Contactless Payments on COTS (CPoC)

What it is

PCI SSC's own scope statement: "This standard offers security requirements for solutions that enable a merchant's commercial off-the-shelf (COTS) device (for example, phone or tablet) to accept contactless payments without the need for an external contactless reader by leveraging the native NFC capabilities inherent to a COTS device."

The current version is 1.0, last updated 2019-12-01, per PCI SSC's own document-library data — no later version was found.

PCI SSC has announced a formal sunset period for this standard from 1 May to 31 October 2026 — see the sunset note on this record.

Who owns it

The standard is owned and published by the PCI Security Standards Council (PCI SSC).

Who assesses it

PCI SSC uses the same laboratory-evaluation model as MPoC and SPoC: "PCI-Recognized CPoC Laboratories" evaluate solutions against the standard, rather than the QSA model used for PCI DSS.

Who asks for it

Voluntary. PCI SSC's own page states: "Compliance programs for all PCI SSC standards are managed by the payment brands. Questions about which entities need to validate compliance to any PCI SSC standard, or whether use of a PCI-listed product is required and for which entities, should be referred to the payment brands." PCI SSC itself imposes no mandate on any entity.

PCI SSC's own page states: "Compliance programs for all PCI SSC standards are managed by the payment brands. Questions about which entities need to validate compliance to any PCI SSC standard, or whether use of a PCI-listed product is required and for which entities, should be referred to the payment brands." PCI SSC itself names no universal requirement.