PCI Software-based PIN Entry on COTS (SPoC)
PCI SSC's standard for accepting PINs on commercial off-the-shelf mobile devices via a software-based PIN-entry application. In its formal sunset window now, with MPoC as the designated successor.
v1.1 · PCI Security Standards Council — SPoC
00Answer
01Standing
Authority and version facts, with a parsed public catalog when available; no tenant blueprint or executable evidence method is activated.
PCI Software-based PIN Entry on COTS (SPoC) is tracked in the registry — authority, version ledger, verification — and nothing else is modelled for it yet. Import its catalog to begin.
Freely downloadable from PCI SSC; PCI SSC's terms permit identifiers and structure, not verbatim requirement text, without a separate license.
02Registry record
- Registry status
- Planned · namedTracked metadata: we name the regime and monitor its issuing authority. No control or requirement model is implemented.
- Control units
- Not on record — no catalog ingested and no authority-published count cited.
- Control families
- PIN CVM application security · Device and OS integrity · Backend monitoring · Solution management
- Applies to
- payments · mobile point-of-sale · global
- Verification
- Primary — the issuing body's own page was read and states this version. checked 2026-09-06
- Pending change
- PCI SSC announced the formal sunset period for SPoC from 2026-05-01 to 2026-10-31. PCI MPoC v1.1 is the standard's designated successor for organizations moving off SPoC.Expected: 2026-10-31 (sunset window closes)
03Version ledger
| v1.1 | Current edition | date not published |
03aCoexisting versions
- PCI MPoC v1.1 (designated successor)
Applies to: New solutions and any SPoC solution being migrated ahead of the sunset
Coexistence scheduled to end 2026-10-31
Source (opens in a new tab)
05Change history
- 2026-10-31PCI Software-based PIN Entry on COTS (SPoC): the coexistence window for PCI MPoC v1.1 (designated successor) (applying to New solutions and any SPoC solution being migrated ahead of the sunset) is scheduled to close.
- 2026-10-31PCI Software-based PIN Entry on COTS (SPoC): PCI SSC announced the formal sunset period for SPoC from 2026-05-01 to 2026-10-31. PCI MPoC v1.1 is the standard's designated successor for organizations moving off SPoC.
06Related frameworks
Also applies to payments · PCI SSC's standard for accepting contactless card payments on a commercial off-the-shelf mobile device without a separate secure card reader. In its formal sunset window now, with MPoC as the designated successor.
Also applies to payments · PCI SSC's consolidated standard for accepting PIN and contactless payments on commercial off-the-shelf mobile devices, absorbing the sunsetting SPoC and CPoC standards into one framework.
Also applies to payments · PCI SSC's standard for validated point-to-point encryption solutions that can reduce a merchant's PCI DSS scope. Part of the payments family beyond bare PCI DSS.
- PCI DSSv4.0.1
Also applies to payments · The cardholder-data standard every merchant and service provider that touches payment card data is measured against. v4.0 retired 2024-12-31; the 51 future-dated v4.x requirements became mandatory 2025-03-31.