The EMV kernel layer — what it certifies, why contactless runs scheme-by-scheme instead of once, and the cases where you actually have to do this work yourself.
EMV Level 2 certifies the kernel — the embedded software that runs EMV transaction logic against the chip. Contact Level 2 is one certification. Contactless is not: each card scheme certifies its own kernel separately, so supporting Visa, Mastercard, Amex, and Discover contactless means four certification cycles. Standard terminal hardware ships with this already done. SoftPOS and custom kernels don't have that luxury — this is real, scheme-by-scheme work.
Level 2 sits between the physical reader interface (Level 1) and the full payment application (Level 3). It certifies the kernel: the embedded software logic that runs an EMV transaction against the chip — selecting the correct application on the card, executing risk management checks, and determining the cardholder verification method (PIN, signature, or no verification, depending on the transaction and card). The kernel is what actually "speaks EMV" to the chip. Everything above it — how the terminal talks to a specific processor, how the transaction gets approved — belongs to Level 3.
Certifies the electrical and RF interface between card and reader. Handled by the terminal manufacturer.
Certifies the embedded logic that executes an EMV transaction against the chip. Pre-certified on standard hardware — but a real project if you're building the kernel yourself, as SoftPOS providers do.
Certifies your complete payment application and its integration with a specific processor and card brand.
This is the detail that catches teams off guard. Contact Level 2 is a single, unified EMVCo Type Approval — one certification covers contact-chip kernel behavior across brands. Contactless is structured completely differently: each card scheme owns its own kernel specification, and each one is certified independently, commonly referenced by kernel number.
| Scheme | Contactless kernel |
|---|---|
| Mastercard | Kernel 2 (M/Chip) |
| Visa | Kernel 3 (qVSDC) |
| American Express | Kernel 4 (ExpressPay) |
| JCB | Kernel 5 (J Speedy) |
| Discover | Kernel 6 (D-PAS) |
| UnionPay | Kernel 7 (QuickPass) |
Support every major network's contactless and you're running six independent kernel certifications, each with its own test tool, its own scheme-managed lab process, and its own findings cycle. This is a large part of why building a compliant multi-scheme contactless kernel from scratch is a serious undertaking rather than a checkbox.
For most payment software companies building on standard terminal hardware, the answer is nobody on your team — a PAX, Ingenico, or Verifone device arrives with its kernel already certified against every major scheme, the same way it arrives with Level 1 done. You inherit it by choosing the hardware.
That changes the moment the kernel runs in software you control instead of pre-certified firmware. SoftPOS is the clearest example — turning a standard commercial phone into a contactless acceptance device means the EMV kernel runs inside your own app, on hardware that was never built for payments. There's no pre-certified kernel to inherit. The same is true for anyone building custom terminal firmware or an unattended device with its own embedded payment stack. In these cases, Level 2 kernel certification is real, scheme-by-scheme project work, not a formality.
SoftPOS and custom terminal kernels are a different scope of work than standard Level 3 certification. Tell us what you're building — we'll tell you honestly what certification path it actually needs.
See our SoftPOS work