Transaction

TransactionSecurity
Security

Mastercard CPV Customer Guide

June 2017 v1.1
UL Transaction Security
UL Transaction Security stands for one or more of the following entities: UL TS B.V. (Leiden,
Netherlands), UL VS Ltd (Basingstoke, UK), UL Transaction Security Pty Ltd (Melbourne,
Australia), UL Transaction Security Ltd (Edinburgh, UK), UL TS Pte Ltd (Singapore), UL TS Inc
(St. Paul, MN, USA), UL TS FZE (Dubai, UAE)

For contact details, please see: www.ul-ts.com

© 2017 UL All rights reserved. May not be copied or distributed without permission.
Table of Contents
1 INTRODUCTION .............................................................................................................. 4
2 THE CPV PROCESS ....................................................................................................... 5
3 SAMPLE SUBMISSION CPV SERVICE ......................................................................... 6
3.1 Process steps ................................................................................................................... 6
3.2 Available CPV Sample Submission Services ................................................................... 8
3.3 Additional iterations .......................................................................................................... 8
3.4 Pricing structure for Sample Submission CPV ................................................................. 9
4 CHANGE NOTIFICATION SUBMISSION ..................................................................... 10
4.1 Process steps ................................................................................................................. 10
4.2 Pricing structure for Change Notification Submission .................................................... 11
5 HIGH PRIORITY CPV FORMAL APPROVAL SERVICES ........................................... 12
6 CPV SUPPORT .............................................................................................................. 13
A.1 LOCAL OFFICES FOR CPV ......................................................................................... 14

Final 3/14 June 2017 v1.1

 Mastercard CPV Customer Guide, June 2017

1 Introduction
A good preparation is essential for a successful Mastercard Formal Approval step. UL
Transaction Security (UL TS) can be your partner throughout the full process: from definition, via
vendor selection and technical consultancy to testing and certification. UL TS also can deliver the
required test tools for Mastercard card issuing and provide training courses. The Mastercard
Formal Approval Services is one of services UL TS offers to Acquirers and Issuers.

Mastercard imposes issuers introducing a new EMV contact or contactless cardholder devices
(any form factors, including mobile implementation) to go through Card Personalization Validation
(CPV) Formal Approval Services of Mastercard. This process is required for issuers to obtain an
approval, i.e. CPV or CNS Report, indicating that the card or device is Mastercard approved. The
main purpose is to make sure the card products carrying Mastercard brands meet the minimum
quality and interoperability requirements specified by Mastercard.

UL has been accredited by Mastercard as a Mastercard Formal Approval Service Provider.

Together with Mastercard qualified testing/certification tools, UL is offering a modulated service
which covers the entire scope to ensure an efficient and effective approval process. This
Customer Guide describes the process and the steps to complete a CPV.

The pricing structure of the service can be found in the CPV UL Order Form. Please contact
ul.ts.cpv@ul.com or your sales contact at UL for the latest version of the order form.

Key Benefits of UL
The extensive experience and in-depth knowledge of 20 years in the area of chip / payment
technology and personalization processes allow. UL TS to support you through the entire Formal
Approval Process, not only by performing the CPV Service, but also through on-site services,
card profile definition, assistance during I-ETED Self-Service, support via telephone and e-mail.
This increases the quality of your product and reduces the time spent for validation, bringing your
product faster on the market.

Covering the complete process and procedures, we can offer you one-stop shopping to
implement your new card product or mobile device, payment terminal or ATM successfully.

Status: Final 4/14 Version: June 2017 v1.1

 Mastercard CPV Customer Guide, June 2017

2 The CPV process

As described in the Mastercard document Card Personalization Validation (in the following “CPV
Guide”), the Card Personalization Validation (CPV) process starts with Issuer Preliminary
Assessment, when you decide what type of service you want to be delivered by UL:
• either Sample Submission, where you submit samples for testing,
• or Change Notification Submission (CNS), where you submit a profile change for
assessment.

When to do a CNS?
The Change Notification Submission process enables issuers to provide UL with a list of changes
they intend to apply to an existing product and to request an assessment of these changes in
order to allow issuing.

The CPV Guide issued by Mastercard explains in which cases a CNS is allowed. The Appendix
of that document describes the impact of changes to each data package (a group of elements or
tags that are functionally related and have similar CPV validation requirements).

For example, adding a BIN to the BIN range, changing the chip product, or changing the values
of certain data elements could be consider a minor change and therefore accepted via the CNS
process. In case the proposed change is considered major, a Sample Submission is required.

See Chapter 4 for more information on the steps to take for the CNS process.

When to do a Sample Submission?

In those cases when a CNS is not applicable, a Sample Submission process is required. For
example, changing personalization bureaus, switching from contact to a dual interface chip
products, altering certain data elements in the personalization profile could be considered a major
change. Issuance of a completely new card profile also requires Sample Submission.

See Chapter 3 for more information on the steps to take for the CPV process.

Status: Final 5/14 Version: June 2017 v1.1

 Mastercard CPV Customer Guide, June 2017

3 Sample Submission CPV Service

3.1 Process steps
In case your card, mobile product or any other EMV form factor has never been approved before
during CPV, or the change to an existing approved product does not meet the requirements for
Change Notification Submission (see chapter 4), you have to initiate the Sample Submission
process.

During this process, you personalize a card sample, wearable or a secure element within the
mobile device and submit it to UL who tests it for conformance with the appropriate
personalization specifications. UL will guide you through the process and inform you about the
status of the CPV submission regularly. You will receive a CPV Report as a formal record of the
result of the CPV Test, whether successful or not.

The CPV Sample Submission CPV Service consists of five steps, as depicted in Figure 1.

Figure 1 Steps of the CPV Sample Submission Service. The steps indicated in red are to
be taken by the customer, the ‘blue’ steps are done by UL.

Each single step of Figure 1 will be explained in more details on the following pages.

Status: Final 6/14 Version: June 2017 v1.1

Mastercard CPV Customer Guide, June 2017

Step 1: Submission of SSF or MCA form

Please complete the SSF/MCA form and send the document to UL via email
ul.ts.cpv@ul.com. This form you can download the CPV Sample
Submission Form (SSF) or M/Chip Advance Profile Generator (MCA) from
Mastercard Connect, or request the latest version via UL.
In the SSF form you may indicate whether you want to have the profile as
completed in the SSF reviewed by UL (not available in MCA). This service
is called Paper Review, see Step 2 for more details.
Step 2: Paper Review (optional)
As part of Sample Submission, you can opt for the Paper Review.
Paper Review is validation of personalization data provided in the Sample
Submission Form, prior to validation of the actual card samples. This will
help you to find deviations from the appropriate Mastercard specifications
in an early stage of your personalization process, i.e. before the cardholder
device is personalized.
You can order Paper Review by ticking the checkbox in the SSF form and
by indicating this in the UL order form. The SSF form has to be completed
for each application supported by the final product.
Note for mobile and M/Chip Advance products, Paper Review is not offered
due to the nature of the profile definition process with Mastercard.
Step 3: Submission of Card Image / Sample
After the settings of the profile are defined (and, if chosen, validated by an
optional Paper Review), you can start the personalization of the physical
card sample or secure element within the mobile device.
To proceed with the CPV service, please submit the card sample to UL for
validation. This is a mandatory step for the CPV service.
For efficiency purposes we recommend you to send us your test samples
directly to the local address as specified in the CPV order form for your
region. If you expect a delay in shipment of the physical sample, you may
send an image in XML format first. You can extract the XML card image
from the sample by using a Qualified CPV Test Tool, e.g. UL
Personalization Validation Tool and submit it to ul.ts.cpv@ul.com.
Note in case of a mobile device Mastercard allows for sending only the XML
image(s) of the test sample instead of the mobile device itself.
Upon receipt of the card sample or XML image, UL CPV Team will send
you a confirmation email.

Step 4: Validation of Card Sample

UL CPV Team will start the validation of the card sample or XML image for
conformance with the appropriate personalization specifications.

Status: Final 7/14 Version: June 2017 v1.1

 Mastercard CPV Customer Guide, June 2017

During the validation, UL CPV Team will keep you informed about the
progress and current status of your submission.

Step 5: Delivery of final CPV Report

Upon successful outcome of card sample validation, a CPV Report will be

generated and sent for signature to Mastercard. You will receive the final
CPV Report signed by Mastercard from UL.
In case of any issues found in the validated profile, UL CPV Team will send
you a CPV Report, indicating the applicable errors and warnings. This
enables you to update the profile settings of your card or mobile device and
submit it to UL for the next iteration, as described in section 3.3.

3.2 Available CPV Sample Submission Services

Within the CPV Sample Submission Formal Approval Services, several flavours of the services
are available:
• CPV Sample Submission for Standard Profile
A CPV based on a Standard Profile (as defined in the most recent Mastercard M/Chip Card
Personalization Data Standard Profiles document). SSF technical review of the
personalization data in the Sample Submission Form for Standard Profile is not having an
added value, since the values of the data elements have been defined by Mastercard and
any deviation to the values defined makes the profile Non-Standard.
• CPV Sample Submission for Non-Standard Profile
A regular CPV Sample Submission not based on a Standard Profile as defined by
Mastercard. Non-Standard Profile applies for both M/Chip Advance and none M/Chip
Advance products.
• SSF Paper Review for Non-Standard Profile
As part of Sample Submission, you can opt for the Personalization Setting Review. This
option allows you to validate your personalization profile/parameters on paper before
personalizing a Sample.
• CPV Sample Submission for Non-Standard Profile, including pre-validation support
During pre-validation support Technical team will provide you technical support with initiation
of the project or chosen profile. Additional support can be ordered separately if required.
• CPV for Mobile
CPV Sample Submission for NFC-enabled mobile phones.
• Additional technical support
Technical support during and after initiation of the project. Our technical team will guide you
through the CPV or CNS process and will help you to analyse issues and find best possible
solutions.Note that for mobile, and M/Chip Advance products, a paper review is not offered
due to the nature of the profile definition process with Mastercard.

3.3 Additional iterations

Via the CPV Formal Approval Service, UL determines if your product has met the requirements
of the CPV service, which includes the specifications of Mastercard. Failure of any tests included

Status: Final 8/14 Version: June 2017 v1.1

 Mastercard CPV Customer Guide, June 2017

in the CPV requires a new iteration. In case the first (or any later) iteration of a CPV Formal
Approval is not successful, you need to go through an additional iteration of the CPV by updating
your personalization settings as indicated in the CPV Report and sending a new card sample or
mobile device (or image of the mobile device profiles). UL will inform you of the need for a new
iteration prior to starting it. Additional iterations will be invoiced according to the UL CPV order
form.

3.4 Pricing structure for Sample Submission CPV

The pricing structure for CPV services is as follows.
A Sample submission fee is composed of (at least) two things, i.e.:
• Base fee, which is applicable to all CPV Sample Submission services (not for Change
Notification services).
• Profile fee. This fee is charged per profile/application per iteration per interface. For mobile
the fee also applies per mode of operation of the application (payment mode or management
mode, when supported). To give some examples:

Profile(s)
Application(s) via Application(s) via
Type of device per
contact interface contactless interface
iteration
Sticker or Single interface
- 1. Contactless Magstripe 1
card
1. Maestro
Single interface card 2. PLA/CAP stand- - 2
alone
Dual interface card 1. Mastercard 1. Mastercard Contactless 2
1. Maestro
Dual interface card 2. PLA/CAP stand- 1. Maestro Contactless 3
alone
1. Contactless Magstripe via
Payment mode (in case
Mobile phone - 1
management mode is not
supported)
1. Mastercard Contactless
(M/Chip) via Management
mode
Mobile phone - 2
2. Mastercard Contactless
(M/Chip) via Payment
mode

The fees for CPV services are given in the latest Order Form document. Please contact our sales
representative or send an email to ul.ts.cpv@ul.com.

Status: Final 9/14 Version: June 2017 v1.1

 Mastercard CPV Customer Guide, June 2017

4 Change Notification Submission

4.1 Process steps
If you as an issuer/perso bureau/MSP are deriving your changes
from an existing CPV-approved card product, you can select to do a
Change Notification Submission. Note that the changes you are
making must be ‘Minor’. The criteria to be met for changes to be
considered as minor can be found in the most recent version of the
Mastercard CPV Guide.

This Change Notification Submission (CNS) process consists of the following major steps, see
Figure 2:

Figure 2 Change Notification Submission (CNS) process steps. The step indicated in red is to
be taken by the customer, the ‘blue’ steps are done by UL.

Step 1: Submission Change Notification Form

To initiate a Change Notification Submission (CNS) service, please
complete a CNS Form and send it to UL via email ul.ts.cpv@ul.com
together with all supporting evidence as defined in the CNS form and UL
order form. A CNS Form can be downloaded from Mastercard Connect
website or requested via UL.
The criteria to be met for a CNS can be found in the most recent version
of the Mastercard CPV Guide.
Note: there is no need to send a physical card sample during a CNS.
However, in some cases an xml card image will be requested.

Status: Final 10/14 Version: June 2017 v1.1

 Mastercard CPV Customer Guide, June 2017

Step 2: Analysis of requested Change

The CPV Technical Team will start analysis of the requested change for
conformance with the appropriate specifications and (local) rules of
Mastercard.
During the analysis, the Technical Team will keep you informed about the
status of the service. If more information is required to perform the analysis,
you will be requested to provide this missing information.
Step 3: Delivery of final Decision
In case the requested change conforms the rules and specifications of
Mastercard, the Technical Team will inform you about the successful
outcome of the CNS and provide you with the formal CNS report.
In case the requested change does not conform the rules and specifications
of Mastercard, the Technical Team will inform you that the CNS is not
accepted and provide the details in the CNS report. In that case, you can
either send a new CNS request or initiate a Sample Submission CPV
service as defined in section 3.
Step 4: Notification to Mastercard

UL will communicate the requested change to Mastercard together with the

final decision.

4.2 Pricing structure for Change Notification Submission

The pricing fee for CPV Change Notification Submission services is given in the latest Order
Form document.

Please contact our sales representative or send an email to ul.ts.cpv@ul.com.

Status: Final 11/14 Version: June 2017 v1.1

 Mastercard CPV Customer Guide, June 2017

5 High priority CPV Formal Approval Services

In certain cases, you may prefer the CPV Formal Approval Service to be delivered with high
priority. High priority means that the service is delivered in a guaranteed shorter time frame
compared to the standard maximum delivery time. This duration represents the time UL spends
to deliver the service; possible time required for Mastercard support is excluded. Please note that
Mastercard has 48 business hours to respond to UL on each support request regarding the CPV
service.

In case only an additional iteration of the service is ordered as high-priority, only the fee for the
additional iteration will be charged as high priority.

For CNS and Mobile CPV, high priority service is not offered.

Please contact your UL contact person for more information about the high
priority CPV.

Status: Final 12/14 Version: June 2017 v1.1

 Mastercard CPV Customer Guide, June 2017

6 CPV Support
During or prior to the CPV/CNS service, you might want to have access to the latest chip
expertise, e.g. to find out about the applicable regional rules and mandates, or about allowed
settings in the profile for your chip product. In addition, you might seek for the details on why
certain warnings or error appear in the CPV Report issued for your product. We are happy to
provide you with our support for all technical questions related to your product certification. For
more details on the pricing, please refer to the field “Customer Support upon initiation of or during
service” in the Order Form document and your regional sales representative.

Status: Final 13/14 Version: June 2017 v1.1

 Mastercard CPV Customer Guide, June 2017

A.1 Local offices for CPV

For Europe, Middle East and Africa:

UL, Transaction Security division

Attn: Mastercard FAS Department
De Heyderweg 2
2314 XZ LEIDEN
The Netherlands

For North America and Canada:

UL VS Inc, Transaction Security division

Attn: Mastercard FAS Department
1945 The Exchange, Suite 200
Atlanta, GA 30339-2029
United States of America

For Asia and Pacific region:

UL, Transaction Security division

Attn: Mastercard FAS Department
1 Fusionopolis Walk
#10-01 Solaris South Tower
Singapore 138628
Singapore

For Latin America and Caribbean:

UL, Transaction Security division

Attn: Mastercard FAS Department
Av. Engenheiro Luis Carlos Berrini, 105, 24º Andar
Brooklin, 04571-010
São Paulo - SP
Brasil

Status: Final 14/14 Version: June 2017 v1.1