How SoftPOS works
The merchant installs an app and enters an amount, and the customer taps a card or a phone on the merchant's device. The phone's own NFC reads the card, a contactless kernel in the app processes the payment, and it goes to the acquirer like any other card payment. EMVCo publishes a kernel specification for each global payment system.
Visa calls this Tap to Phone and Mastercard Tap on Phone. On iPhone, acceptance runs through Apple's Tap to Pay on iPhone, which an app reaches through a payment service provider that supports it.
What is evaluated in SoftPOS
A phone is not a certified terminal, so the software and the service around it are evaluated instead. PCI MPoC covers the payment software, the attestation and monitoring service that checks the device, and the complete solution. Laboratories recognised by PCI SSC carry out the evaluations.
The Visa Core Rules define a Tap to Phone solution as a mobile device owned or controlled by the merchant, multi-functional and NFC-enabled, that uses an application to act as an acceptance device.
When SoftPOS asks for a PIN
A tap with no further check is an exemption from strong customer authentication. In the EU, Delegated Regulation (EU) 2018/389, Article 11, allows the exemption up to EUR 50 a payment, until EUR 150 in total or five consecutive contactless payments have passed since the cardholder last authenticated.
In the UK there has been no fixed limit since 19 March 2026. The FCA's version of Article 11 allows the exemption where the provider identifies the payment as low risk.
Outside the exemption the cardholder authenticates, with a card usually by PIN. MPoC covers PIN entry on the merchant's own screen, so no extra hardware is needed for it.
Who launches SoftPOS
Acquirers, payment facilitators and fintechs that want to give merchants card acceptance without shipping hardware. Each merchant still needs acquiring behind the app, and onboarding checks before the first payment.
SoftPOS, mPOS or a card terminal?
- mPOS
- A phone or tablet with a separate card reader attached. SoftPOS has no reader: the phone's own NFC reads the card.
- Card terminal
- Hardware built for taking payments. Under the Visa Core Rules, a device made or used primarily as an acceptance device does not qualify as a Tap to Phone solution.
- Paying with a phone wallet
- A customer paying with a phone, through a wallet such as Apple Pay or Google Pay. SoftPOS is the other side: the merchant accepting the payment on a phone.
- MPoC
- The PCI standard that SoftPOS software and solutions are evaluated against. SoftPOS is the product, and MPoC is the security standard.
Where SoftPOS shows up in a platform
Modules that do the work
- Card acquiringCard acceptance on the phone, in store and online, through the acquirer you choose.
- Merchant onboardingBusiness sign-up, verification and underwriting, from application to first payment.
- KYC / AMLIdentity checks, screening and ongoing monitoring, with the verification provider you choose.
- BackofficeOne console to run the platform: customers, money, risk, content and staff permissions.
Platforms that need it
Guides that go deeper
- SoftPOS certification, explainedWhat it takes for a phone to accept card payments: the PCI standard behind it, card scheme approval, attestation and monitoring, and what a merchant needs on day one.
- How to become a PSP or a payment facilitatorGateway, acquirer, payment facilitator or payment institution: where the licence line falls, how the card schemes register payment facilitators, what merchant KYB demands, and the UK and UAE rules.
- PCI DSS for a payment gateway: scope, levels and how to shrink itWhat PCI DSS v4.0.1 asks of a payment gateway: who sets your validation level, when you need a Report on Compliance from a QSA, and how tokenisation and hosted fields shrink scope.
Where it is written
The laws and standards this page's facts come from.
- PCI SSC, Mobile Payments on COTS (MPoC)
- Visa Core Rules and Visa Product and Service Rules, 18 April 2026: glossary, Tap to Phone Solution (Visa)
- EMVCo, EMV Contactless Chip, with the contactless kernel specifications
- Delegated Regulation (EU) 2018/389, Article 11 (EUR-Lex)
- FCA Handbook, technical standards on strong customer authentication, Article 11
General information, not legal advice: what applies to you depends on your services and your market.