MPoC (Mobile Payments on COTS)
PCIComplianceHubLast updated
A PCI Security Standards Council standard covering payment acceptance on ordinary mobile devices, including contactless acceptance and PIN entry on the same device. MPoC builds on the earlier SPoC and CPoC standards and is intended to consolidate them, replacing their fixed solution shapes with a modular, outcome-based set of requirements that suits a wider range of designs.
Applies to. No PCI DSS v4.0.1 requirement names MPoC; it is the Council's current standard for payment acceptance on ordinary phones and tablets, covering contactless reads and PIN entry on the same device through a modular set of requirements, and the Council positions it above SPoC and CPoC for new solutions. A merchant meets it when a provider offers a tap-to-pay or PIN-on-glass app; the listing belongs to the provider, and the merchant's PCI DSS obligations are about the device the app runs on, the staff who use it and the account data that passes through it. The provider is a service provider to its merchants and carries its own PCI DSS assessment for the back end that attests devices and handles the payment.