How MPoC works
COTS means commercial off-the-shelf: a stock device, not one built for a specific customer. PCI SSC describes MPoC as modular and objective-based. Three kinds of product are evaluated under it, and PCI SSC publishes an attestation form for each.
- MPoC Software: the payment software.
- MPoC Attestation and Monitoring Service: the service that checks the device and the software.
- MPoC Solution: the complete solution a merchant uses.
The MPoC version in force
The current Security and Test Requirements are version 1.1, dated November 2024. PCI SSC's document library also lists a Program Guide, version 1.1, of January 2025, and technical FAQs last revised in July 2026.
The end of CPoC and SPoC
CPoC, Contactless Payments on COTS, covers contactless acceptance through the device's own NFC, with no external reader. SPoC, Software-based PIN Entry on COTS, covers PIN entry on the device, used with a separate secure card reader.
On 1 May 2026, PCI SSC announced a sunset period for both standards, from 1 May to 31 October 2026. During the period, new submissions are still accepted. After 31 October 2026, PCI SSC accepts no new SPoC or CPoC submissions.
Existing SPoC and CPoC listings remain valid through their normal lifecycle and expire on their existing dates.
Who needs MPoC
Laboratories recognised by PCI SSC evaluate a product against the standard and its Program Guide. PCI SSC lists the products and solutions that passed, and encourages merchants and acquirers to choose from that list.
Vendors of SoftPOS software, attestation services and complete solutions submit them for evaluation. An acquirer, a payment facilitator or a fintech launching SoftPOS builds on products that are listed, or seeks a listing of its own. PCI SSC's bulletin asks organisations considering a SPoC or CPoC evaluation to plan within the sunset timeline, and points them to MPoC.
MPoC, CPoC, SPoC or PCI DSS?
- CPoC
- Contactless Payments on COTS: contactless only, read by the phone's own NFC. In its sunset period, with no new submissions after 31 October 2026.
- SPoC
- Software-based PIN Entry on COTS: PIN entry on the device, with the card read by a separate secure card reader. In its sunset period, with no new submissions after 31 October 2026.
- PCI DSS
- Applies to the organisations that store, process or transmit card data. MPoC applies to a product or a solution, which a laboratory evaluates and PCI SSC lists.
- SoftPOS
- The product a merchant uses to take a tap on a phone. MPoC is the standard that the product's security is evaluated against.
Where MPoC shows up in a platform
Modules that do the work
- Card acquiringCard acceptance on the phone, in store and online, through the acquirer you choose.
- Merchant onboardingBusiness sign-up, verification and underwriting, from application to first payment.
Platforms that need it
Guides that go deeper
- SoftPOS certification, explainedWhat it takes for a phone to accept card payments: the PCI standard behind it, card scheme approval, attestation and monitoring, and what a merchant needs on day one.
- PCI DSS for a payment gateway: scope, levels and how to shrink itWhat PCI DSS v4.0.1 asks of a payment gateway: who sets your validation level, when you need a Report on Compliance from a QSA, and how tokenisation and hosted fields shrink scope.
Where it is written
The laws and standards this page's facts come from.
- PCI SSC, Mobile Payments on COTS (MPoC)
- PCI SSC, Document Library: MPoC standard, Program Guide and attestation forms
- PCI SSC Bulletin, Announcement of Sunset Periods for the PCI SPoC and PCI CPoC Standards, 1 May 2026
- PCI SSC, Contactless Payments on COTS (CPoC)
- PCI SSC, Software-based PIN Entry on COTS (SPoC)
General information, not legal advice: what applies to you depends on your services and your market.