Certification Checklist for Level 2 and Level 3 Application for NCMC Transit Terminal
The National Common Mobility Card (NCMC), initiated by the Government of India and powered by the RuPay card network, enables seamless contactless fare payments across transit systems, including metros and buses. For any terminal to support NCMC transactions, it must pass through rigorous EMV Level 2 (L2) and Level 3 (L3) certifications. This guide presents a comprehensive, technically informative checklist for successfully passing these certifications.
Understanding EMV L2 and L3 Certification for NCMC
EMV Level 2 (L2) certification validates the EMV kernel’s compliance with EMVCo specifications. It focuses on the correctness of the kernel’s implementation in handling APDU command-response sequences, application selection, cryptogram generation, and decision logic. EMV Level 3 (L3) certification verifies the end-to-end terminal transaction flow, UI behavior, fare logic, and host communication as per NCMC requirements.
Pre-Certification Preparation
Before starting the certification process, ensure the device and software stack meet the minimum compliance requirements.
The contactless reader must be EMVCo L1 certified, supporting ISO 14443 standards for NFC communication at multiple baud rates (106, 212, 424 kbps). The terminal should integrate a compliant EMV Level 2 kernel capable of processing NCMC’s AID (A0000005241010) and supporting contactless processing without requiring Cardholder Verification Method (CVM) in most use cases.
Set up an appropriate development and test environment with tools such as the UL Brand Test Tool, NPCI’s Transit Host Simulator, and debug hardware interfaces (USB/UART). Test cards issued by RuPay for NCMC and EMV are also essential for offline validation and functional testing.
EMV Level 2 Certification Checklist
Certification at this level focuses entirely on the kernel. The kernel should process smart card commands and responses precisely as specified by EMVCo.
Application Selection: The kernel must support both PSE and direct AID selection mechanisms and properly prioritize AID lists.
GPO Processing: PDOL construction must be accurate. The kernel should correctly parse GPO responses to extract AIP and AFL.
Read Record Handling: All records listed in the AFL must be read and interpreted without error.
Cardholder Verification: NCMC typically mandates No CVM. If required, online PIN should be implemented.
Risk Management: Proper handling of floor limits, exception files, and velocity checking should be embedded.
Terminal Action Analysis: The logic must process default, online, and denial paths based on TVR and issuer conditions.
Cryptogram Generation: Correct handling and generation of ARQC, TC, and AAC must be ensured.
Issuer Script Processing: The kernel must execute and respond to issuer-provided scripts with proper status word feedback.
Kernel logs should include clear APDU traces, parsed TLVs (TVR, TSI, CID, ATC), and time-stamped kernel decisions. Tools such as UL Trace Viewer or Galitt EMV analyzers help identify issues in early development stages.
EMV Level 3 Certification Checklist
EMV Level 3 focuses on validating the terminal’s behavior within a real-world transit scenario. It ensures that the terminal application integrates seamlessly with the kernel, processes user inputs correctly, calculates fares, and communicates with the host accurately.
Application Logic
The terminal should support NCMC Tap-In and Tap-Out flows. During Tap-In, the terminal should capture entry details such as time, station, and device ID and tag the transaction as an “Entry” (Type 20). During Tap-Out, the terminal must retrieve the Tap-In data, calculate the fare, and classify the transaction as an “Exit” (Type 21).
Fare Engine Implementation
Fare calculations should follow a distance-based or time-based rule engine. In cases of insufficient balance, the terminal should reject the transaction gracefully with appropriate messages. If a Tap-Out is missed, the terminal must apply a penalty or maximum fare.
Host Communication and Reversal Logic
The terminal must generate ISO8583 messages according to NPCI’s NCMC Transit Host specifications. Critical fields include the card’s PAN, processing code, amount, response code, and EMV TLV data. In case of a transaction failure or timeout, a reversal message should be automatically queued and sent once connectivity is restored.
User Interface and HMI Behavior
User experience is crucial for transit payments. The terminal must provide audible beeps and visual LED indicators for successful and failed transactions. The display should show transaction status messages like “Tap Successful” or “Insufficient Balance.”
Offline and Edge Case Handling
The application must handle duplicate tap prevention using the Application Transaction Counter (ATC). It should also implement logic for offline transaction queuing when host connectivity fails, ensuring data is securely stored and transmitted later.
Logging and Debugging Guidelines
Logs are vital for certification submission and issue debugging.
EMV L2 Logs: Should include APDU command-response pairs, terminal parameters, TLV-decoded values, and decisions made by the kernel.
EMV L3 Logs: Must contain ISO8583 requests and responses, Tap-In/Out data, fare calculations, and UI event logs.
Debugging tips include using trace-level logs to observe kernel behavior and replaying known scenarios with debug cards to isolate issues.
Key Test Cases for Certification
Some of the critical scenarios required during L3 certification include:
Successful Tap-In with sufficient balance
Successful Tap-Out following Tap-In
Handling of insufficient balance
Tap-Out without Tap-In (fallback to maximum fare)
Duplicate Tap-In/Out detection
Timeout and host failure management
Reversal and retry logic verification
Each of these tests verifies a critical component of terminal reliability and user safety.
Certification Timeline
A realistic timeline for L2 and L3 certification is as follows:
Kernel Integration and Debugging: 1–2 week
L2 Certification and Testing: 2–3 weeks
Terminal App Development and Debugging: 2 weeks
L3 Certification and Final Validation: 2–3 weeks
Total estimated time: 6 to 8 weeks
How EazyPay Tech Supports NCMC Certification
EazyPay Tech offers a complete portfolio of services for EMV and NCMC terminal projects. With a pre-certified EMV L2 kernel and a tested terminal SDK, we reduce development and certification time significantly. Our engineering team assists with:
Terminal configuration
Fare logic development
EMV and ISO log validation
Certification test case preparation
Debugging and optimization
We also coordinate with certification labs like UL and FIME and work closely with NPCI during project execution.
Final Checklist Summary
EMV L2 certification completed with valid kernel logs
EMV L3 scenarios passed with ISO traces and test data
UI and transaction flows verified under various real-world cases
Offline mode, reversals, retries, and tap-state logic tested
Certification documents submitted with terminal configuration, firmware version, and debug logs
