contactless only, contact only, or contactless and contact (and magnetic stripe can also be added as a back up).

What are the certifications?

There are two certification tracks for payment terminals, one track for each interface type:

• Contact / Chip-card
• Contactless

Both interfaces have two certification levels required

• Level 1 (L1) – communication with the card
• Level 2 (L2) – card transaction processing – what data to read from the card and how to deal with it

A terminal must pass all certifications required for EACH interface, so if you have contact and contactless, you have to do L1 and L2 for each.  Contactless is the most complex and takes the longest time, as much as 6 months or more, just for the certification testing.

L1 certification testing is to ensure that the terminal is correctly communicating with the card, including providing a strong enough RF field to read the card at up to 4cm distance (again, to ensure a good user experience).  Additionally, other RF field parameters are measured, there is a test case to check for the presence of the contactless payment logo, so a user knows where to tap, and there are tests to make sure the communication process itself is done correctly.  The focus is to ensure the card is correctly detected, that communication is reliable and that the card is not processed more than one time in a single tap.

How much time does L1 certification require?

The actual certification testing is only a couple of days, but, in an ideal situation, one should plan two to four weeks for the whole process.  This includes an initial debug session where the performance is verified and any issues can quickly be addressed, the certification testing itself, know as Type Approval (TA), report writing, submission of the report and lastly, receiving the Letter of Acceptance (LoA).

Once L1 is complete, you can transition to L2.  L1 and L2 cannot be done in parallel.  The L1 LoA is a pre-condition to starting the L2 certification testing.  That’s not to say L2 validation testing should be ignored until L1 is complete.  Quite the contrary, validation testing should being early.

How much time does L2 certification require?

L2 is much more complex, both from a testing standpoint and from a scheduling standpoint. At the very minimum certification testing will take, 2-3 months, at the upper end, 4-6 months. How does that break down?

For contactless L2, each card brand (Amex, Discover, Visa, Mastercard, et. al.) has its own L2 certification requirements and testing.  Your product must be certified for each card brand your product will be able to support.  This means you may need certification for up to four or more card brands.  Each certification is different and has different requirements and testing.  Even though each brand is different, the purpose for each is the same.  The L2 testing ensures that the correct data is read from the card and that it is processed correctly, according to the card brands’ specifications. In general, one should plan the following:

• Mastercard – 6-8 weeks
• Visa – 4-6 weeks
• Other – 3-6 weeks

You might ask if the different card brands can be certified in parallel.  That’s a great question, and the answer is a definite maybe.  It comes down to working with the certification labs and identifying their availability.  There are certain times of the year when availability is very limited.  Additionally, even though a lab may be able to test all the brands, one specific location may have limited resources or approval for certain card brands and the lab will have to coordinate with their other locations to handle the testing and scheduling.  Close communication and coordination with the certification labs is critical to be able to complete the certification process in the shortest possible time.

What are the pitfalls?

L1 pitfalls

WEEKS of debug and THOUSANDS of dollars.

I’ve worked with the certification labs for many years and have many stories.  Starting with the L1 debug session I mentioned earlier.  Ideally, this is a single pass (2 – 3 days) through all of the certification tests to ensure that it WILL pass the formal Type Approval (TA) certification process.  The debug is done at the certification lab, using the same type of equipment used for the formal TA.  I’ve been told stories of companies that were unprepared and didn’t understand what they were getting in to, submitting a device for TA, with or without debug time and only passing 10%-15% of the tests on the first try. This can lead to WEEKS of iteration, fixing issues and rerunning debug tests until they achieve 100% pass rate.  This is THOUSANDS of dollars worth of testing time.  In the worst case, it can require a complete redesign of an antenna and/or product.

Ingenutec can make sure that your debug session achieves a 95-100% pass rate on the first try, saving both time and money.  We do this by working with you early in the design process to ensure you’re using best practices and design guidelines.  We know where the high risk areas are and address them early.  We run in-house tests and address performance issues immediately.  By the time the product is nearing time for certification, all that remains to be prepared for the debug session is some final tuning and refinement.

L2 pitfalls

The same debug issues and possibly RECERTIFICATION of L1

In describing the certification process, I clearly stated that L1 certification must happen before L2 can be started.  However as I mentioned, this does NOT apply to validation testing and debug sessions.  To the inexperienced product developer, if they waited until L1 were complete before even beginning debug testing of their L2, they might encounter a situation that would require hardware changes to pass L2, but those hardware changes would invalidate their L1 LoA and require a re-certification. This is a heavy expense to bear.  Ingenutec understands, not only the certification processes, but also the testing requirements, what should be validated and when.  We recognize that those L2 tests that could require hardware changes should be performed at the same time as the L1 debug testing.  This approach moves ALL hardware related testing to the front of the process,  ensuring that L2 won’t impact your product’s L1 LoA.

Ingenutec works with a well established L2 kernel provider.  They have hundreds of their kernel implementation certified by their customers.  We work closely with this kernel provider to ensure that the firmware is correctly integrated.  We have the ability to run the same tests that the certification labs can run and ensure that, if any L2 firmware issues arise, they can be addressed before going to the lab for certification.  We can be highly confident that the L2 certification will pass on the first attempt, while using minimal lab debug time.

So how long does it take?

If all goes well, assuming the 4 common US card brands, plan on six months. This may be much longer than you expected, but that’s the point of my message, to set your expectation.  Of course, without the proper preparation, a few unexpected issues could cause the certification time to drag out to 9, 12 or even 18 months, costing you time and money.  We’re able to ensure that you are prepared.

That’s just for Contactless EMVCo certification.  If your product has a Contact interface, that’s another set of certification tests and processes.  Don’t forget PCI and FCC Part 15 along with any other that are required for your product and market.  We’ll cover the payment and NFC related certifications in future posts.