SPoC
Software-based PIN Entry on COTS
Focuses on software PIN entry on the everyday device, usually paired with an external secure card reader (SCRP) to read the card. It enables PIN but relies on accessory hardware to capture card data.
Compliance · Payments
PCI MPoC what it is and assessment
PCI MPoC (Mobile Payments on COTS) is the PCI SSC standard that lets you accept contactless payments and PIN entry directly on an ordinary commercial device — such as a smartphone — with no dedicated hardware. It is modular and objective-based, unifying and extending the SPoC and CPoC standards.
What is PCI MPoC?
MPoC stands for Mobile Payments on COTS (Commercial Off-The-Shelf devices). It is the PCI Security Standards Council (PCI SSC) standard that sets security requirements for solutions turning an ordinary smartphone or tablet, with no peripherals, into a payment-acceptance point — the model commonly called SoftPOS or "tap to pay on phone".
Unlike earlier standards, MPoC is objective-based rather than a fixed control list: it describes the expected security outcome and allows different approaches to reach it, as long as they are proven through assessment and continuous monitoring. Compliance covers the solution, the SDK, attestation, and real-time monitoring of the inherently untrusted COTS environment.
In short
•PCI SSC standard for payments on everyday devices
•Accepts contactless (NFC) and PIN entry on the same device
•No dedicated hardware — SoftPOS / tap to pay on phone
•Unifies and extends the SPoC and CPoC standards
•Objective-based, with attestation and continuous monitoring
•Assessed by a PCI SSC-recognized laboratory
Comparison
MPoC vs. SPoC vs. CPoC: what is the difference?
All three standards enable payments on everyday devices, but with different scopes. MPoC is the broadest and replaces prescriptive logic with objective-based security assessment.
CPoC
Contactless Payments on COTS
Enables contactless (NFC) payments using the device's own antenna, with no peripherals and no PIN entry. It covers low-value contactless transactions but not PIN entry.
MPoC
Mobile Payments on COTS
Brings contactless and PIN entry together on the same everyday device in a modular, objective-based standard. It replaces the prescriptive SPoC/CPoC approach with security requirements proven via attestation and continuous monitoring.
Structure
How is the MPoC standard organized?
MPoC is modular: requirements are grouped into domains covering the solution, the software, attestation, integration, and lifecycle management. A solution selects the modules that apply to its design.
CORE and software protection
Fundamental solution security requirements and protection of the MPoC SDK against reverse engineering, tampering, and execution in a compromised environment — the base the other modules build on.
Attestation and monitoring
Components that verify, in real time, the integrity of the app and the COTS device on each transaction, plus continuous monitoring that detects anomalies and revokes access when the environment becomes unsafe.
Secure entry and PIN
Secure capture and processing of account data and software PIN entry on the everyday device screen, protecting sensitive cardholder data throughout the flow.
Contactless and offline
Requirements for contactless payments via the device's own NFC and for secure handling of offline transactions where the solution supports them.
Integration and implementation
Integration of the MPoC software by the payment app, final-app security, and the implementation guidance the provider must follow to preserve the SDK's security assumptions.
Software and third-party management
Governance of the software lifecycle — secure development, updates, and incident response — and management of the vendors and third parties in the solution.
Assessment
How does an MPoC assessment work?
Formal listing of an MPoC solution is carried out by a PCI SSC-recognized laboratory. Berghem works on the technical preparation, security testing, and program sustainment before and after the assessment.
1 · Scope and gap analysis
We map the solution architecture, the applicable MPoC modules, and the gaps against the standard's security objectives, prioritizing remediation before any formal assessment.
2 · Pentest and mobile security
We test the app and SDK with an OWASP MASVS/MASTG-aligned methodology and API testing, covering software protection, data storage, communication, and tamper resistance on COTS.
3 · Attestation and monitoring
We review the real-time attestation architecture and continuous monitoring, checking that the solution detects compromised environments and reacts per the standard's objectives.
4 · Formal assessment and sustainment
We prepare the evidence for the assessment run by the PCI SSC-recognized laboratory and support the reassessment and monitoring cycle that keeps the solution compliant over time.
Related services
Round out your MPoC program
MPoC compliance rests on payment security, mobile and API application testing, and a consistent PCI compliance program.
Payment Security
Payment, POS, and EMV security — the foundation of any acceptance-on-everyday-devices initiative.
Mobile Pentest
Android and iOS penetration testing aligned with OWASP MASVS/MASTG — essential for a SoftPOS solution.
API Pentest
Testing of the APIs that connect the MPoC app to the payments backend and attestation.
PCI DSS
PCI DSS readiness and testing for the environment that processes, stores, or transmits card data.
Why Berghem
MPoC preparation with technical evidence
We combine payment security, offensive mobile testing, and PCI compliance experience to get your MPoC solution assessment-ready.
Payment security
Hands-on experience with POS, EMV, and the PCI ecosystem, understanding both the device and the end-to-end acceptance flow.
Offensive mobile and API testing
OWASP MASVS/MASTG-aligned pentest that exercises the SDK defenses, attestation, and backend — not a paper checklist.
Auditable evidence
We deliver prioritized gaps, reproducible evidence, and a remediation roadmap ready for the assessing laboratory and your team.
FAQ
PCI MPoC: frequently asked questions
What does MPoC mean?
MPoC stands for Mobile Payments on COTS (Commercial Off-The-Shelf). It is the PCI SSC standard that lets you accept contactless payments and PIN entry on an ordinary smartphone or tablet, with no dedicated hardware.
What is the difference between MPoC, SPoC, and CPoC?
SPoC covers software PIN entry, usually with an external card reader. CPoC covers contactless payments without PIN. MPoC unifies both — contactless and PIN on the same everyday device — in a modular, objective-based standard.
Do I need dedicated hardware to accept MPoC payments?
No. MPoC's goal is to remove terminals and peripherals: an ordinary NFC-capable smartphone or tablet accepts contactless and PIN via software. Security is ensured by software protection, attestation, and continuous device monitoring.
Does Berghem issue PCI MPoC certification?
Formal listing of an MPoC solution is done by a PCI SSC-recognized laboratory. Berghem handles the preparation: gap analysis, mobile and API pentest, attestation and monitoring review, and the evidence that supports the assessment.
Who needs MPoC compliance?
SoftPOS solution providers, acquirers, sub-acquirers, and fintechs offering payment acceptance on everyday devices. MPoC is the route to bring a tap-to-pay-on-phone solution to market securely and with recognition.
Let's talk
Get your MPoC solution assessment-ready
In a 30-minute call we map the scope of your SoftPOS solution, the applicable MPoC modules, and the path to formal assessment.