SPoC (Software-based PIN Entry on COTS)
PCIComplianceHubLast updated
A PCI Security Standards Council standard for solutions that accept a PIN on an ordinary commercial off-the-shelf device, such as a phone or tablet, paired with a separate secure card reader that handles the card data. The security model depends on that separation, and only solutions listed by the council qualify.
Applies to. No PCI DSS v4.0.1 requirement names SPoC; a merchant meets it when accepting a PIN on a phone or tablet paired with a separate PTS-approved secure card reader, and only a solution on the Council's SPoC list is validated for that design. The Council now positions MPoC as the standard for new COTS acceptance solutions, so a product chosen today is more likely to carry an MPoC listing than a new SPoC one. For the merchant's own assessment, SAQ SPoC is written for merchants whose only card acceptance is a listed SPoC solution; the COTS device stays the merchant's to keep updated, and the solution's attestation service monitors its state.