Security advisory
PCI SPoC and CPoC Stop Accepting New Submissions After 31 October 2026
The PCI Security Standards Council put the SPoC and CPoC mobile payment standards into sunset. New submissions close on 31 October 2026; existing listings run to their normal expiry.
What changed?
The PCI Security Standards Council issued a bulletin on 1 May 2026. It puts two standards for accepting payments on ordinary mobile devices into a formal sunset period: PCI SPoC (software-based PIN entry) and PCI CPoC (contactless payments). The Council cites the growth and maturity of the PCI MPoC standard.
What are the dates?
- The sunset period began on 1 May 2026.
- It ends on 31 October 2026.
Until then, new SPoC and CPoC submissions are still accepted and programme requirements are unchanged. After 31 October 2026, no new submissions will be accepted.
What happens to existing listings?
The Council says there is no change for solutions already accepted and listed. They remain valid through their normal lifecycle and expire on their existing reevaluation or expiry dates. They remain eligible for annual checkpoints and applicable change submissions, and must meet programme maintenance requirements while listed.
Why does it matter?
Vendors who planned a new SPoC or CPoC listing have a short window left. Merchants using listed solutions are not told to change anything now, but should know the standards are closing to new entrants. The Council encourages organisations to align future product plans with its standards, including MPoC where appropriate.
What should you do?
Vendors should confirm their timeline with the Council’s MPoC programme team, whose contact is in the bulletin. Merchants can check the expiry date of any listed solution they depend on. This briefing does not cover PCI DSS itself; see our PCI DSS guide for that.
What to watch
- Solution vendors with SPoC or CPoC evaluations in progress, who need to submit before the 31 October 2026 close.
- Expiry dates of existing SPoC and CPoC listings that merchants rely on.
- Guidance from PCI SSC on MPoC as the route for new products.
Sources and official references
- Announcement of Sunset Periods for the PCI SPoC and PCI CPoC Standards (bulletin) — PCI Security Standards Council (official source)
Links go to the publisher's own site. Where a standard is sold or copyrighted, MajorCyber™ summarises it in original words and links to the official listing instead of reproducing its text.
Listen to this page
Read aloud in UK English by your own device. Nothing is sent anywhere, and the voice is whichever one your browser provides.
General educational information, not legal or professional advice. Check the official sources and take qualified advice before acting.
