Book C-2 Kernel Specification

countries. EMV® Contactless Specifications for Payment Systems Book C-2 Kernel 2 Specification Version 2.12 May 2026 EMV® Contactless Specifications for Payment Systems Kernel 2 Specification v2.12

/ 347

countries.

Legal Notice

Unless the user has an applicable separate agreement with EMVCo or with the applicable payment system, any and all uses of these Specifications is subject to the terms and conditions of the EMVCo Terms of Use agreement available at www.emvco.com and the following supplemental terms and conditions. The license granted in the EMVCo Terms of Use specifically excludes (a) the right to disclose, distribute or publicly display these Specifications or otherwise make these Specifications available to any third party, and (b) the right to make, use, sell, offer for sale, or import any software or hardware that practices, in whole or in part, these Specifications. Further, EMVCo does not grant any right to use the Kernel Specifications to develop contactless payment applications designed for use on a Card (or components of such applications). As used in these supplemental terms and conditions, the term “Card” means a proximity integrated circuit card or other device containing an integrated circuit chip designed to facilitate contactless payment transactions. Additionally, a Card may include a contact interface and/or magnetic stripe used to facilitate payment transactions. To use the Specifications to develop contactless payment applications designed for use on a Card (or components of such applications), please contact the applicable payment system. To use the Specifications to develop or manufacture products, or in any other manner not provided in the EMVCo Terms of Use, please contact EMVCo. These Specifications are provided "AS IS" without warranties of any kind, and EMVCo neither assumes nor accepts any liability for any errors or omissions contained in these Specifications. EMVCO DISCLAIMS ALL REPRESENTATIONS AND WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON - INFRINGEMENT, AS TO THESE SPECIFICATIONS. EMVCo makes no representations or warranties with respect to intellectual property rights of any third parties in or in relation to the Specifications. EMVCo undertakes no responsibility to determine whether any implementation of these Specifications may violate, infringe, or otherwise exercise the patent, copyright, trademark, trade secret, know-how, or other intellectual property rights of third parties, and thus any person who implements any part of these Specifications should consult an intellectual property attorney before any such implementation. Without limiting the foregoing, the Specifications may provide for the use of public key encryption and other technology, which may be the subject matter of patents in several countries. Any party seeking to implement these Specifications is solely responsible for determining whether its activities require a license to any such technology, including for patents on public key encryption technology. EMVCo shall not be liable under any theory for any party's infringement of any intellectual property rights in connection with these Specifications. EMV® Contactless Specifications for Payment Systems Kernel 2 Specification v2.12

/ 347

countries. Revision Log – Version 2.12 The following changes have been made to Book C-2 since the publication of Version 2.11. Incorporated changes described in the following Specification Bulletin:

• Specification Bulletin No. 317: Mag-stripe Mode Implementation Option Deprecated
• Specification Bulletin No. 318: ERRD Time Measurement by PCD for Kernel 2
• Specification Bulletin No. 319: Update to Terminal Risk Management Data of Kernel 2 Other changes:
• Replaced On-device Cardholder Verification Method (OD-CVM) with Consumer Device Cardholder Verification Method (CDCVM)
• Marked unused bits in Terminal Verification Results as RFU in the data dictionary EMV® Contactless Specifications for Payment Systems Kernel 2 Specification v2.12 / 347 countries. Contents Revision Log – Version 2. 1. 1. 1. 1. 1. 1.5. 1.5. 1.5. 2. 2. 2.2. 2.2. 2.2. 2.2. 2.2. 2. 3. 3. 3. 3. 3.4. 3.4. 3.4. 3.4. 3. 3.5. 3.5. 3.5. 3. 3. EMV® Contactless Specifications for Payment Systems Kernel 2 Specification v2.12 Page v / 347 countries. 3.7. 3.7. 3. 3.8. 3.8. 3. 4. 4.1. 4.1. 4.1. 4.1. 4. 4. 4. 4.4. 4.4. 4.4. 4. 4.5. 4.5. 4.5. 4.5. 4. 4.6. 4.6. 4. 5. 5. 5.2. 5.2. 5.2. 5.2. 5. 5.3. 5.3. 5.3. 5.3. 5. EMV® Contactless Specifications for Payment Systems Kernel 2 Specification v2.12 / 347 countries. 5.4. 5.4. 5.4. 5.4. 5. 5.5. 5.5. 5.5. 5.5. 5. 5.6. 5.6. 5.6. 5.6. 5. 5.7. 5.7. 5.7. 5.7. 6. 6. 6.2. 6.2. 6.2. 6. 6.3. 6.3. 6.3. 6. 6.4. 6.4. 6.4. 6. 6.5. 6.5. 6.5. 6. 6.6. 6.6. EMV® Contactless Specifications for Payment Systems Kernel 2 Specification v2.12 / 347 countries. 6.6. 6. 6.7. 6.7. 6.7. 6. 6.8. 6.8. 6.8. 6. 6.9. 6.9. 6.9. 6. 6.10. 6.10. 6.10. 6. 6.11. 6.11. 6.11. 6. 6.12. 6.12. 6.12. 6. 6.13. 6.13. 6.13. 6. 6.14. 6.14. 6.14. 7. 7.1. 7.1. 7.1. 7. 7.2. EMV® Contactless Specifications for Payment Systems Kernel 2 Specification v2.12 / 347 countries. 7.2. 7.2. 7. 7.3. 7.3. 7.3. 7. 7.4. 7.4. 7.4. 8. 8. 8. A. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. EMV® Contactless Specifications for Payment Systems Kernel 2 Specification v2.12 / 347 countries. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. EMV® Contactless Specifications for Payment Systems Kernel 2 Specification v2.12 Page x / 347 countries. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. EMV® Contactless Specifications for Payment Systems Kernel 2 Specification v2.12 / 347 countries. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. EMV® Contactless Specifications for Payment Systems Kernel 2 Specification v2.12 / 347 countries. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A.1. A. B. B. EMV® Contactless Specifications for Payment Systems Kernel 2 Specification v2.12 / 347 countries. Figures Figure 1. Figure 2. Figure 2. Figure 2. Figure 3. Figure 6. Figure 6. Figure 6. Figure 6. Figure 6. Figure 6. Figure 6. Figure 6. Figure 6. Figure 6. Figure 6. Figure 6. Figure 6. Figure 7. Figure 7. Figure 7. Figure 7. EMV® Contactless Specifications for Payment Systems Kernel 2 Specification v2.12 / 347 countries. Tables Table 1. Table 1. Table 2. Table 2. Table 2. Table 2. Table 2. Table 2. Table 3. Table 3. Table 4. Table 4. Table 4. Table 4. Table 4. Table 4. Table 4. Table 5. Table 5. Table 5. Table 5. Table 5. Table 5. Table 5. Table 5. Table 5. Table 5. Table 5. Table 5. Table 5. Table 5. Table 5. Table 5. Table 5. Table 5. Table 5. Table 5. Table 5. Table 5. Table 5. Table 5. Table 5. Table 6. Table 6. EMV® Contactless Specifications for Payment Systems Kernel 2 Specification v2.12 / 347 countries. Table 6. Table 6. Table 6. Table 6. Table 6. EMV® Contactless Specifications for Payment Systems Kernel 2 Specification v2.12 / 347 countries. 1 Using This Manual 1.1

Purpose

This document, EMV Contactless Specifications for Payment Systems, Book C-2 – Kernel 2 Specification, should be read in conjunction with:

• EMV Contactless Specifications for Payment Systems, Book A – Architecture and General Requirements, hereafter referred to as [EMV Book A], and
• EMV Contactless Specifications for Payment Systems, Book B – Entry Point Specification, hereafter referred to as [EMV Book B]. This document defines the behaviour of the Kernel used in combination with cards supporting a Mastercard brand or cards having a Kernel Identifier indicating Kernel 2, as defined in [EMV Book B].

1.2 Audience This specification is intended for use by manufacturers of contactless readers and terminals. It may also be of interest to manufacturers of contactless cards and to financial institution staff responsible for implementing financial applications in contactless cards.

1.3 Related Information The following references are used in this document

The latest version applies unless a publication date is explicitly stated. Reference Document Title [EMV Book 1] Integrated Circuit Card Specifications for Payment Systems – Book 1, Application Independent ICC to Terminal Interface Requirements, Version 4.4, October 2022 [EMV Book 2] Integrated Circuit Card Specifications for Payment Systems – Book 2, Security and Key Management, Version 4.4, October 2022 [EMV Book 3] Integrated Circuit Card Specifications for Payment Systems – Book 3, Application Specification, Version 4.4, October 2022 [EMV Book 4] Integrated Circuit Card Specifications for Payment Systems – Book 4, Cardholder, Attendant, and Acquirer Interface Requirements, Version 4.4, October 2022 EMV® Contactless Specifications for Payment Systems Kernel 2 Specification v2.12

/ 347

countries. Reference Document Title [EMV Book A] EMV Contactless Specifications for Payment Systems, Book A – Architecture and General Requirements, Version 2.11 [EMV Book B] EMV Contactless Specifications for Payment Systems, Book B – Entry Point Specification, Version 2.11 [EMV CL L1] EMV Level 1 Specifications for Payment Systems, EMV Contactless Interface Specification, Version 3.2 [EMV Token] EMV Payment Tokenisation Specification, Technical Framework, Version 2.3, October 2021 [ISO 639-1] Codes for the representation of names of languages – Part 1: Alpha-2 Code [ISO 3166-1] Codes for the representation of names of countries and their subdivisions – Part 1: Country codes [ISO 4217] Codes for the representation of currencies and funds [ISO/IEC 7813] Information technology — Identification cards — Financial transaction cards [ISO/IEC 7816-4] Identification cards — Integrated circuit(s) cards with contacts — Part 4: Organization, security and commands for interchange [ISO/IEC 7816-5] Registration of application providers [ISO 8583:1987] Financial transaction card originated messages – Interchange message specifications [ISO 8583:1993] Financial transaction card originated messages – Interchange message specifications [ISO/IEC 8825-1] Specification of Basic Encoding Rules (BER), Canonical Encoding Rules (CER) and Distinguished Encoding Rules (DER) [ISO/IEC 8859] Information technology – 8-bit single-byte coded graphic character sets [ISO 18031:2005] Information technology – Security techniques – Random bit generation [NIST SP800-22A] A statistical test suite for random and pseudorandom number generators for cryptographic algorithms EMV® Contactless Specifications for Payment Systems Kernel 2 Specification v2.12

/ 347

countries.

1.4 Terminology The following terms are used in this document, carrying specialized meanings as indicated. Table 1.1: Terminology Term

Description

Card Card, as used in these specifications, is a consumer device supporting contactless transactions. Combination Combination is the combination of an AID and a Kernel ID. Configuration Option A Configuration Option allows activation or deactivation of the Kernel software behind this option. The Configuration Option may change the execution path of the software but it does not change the software itself. A Configuration Option is set in the Kernel database per AID and transaction type. EMV Mode Operating mode that indicates that the contactless payment transaction is validated based on EMV minimum data. Implementation Option An Implementation Option allows the vendor to select whether the functionality behind the option will be implemented in a particular installation. Kernel The Kernel contains the interface routines, security and control functions, and logic to manage a set of commands and responses to retrieve all the necessary data from the Card to complete a transaction. The Kernel processing covers the interaction with the Card between the selection of the card application (excluded) and the processing of the transaction's outcome (excluded). Mag-stripe Mode Mag-stripe Mode describes an operating mode of the POS System that indicates that this particular acceptance environment and acceptance rules support magnetic stripe infrastructure. Mag-stripe Mode transactions are no longer supported by this version of the specification. POS System The POS System is the collective term given to the payment infrastructure present at the merchant. It is made up of the Terminal and Reader. EMV® Contactless Specifications for Payment Systems Kernel 2 Specification v2.12

/ 347

countries. Term Description Process A Process is a logical component within a Reader that has one or more Queues to receive Signals. The processing of Signals, in combination with the carried data, may then generate other Signals to be sent. Processing can continue until all the Queues of a Process are empty, or until the Process terminates. Queue A Queue is a buffer that stores events to be processed. The events are stored in the order received. Reader The Reader is the device that supports the Kernel(s) and provides the contactless interface used by the Card. In this specification, the Reader is considered as a separate logical entity, although it can be an integral part of the POS System. Signal A Signal is an asynchronous event that is placed in a Queue. A Signal can convey data as parameters, and the data provided in this way is used in the processing of the Signal. Terminal The Terminal is the device that connects to the authorization and/or clearing network and that together with the Reader makes up the POS System. The Terminal and the Reader may exist in a single integrated device. However, in this specification, they are considered separate logical entities.

1.5 Notations This section lists notational conventions used in this specification:

1.5.1 State Machine This document specifies the Kernel processing as a state machine that is triggered by Signals that cause state transitions. The application states of the Kernel are written in a specific format to distinguish them from the text: state Example: GOTO s4 – waiting for read record response The state machine of the Kernel is represented by means of a state diagram (as shown in Figure B.1). EMV® Contactless Specifications for Payment Systems Kernel 2 Specification v2.12

/ 347

countries. This document uses a combination of flow diagrams and textual description in order to describe the state transitions in the state machine of the Kernel. Figure 1.1 shows the symbols used in the flow diagrams. Figure 1.1: Symbols Used in Transaction Flow Diagrams The combination of the flow diagrams and the corresponding textual descriptions constitute the requirements on the Kernel behaviour:

• Each diagram in this specification has a unique label.
• Each symbol in a diagram has a unique identifier that is the concatenation of the diagram label with the symbol number. Procedure start Procedure return Yes No decision task complex task procedure X connectors Yes No complex decision X – state state Procedure X signal received ACT CA(GPO) signal sent XYZ Yes No Implementation option test EMV® Contactless Specifications for Payment Systems Kernel 2 Specification v2.12 / 347 countries.
• The textual description corresponding to the symbol in a diagram starts with the identifier of the symbol. The flow diagrams are read from top to bottom and define the order of execution of the processing steps. The textual description specifies the behaviour of the individual steps but bears no information on the order of execution. The requirements relate to the behaviour of the Kernel but leave flexibility in the actual implementation. The implementation must behave in a way that is indistinguishable from the behaviour specified in this document. Indistinguishable means that it creates the output as predicted by this specification for a given input. There is no requirement that the implementation realize the behaviour through a state machine as described in this document.

1.5.2 Data Object Notation Data object names are capitalized to distinguish them from the text: Data Object Name To refer to a sub-element of a data object (i.e. a specific bit, set of bits, or byte of a multi- byte data object), the following notational convention is used:

• If the sub-element is defined in the data dictionary (Annex A), with each possible value of the sub-element having a name, then the following conventions apply:
• The reference to the sub-element is 'Name of Sub-element' in Data Object Name.
• The reference to the value is VALUE OF SUB-ELEMENT. Examples:
• 'CDCVM successful' in POS Cardholder Interaction Information refers to bit 5 of byte 2 in POS Cardholder Interaction Information.
• 'CVM' in Outcome Parameter Set:= ONLINE PIN means the same as “bits 4 to 1 of byte 4 of Outcome Parameter Set are set to 0010b”.
• Alternatively, an index may be used to identify a sub-element of a data object. In this case the following notational conventions apply:
• To refer to a specific byte of a multi-byte data object, a byte index is used within brackets (i.e. [ ]). For example, Terminal Verification Results[2] represents byte 2 of Terminal Verification Results. The first byte (leftmost or most significant) of a data object has index 1.
• To refer to a specific bit of a single byte multi-bit data object, a bit index is used within brackets [ ]. EMV® Contactless Specifications for Payment Systems Kernel 2 Specification v2.12 / 347 countries. For example, Cryptogram Information Data[7] represents the 7th bit of the Cryptogram Information Data. The first bit (rightmost or least significant) of a data object has index 1.
• To refer to a specific bit of a multi-byte data object, a byte index and a bit index are used within brackets (i.e. [ ][ ]). For example, Terminal Verification Results[2][4] represents bit 4 of byte 2 of the Terminal Verification Results.
• Ranges of bytes are expressed with the x:y notational convention: For example, Terminal Verification Results[1:4] represents bytes 1, 2, 3, and 4 of the Terminal Verification Results.
• Ranges of bits are expressed with the y:x notational convention: For example, Cryptogram Information Data[5:1] represents bits 5, 4, 3, 2, and 1 of the Cryptogram Information Data.

1.5.3 Other Notational Conventions Notations for processing data and managing memory are described in Table 1.2. Table 1.2: Other Notational Conventions Symbol Meaning Example '0' to '9' and