PCI MPoC: Mobile Payments on COTS Devices Explained

PCI MPoC (Mobile Payments on COTS) is the PCI Security Standards Council standard for software-based payment acceptance on commercial off-the-shelf (COTS) devices: the phones and tablets a business already owns. An MPoC solution lets a merchant take contactless card payments, with the cardholder entering a PIN where needed, on the same device and without a separate terminal. PCI SSC published MPoC on 16 November 2022, and it becomes the only PCI SSC standard for COTS payment acceptance open to new submissions once the older SPoC and CPoC programmes stop accepting them after 31 October 2026.

What is PCI MPoC?

MPoC sets security and testing requirements for a whole payment solution, not just an app. An MPoC solution relies on layered controls: protections in the payment software, encryption of card data and PINs, and a back-end attestation and monitoring service that checks the device and app are in a trusted state and can stop payments if they are not.

The standard is modular and objective-based. It separates the technical side (the MPoC software, often an SDK built into a payment app) from the operational side (the solution provider that deploys the solution, runs its back end and supports merchants), which PCI SSC says gives more flexibility in how solutions are developed, deployed and maintained. PCI-recognised MPoC laboratories carry out the evaluations, and PCI SSC publishes a list of MPoC products and solutions.

Is MPoC the same as SoftPOS?

Not quite. SoftPOS, tap on phone, tap to pay and PIN on glass are industry and product names for taking card payments on a phone or tablet’s own hardware. MPoC is the PCI SSC standard that sets the security bar for those products, and a listing is how a merchant knows a SoftPOS solution has been independently evaluated. Until the older listings expire, a SoftPOS product may be listed under CPoC or SPoC instead, so check the PCI SSC listing rather than the marketing name.

The practical difference between SoftPOS and mPOS is the hardware: SoftPOS needs nothing but the phone, while mPOS adds a dedicated reader that holds the card-reading security itself.

How did MPoC replace SPoC and CPoC?

PCI SSC’s sunset bulletin says existing SPoC and CPoC listings remain valid until their own expiry or reevaluation dates. A merchant using a listed SPoC or CPoC solution does not have to switch at once, but should check the expiry date on the listing and ask the provider about its MPoC plans. The SCRP readers used with SPoC are approved under a separate device programme, explained in our entry on PCI PTS.

Who does MPoC apply to?

PCI SSC is clear that the payment brands, not the Council, decide who must validate and whether a listed product is required.

What should merchants check before taking tap to pay on a phone?

• The listing. Find the solution on the PCI SSC list of MPoC solutions, or on the SPoC or CPoC list with an expiry date still in the future.
• Your acquirer’s view. Confirm the acquirer accepts the solution and which validation route applies. Our guide to choosing the right SAQ covers the questionnaires, including SAQ SPoC for listed SPoC solutions, and our free PCI compliance check gives a first view of your wider position.
• Supported devices. Use only the phone models and operating system versions the provider supports, keep them updated, and never use a jailbroken or rooted device.
• Device ownership. Treat the phone as a payment device, with a screen lock, named users and a process for lost or stolen handsets.
• Card data outside the app. Staff must not write down or photograph card details, and customers should be able to enter a PIN out of sight of others.

How does MPoC affect your PCI DSS scope?

A listed solution is designed so that your business never handles clear card data or PINs, which is what keeps your PCI DSS scope small. Your obligations do not disappear. You still manage the provider as a third-party service provider under Requirement 12.8, keep policies and incident response in place, and complete whatever validation your acquirer asks for. If the solution is not listed, or you are building your own payment app, speak to your acquirer before going live: the validation route and your scope may be very different, and a PCI DSS assessment by a QSA settles what is in scope.

Where does Sovereign Secure fit?

Sovereign Secure is not an MPoC laboratory and cannot evaluate MPoC software or solutions. We are a PCI SSC-approved QSA, Qualified PIN Assessor (QPA) and Card Production Security Assessor (CPSA) company, a P2PE Assessor for Europe and the USA, and a member of the Global Executive Assessor Roundtable (GEAR) for 2026 to 2028.

We assess merchants and service providers that use COTS payment acceptance under PCI DSS, assess PIN processing through our PCI PIN security assessments, assess point-to-point encryption solutions and components for terminal-based acceptance through our P2PE assessments, and test payment apps through mobile application penetration testing, which is separate from an MPoC evaluation. For how MPoC sits beside PCI DSS, PIN, P2PE and the other standards, see our guide to the PCI Security Standards Council, or contact our team with your question.