PCI Contactless Payments on COTS (CPoC)
PCI SSC's standard for accepting contactless card payments on a commercial off-the-shelf mobile device without a separate secure card reader. In its formal sunset window now, with MPoC as the designated successor.
v1.0 · PCI Security Standards Council — CPoC
00Answer
01Standing
Authority and version facts, with a parsed public catalog when available; no tenant blueprint or executable evidence method is activated.
PCI Contactless Payments on COTS (CPoC) is tracked in the registry — authority, version ledger, verification — and nothing else is modelled for it yet. Import its catalog to begin.
Freely downloadable from PCI SSC; PCI SSC's terms permit identifiers and structure, not verbatim requirement text, without a separate license.
02Registry record
- Registry status
- Planned · namedTracked metadata: we name the regime and monitor its issuing authority. No control or requirement model is implemented.
- Control units
- Not on record — no catalog ingested and no authority-published count cited.
- Control families
- Contactless kernel security · Device and OS integrity · Backend monitoring · Solution management
- Applies to
- payments · mobile point-of-sale · global
- Verification
- Secondary — corroborated across independent sources; the authority blocks automated fetch or does not state it plainly. checked 2026-09-06
- Pending change
- PCI SSC announced the formal sunset period for CPoC from 2026-05-01 to 2026-10-31, the same window as SPoC. PCI MPoC v1.1 is the standard's designated successor.Expected: 2026-10-31 (sunset window closes)
03Version ledger
| v1.0 | Current edition | date not published |
03aCoexisting versions
- PCI MPoC v1.1 (designated successor)
Applies to: New solutions and any CPoC solution being migrated ahead of the sunset
Coexistence scheduled to end 2026-10-31
Source (opens in a new tab)
05Change history
- 2026-10-31PCI Contactless Payments on COTS (CPoC): the coexistence window for PCI MPoC v1.1 (designated successor) (applying to New solutions and any CPoC solution being migrated ahead of the sunset) is scheduled to close.
- 2026-10-31PCI Contactless Payments on COTS (CPoC): PCI SSC announced the formal sunset period for CPoC from 2026-05-01 to 2026-10-31, the same window as SPoC. PCI MPoC v1.1 is the standard's designated successor.
06Related frameworks
Also applies to payments · PCI SSC's consolidated standard for accepting PIN and contactless payments on commercial off-the-shelf mobile devices, absorbing the sunsetting SPoC and CPoC standards into one framework.
Also applies to payments · PCI SSC's standard for accepting PINs on commercial off-the-shelf mobile devices via a software-based PIN-entry application. In its formal sunset window now, with MPoC as the designated successor.
Also applies to payments · PCI SSC's standard for validated point-to-point encryption solutions that can reduce a merchant's PCI DSS scope. Part of the payments family beyond bare PCI DSS.
- PCI DSSv4.0.1
Also applies to payments · The cardholder-data standard every merchant and service provider that touches payment card data is measured against. v4.0 retired 2024-12-31; the 51 future-dated v4.x requirements became mandatory 2025-03-31.