Security & Authentication
- Aadhaar Registered Devices Technical SpecificationsUIDAI's Aadhaar Registered Devices specifications define requirements for biometric devices and their Registered Device services. They support Aadhaar authentication by governing the device layer; individual products need their own evidence of certification and deployed revision.
- Alipay Information Security StandardsAlipay's Information Security Standards set contractual obligations for overseas commercial partners, including acquirers and integration providers. They cover API access, application security, separation of merchant information and user-data protection across partner services.
- EMV 3-D SecureEMV 3-D Secure defines messages for authenticating cardholders during e-commerce checkout. The 3DS Server, Directory Server and issuer's Access Control Server exchange information supporting frictionless or challenged authentication, alongside payment authorisation and settlement.
- EMV 3-D Secure 2.2.0EMV 3-D Secure 2.2.0 is EMVCo's versioned protocol, core-functions and SDK specification family for remote cardholder authentication. Its specifications and bulletins define that edition's baseline, keeping implementations distinct from later 2.3.x versions and certification.
- EMV Payment Tokenisation SpecificationEMV Payment Tokenisation replaces a primary account number with a payment token constrained to a usage domain. It defines ecosystem roles, lifecycle management and controls for token requestors and service providers, reducing exposure of the PAN across supported payment transactions.
- EU Strong Customer Authentication RTS (Delegated Regulation 2018/389)EU regulatory technical standards under PSD2 that set requirements for strong customer authentication, permitted exemptions and secure communication between payment service providers. They define how banks and third-party providers protect access to accounts and electronic payments.
- GSMA Mobile Money Certification CriteriaGSMA Mobile Money Certification sets eight principles and almost 300 criteria for safeguarding, financial-crime controls, agents, operations, security and customer protection. Providers assemble evidence for assessment, with certification tied to a named provider, country and period.
- ISO 11568:2023 Retail Key ManagementISO 11568:2023 defines management of symmetric and asymmetric cryptographic keys in retail finance. Creation, distribution, storage, use, replacement and retirement form a controlled lifecycle, helping protect transaction security through controlled handling of payment keys.
- ISO 13491-1:2024 Secure Cryptographic Devices — Concepts and RequirementsISO 13491-1:2024 defines concepts and requirements for secure cryptographic devices in retail financial services. It addresses sensitive keys and operations within a device boundary, giving implementers a reference for threats, security properties and the design of financial devices.
- ISO 13491-2:2023 Secure Cryptographic Devices — Security Compliance ChecklistsISO 13491-2:2023 gives security-compliance checklists for cryptographic devices used in financial transactions. It turns Part 1's concepts and requirements into structured assessment criteria, helping evaluators examine device protections consistently against the security framework.