95 Terminal Verification Results (TVR)

The Terminal Verification Results are five bytes the terminal fills in during an EMV transaction. Each bit records the outcome of one check: offline data authentication, processing restrictions, cardholder verification, terminal risk management and issuer authentication. The terminal starts the transaction with every bit at zero and sets bits as problems or notable events occur.

What each byte covers

• Byte 1, offline data authentication. Whether SDA, DDA or CDA was performed and whether it failed, plus missing ICC data and a card on the exception file.
• Byte 2, processing restrictions. Application version mismatch, expired or not yet effective application, service not allowed for this card product, new card.
• Byte 3, cardholder verification. CVM not successful, unrecognised CVM, PIN try limit exceeded, PIN pad missing or not working, PIN not entered, online PIN entered.
• Byte 4, terminal risk management. Floor limit exceeded, lower and upper consecutive offline limits exceeded, random selection for online, merchant forced online.
• Byte 5, issuer authentication and scripts. Default TDOL used, issuer authentication failed, script processing failed before or after the final GENERATE AC.

Use the decoder on this page, or the full TVR and TSI decoder, to see every bit by name.

How the terminal uses it

In terminal action analysis, the terminal compares the TVR with two sets of masks: the Issuer Action Codes from the card (9F0D Default, 9F0E Denial, 9F0F Online) and the Terminal Action Codes configured by the acquirer. If a TVR bit is also set in a Denial code, the terminal asks for an AAC. If it matches an Online code and the terminal can go online, it asks for an ARQC. Otherwise it can ask for a TC and approve offline. The TVR then travels to the issuer in field 55, so the issuer sees exactly what the terminal found.

Kernel differences

The contact kernel uses the layout above, from EMV Book 3. Contactless kernels differ. Kernel 2 (Mastercard) keeps the TVR but uses bits in byte 5 for its relay resistance protocol. Kernel 8 defines its own TVR layout. Visa's Kernel 3 does not use the TVR at all: its decisions rely on the TTQ and the card's own risk management. Always decode a TVR with the layout of the kernel that produced it.

Example

95 05 00 00 00 80 00: only byte 4 bit 8 is set, Transaction exceeds floor limit. This is the most common TVR you will see on a terminal configured with a zero floor limit, and it is what sends every transaction online when the online action codes include that bit.

Common mistakes

• Counting bits from the wrong end. EMV numbers bits b8 (most significant) to b1.
• Decoding a Kernel 2 or Kernel 8 TVR with the contact layout, which gives wrong meanings for byte 5 or the whole value.
• Expecting the TVR to say whether a check succeeded when it was not performed. Read it together with the TSI.
• Forgetting that a zero floor limit sets byte 4 bit 8 on every transaction.