A payment terminal that reads chip cards passes three separate approvals before it can take real payments. Each level looks at a different layer, is tested by a different party, and produces its own evidence. They are done in order: a Level 2 approval refers to the Level 1 approval of the reader it runs on, and Level 3 testing assumes both.
| Level | What is tested | Who tests | What you get |
|---|---|---|---|
| Level 1 | The card reader hardware and the low-level protocols: electrical signals, timing, the answer to reset, T=0 / T=1, and for contactless the radio field, modulation, anticollision and the ISO 14443 block protocol | An EMVCo-accredited laboratory | An EMVCo Level 1 approval for the interface module (contact IFM, contactless PCD) |
| Level 2 | The EMV kernel: the software that runs the transaction with the card — selection, data, offline data authentication, CVM, risk management, action analysis, cryptograms, scripts | An EMVCo-accredited laboratory, with an approved test tool | An EMVCo Level 2 approval for the kernel in a stated configuration |
| Level 3 | The terminal as integrated in the payment environment: the payment application, its configuration per brand, the messages to the acquirer, receipts, exceptions | The acquirer or a brand-qualified test service, with the brands' test cards and tools | A brand approval or acquirer sign-off to deploy, per payment system |