EMV Level 2 certifies the kernel — the embedded software that runs EMV transaction logic against the chip. Contact Level 2 is one certification. Contactless is not: each card scheme certifies its own kernel separately, so supporting Visa, Mastercard, Amex, and Discover contactless means four certification cycles. Standard terminal hardware ships with this already done. SoftPOS and custom kernels don't have that luxury — this is real, scheme-by-scheme work.
What EMV Level 2 covers
Level 2 sits between the physical reader interface (Level 1) and the full payment application (Level 3). It certifies the kernel: the embedded software logic that runs an EMV transaction against the chip — selecting the correct application on the card, executing risk management checks, and determining the cardholder verification method (PIN, signature, or no verification, depending on the transaction and card). The kernel is what actually "speaks EMV" to the chip. Everything above it — how the terminal talks to a specific processor, how the transaction gets approved — belongs to Level 3.
Where Level 2 sits in the stack
Level 1 — the physical interface
Certifies the electrical and RF interface between card and reader. Handled by the terminal manufacturer.
Level 2 — the EMV kernel
Certifies the embedded logic that executes an EMV transaction against the chip. Pre-certified on standard hardware — but a real project if you're building the kernel yourself, as SoftPOS providers do.
Level 3 — the payment application, end to end
Certifies your complete payment application and its integration with a specific processor and card brand.
Contact Level 2 vs. contactless kernel certification
This is the detail that catches teams off guard. Contact Level 2 is a single, unified EMVCo Type Approval — one certification covers contact-chip kernel behavior across brands. Contactless is structured completely differently: each card scheme owns its own kernel specification, and each one is certified independently, commonly referenced by kernel number.
| Scheme | Contactless kernel |
|---|---|
| Mastercard | Kernel 2 (M/Chip) |
| Visa | Kernel 3 (qVSDC) |
| American Express | Kernel 4 (ExpressPay) |
| JCB | Kernel 5 (J Speedy) |
| Discover | Kernel 6 (D-PAS) |
| UnionPay | Kernel 7 (QuickPass) |
Support every major network's contactless and you're running six independent kernel certifications, each with its own test tool, its own scheme-managed lab process, and its own findings cycle. This is a large part of why building a compliant multi-scheme contactless kernel from scratch is a serious undertaking rather than a checkbox.
Who actually has to do this work
For most payment software companies building on standard terminal hardware, the answer is nobody on your team — a PAX, Ingenico, or Verifone device arrives with its kernel already certified against every major scheme, the same way it arrives with Level 1 done. You inherit it by choosing the hardware.
That changes the moment the kernel runs in software you control instead of pre-certified firmware. SoftPOS is the clearest example — turning a standard commercial phone into a contactless acceptance device means the EMV kernel runs inside your own app, on hardware that was never built for payments. There's no pre-certified kernel to inherit. The same is true for anyone building custom terminal firmware or an unattended device with its own embedded payment stack. In these cases, Level 2 kernel certification is real, scheme-by-scheme project work, not a formality.
Frequently asked questions
What does EMV Level 2 certification cover?
Is contactless Level 2 the same for every card brand?
Do I need to complete Level 2 myself?
How long does contactless kernel certification take?
Why does SoftPOS need this when a normal terminal doesn't?
Building a kernel, not just an application?
SoftPOS and custom terminal kernels are a different scope of work than standard Level 3 certification. Tell us what you're building — we'll tell you honestly what certification path it actually needs.
See our SoftPOS work