The PCI Security Standards Council announced on May 1, 2026 that it is sunsetting three standards: Software-based PIN Entry on COTS (SPoC), Contactless Payments on COTS (CPoC) and the 3-D Secure Software Development Kit (3DS SDK) standard. The sunset period runs from May 1 to October 31, 2026. After October 31, the Council will not accept new submissions under any of the three. The PCI 3DS Core Standard is not affected.
SPoC and CPoC cover payment apps that let merchants accept PINs or contactless cards on ordinary phones and tablets. Existing validated solutions are not being pulled: their listings stay valid until their normal expiration or reevaluation dates and remain subject to maintenance requirements. The Council points to the growth of its Mobile Payments on COTS (MPoC) standard as a reason for the change, and says the PCI Secure Software Standard v2.0 offers an alternative assessment path for 3DS SDKs.
Merchants using tap-to-pay or PIN-on-phone apps should ask their payment provider which PCI standard their solution is listed under, when that listing expires, and what the provider's plan is after that, including whether it is moving to MPoC. If you are evaluating a new mobile acceptance product, ask about MPoC validation directly. Software providers with a SPoC, CPoC or 3DS SDK evaluation in progress need to submit before October 31.
For most merchants this is not an urgent change, but it is a useful contract question. Make sure your agreements require the provider to keep its solution validated under a current PCI standard.
Does this affect your business?
Our advisors can help you figure out the right move, at no cost.