EMVCo

EMVCo is the technical body that writes and manages the EMV specifications, the global standards behind chip cards, contactless payments, online card authentication and payment tokens. It is owned by six card networks: American Express, Discover, JCB, Mastercard, UnionPay and Visa. Card issuers, acquirers, terminal makers and merchants build products to its specifications so that a card issued in one country works on a terminal or website in another.

The name comes from Europay, Mastercard and Visa, the three companies that created the original chip card standard. EMVCo sets technical specifications and runs testing and approval programmes. It does not process payments, set fees or decide liability rules; those remain with each network and its card scheme rules. It is also separate from the PCI Security Standards Council, which covers card data security.

Think of the agreed shape of an electrical plug and socket. Many companies make plugs and many make sockets, yet they fit because everyone follows the same published design. EMVCo writes that kind of shared design for card payments. A bank in Japan and a shop terminal in Brazil have never met, but both follow the same rulebook, so the card works.

The rulebook covers several situations: tapping or inserting a card in a shop, proving who you are when you shop online, and swapping a real card number for a stand-in number on a phone or website. EMVCo does not run the payment itself. It publishes the designs, tests equipment against them and certifies the products that pass, which is why shoppers rarely notice it exists.

Europay, Mastercard and Visa formed EMVCo in 1999 to maintain the chip specification they had developed during the 1990s, which replaced the easily copied magnetic stripe with a chip that creates a unique cryptogram for each payment. Mastercard absorbed Europay in 2002. JCB joined in 2004, American Express in 2009 and UnionPay in 2013, and Discover later became the sixth member. Discover has been owned by Capital One since May 2025 and remains a member.

Chip adoption spread through Europe in the 2000s. The United States lagged until the card networks moved fraud liability for counterfeit card-present payments to whichever party had not adopted chip technology, a liability shift that took effect in October 2015.

EMVCo's current work falls into several families:

• EMV contact and contactless chip. The core standards for cards and terminals, including tap-to-pay.
• EMV 3-D Secure. The protocol for authenticating card-not-present purchases. Version 2.0 was published in 2016 and lets the card issuer approve most low-risk purchases without asking the shopper for anything, which in Europe supports strong customer authentication.
• EMV Payment Tokenisation. A framework, first published in 2014, for replacing the card number with a payment token tied to a device or merchant; it underpins network tokenization and mobile wallets.
• EMV QR Codes. Specifications for paying by scanning a code, either shown by the merchant or by the customer.
• EMV Secure Remote Commerce. A common online checkout button and process for card payments.

Alongside the specifications, EMVCo runs type approval and testing so that cards, terminals and software from different vendors are certified as interoperable before they reach the market, supporting interoperability in payments worldwide.

A Board of Managers, with two representatives from each member, runs EMVCo. The wider industry takes part through Associates and Subscribers programmes, open to issuers, acquirers, merchants, technology vendors and testing laboratories. Associates can contribute to drafts, and those who serve as Advisors vote on whether specifications are approved for publication. Most specifications are free to download from EMVCo's website.

As AI agents began buying on behalf of users, EMVCo set up an Agentic Payments Task Force to look at how card standards should handle agentic commerce. On 1 September 2026 it published a draft "EMV Agentic Payments: Framework for Specifications", which introduced the idea of Intent Services and invited industry comment until 30 September 2026. EMVCo presents the framework as complementing, not replacing, authorisation proofs such as Google's Agent Payments Protocol (AP2) and Mastercard's verifiable intent, which are being developed at the FIDO Alliance. EMVCo has also said that 3-D Secure, payment tokenisation and Secure Remote Commerce will be extended for agent-initiated payments.

Because its owners are the card networks themselves, merchant and retail groups have argued that EMVCo gives the networks the decisive vote over standards that merchants and acquirers must pay to implement, such as terminal upgrades. Associates can comment on drafts and Advisors vote on publication, but only the six members sit on the Board of Managers. Critics have also noted that chip cards moved fraud rather than ending it: counterfeit fraud at terminals fell in countries that adopted chip, while card-not-present fraud online grew, which is the gap that 3-D Secure and tokenisation try to close. Each new specification also adds cost and complexity for smaller merchants and processors, who must certify equipment and software against it.

• EMVCo