CPoC (Contactless Payments on COTS)
PCIComplianceHubLast updated
A PCI Security Standards Council standard for solutions that accept contactless payments using the built-in NFC reader of an ordinary phone or tablet, with no additional hardware. CPoC solutions do not accept a PIN. As with SPoC, only solutions listed by the council qualify.
Applies to. No PCI DSS v4.0.1 requirement names CPoC; a merchant meets it when taking tap-to-pay on a phone or tablet's own NFC reader with no separate hardware and no PIN, and only solutions on the Council's CPoC list are validated for it. The Council now positions MPoC, which covers contactless and PIN on one device, as the standard for new solutions. To the merchant a CPoC app is a card-present channel: the account data passes through the merchant's device to the solution provider, so the device and its handling stay in the assessment, and the SAQ is agreed with the acquirer, since the v4.0.1 SAQ set names SPoC but not CPoC.