What is EMVCo SBMP?
It is EMVCo's security evaluation process for software-based mobile payment solutions, such as HCE wallets and payment SDKs, and for the components they use, such as software protection tools. An EMVCo-recognized laboratory evaluates the product and reports to EMVCo, which decides whether to issue a Security Evaluation Certificate.
Is a pre-evaluation the same as the EMVCo evaluation?
No. We are not an EMVCo-recognized laboratory: we do not perform the formal evaluation or write the evaluation report. We test your product with the attacks a laboratory would use, so you can fix what matters before the formal evaluation.
Do you tell us what to fix before the evaluation?
We tell you what we achieved and, from our experience with the scheme, what we think will matter to the laboratory. You decide what to fix before you submit your product.
How is this different from PCI MPoC?
EMVCo SBMP covers payments made by the cardholder with their phone, for example from a wallet or a payment app. PCI MPoC covers accepting payments on a phone, such as SoftPOS. If you are preparing for PCI MPoC, see our PCI MPoC vulnerability assessment.
We develop a software protection tool. Does this apply to us?
Yes. Software protection tools are evaluated as components, and EMVCo can issue a certificate for the tool itself. Apps that use an SPT with an EMVCo certificate can build on that certificate in their own evaluation. We test your SPT applied to the sample app you will submit to the laboratory, with the attacks a laboratory would use. For protection tools outside the EMVCo process, see our protection SDK evaluation.
Do you need source code?
No. By default, testing is black-box: we work with the same information an attacker would have, using the build you plan to submit for evaluation. If you prefer, we can also review the source code.
Do you test on physical devices?
When needed. On Android we mainly work with Chameleon, our analysis environment, which reproduces a physical device including its hardware capabilities. If we hit a limitation that matters for your product, we use physical devices. On iOS we use physical devices.
Do you use AI on my solution?
Yes, to cover more of your product and go deeper in the same time. We use AI providers that do not train their models on your data. We only use accounts you provide or that we create ourselves, never other real users' accounts. Our specialists lead the work and validate every result. If your policy does not allow external AI, tell us when we agree on the scope and we work without it.
How long does it take and what does it cost?
It depends on the type of product and the platforms, the components and interfaces in scope and your evaluation date. We send you a proposal with a fixed price and the schedule. It usually takes one to two weeks per platform, report included, depending on the complexity of your product. We can usually start the same week you accept the proposal; the start date depends on our team's workload and is stated in the proposal.
Is retesting included?
Retesting is quoted separately at a reduced rate. In the proposal we give you two options, testing only or testing with one retest round, so you know the total cost from the start. We agree with you on which fixes and builds to retest before you submit your product to the laboratory.
Do you offer recurring contracts?
Yes. If you plan your annual reviews with us, we agree special conditions for the whole cycle.
What format do the findings come in?
You receive one report per platform, with every finding detailed. If you also want to use them in your own tools, we provide them as CSV or JSON too.
What language is the report in?
English by default. If you need it in Spanish, just tell us.
How do you handle confidentiality?
We agree confidentiality terms before you share builds, source code or documentation. We have a standard NDA, but if you prefer to use yours, we are happy to review it.
