Device Requirements

The CPOC and MPOC specifications (PCI standards for SoftPOS solutions) allow to use SoftPOS on “COTS devices” & “Enterprise devices”.

COTS devices: which mean “commercial-off-the-shelf devices”. Such devices include smartphones and tablets which are typically used in a consumer environment.
Enterprise devices: typically used in a professional environment – sometimes also called handheld devices, Android mini computers, ruggedized devices or courier devices. For more information on when SoftPOS is allowed on enterprise devices please scroll further down on this page.

Requirements for Android COTS devices

Device is NFC-enabled
Android OS version still needs to be supported with regular updates: minimum Android 10, preferred Android 11 or higher (to make sure the device is supported can be used with CCV SoftPOS for a longer time)
The device has a hardware backed keystore
More information at Android - Hardware-backed keystore
The device passes the security tests of Google by using the Play Integrity API
This API is used to verify whether the CCV SoftPOS app is running on a known, unmodified Android device powered by Google Play services
More information at Play Integrity API
This requirement also applies if the deployment of CCV SoftPOS is not done via the Google Play Store (but via a closed MDM system).

The same requirements apply for Enterprise Devices as for COTS deviced - with the following additions:

Officially, enterprise devices must be rated to “EMV contactless level 1”. Only “normal” standard/physical payment terminals receive 100%, enterprise devices reach a lower percentage level. Visa/Mastercard have not published an official minimum level (in %) that an enterprise device must achieve. Tests are performed by EMVCo certified test labs. These tests can only be initiated by the hardware manufacturers. The test results of the labs are sent to Mastercard, who evaluates it and gives their approval/disapproval for an enterprise device. The approval counts for the hardware device itself (not for the operating system/Android version on it). Visa/Mastercard so far do not publish a list of enterprise devices to which they gave their approval yet.
- To make sure an enterprise has received the approval, this question either needs to be directed to the hardware provider or Mastercard.
  If you are having difficulties to find out if an enterprise device has received the approval or should be tested for approval, please contact your dedicated CCV Key Account Manger.
Additionally Visa/Mastercard strongly suggest that the CCV SoftPOS solution is tested thoroughly on the specific hardware device, before starting a roll-out.
- CCV can either provide a test installation to you for conducting the tests, or you can send an example device to CCV (please notify us before sending) and we conduct the tests for you.