9F33 Terminal Capabilities

Terminal Capabilities are three bytes describing what the terminal can do: how it reads cards, how it verifies cardholders and which security functions it supports. The value comes from the terminal configuration and drives several decisions during the transaction.

The bytes

• Byte 1, card data input: b8 manual key entry, b7 magnetic stripe, b6 IC with contacts.
• Byte 2, CVM capability: b8 plaintext PIN for ICC verification, b7 enciphered PIN for online verification, b6 signature (paper), b5 enciphered PIN for offline verification, b4 no CVM required.
• Byte 3, security capability: b8 SDA, b7 DDA, b6 card capture, b4 CDA.

The other bits are reserved.

How it is used

During cardholder verification, conditions such as "if terminal supports the CVM" in the CVM List are checked against byte 2. For offline data authentication, the terminal picks the best method that both it (byte 3) and the card (AIP) support. Cards can also request 9F33 in a DOL and apply their own risk rules to it.

Example

9F33 03 E0 F0 C8: manual entry, magnetic stripe and contact chip; plaintext and enciphered offline PIN, online PIN and signature; SDA, DDA and CDA. This is typical for an attended terminal with a PIN pad.

Kernel differences

9F33 belongs to the contact kernel. Contactless kernels usually have their own capability settings, and some build the 9F33 value they send from that configuration, for example per CVM limit. Do not assume the contact value is what the contactless kernel reports.

Common mistakes

• Declaring a capability the terminal does not really have, such as offline PIN without a certified PIN pad. CVM selection then picks a method that cannot be completed.
• Declaring "no CVM required" on terminals where the scheme does not allow it.
• Changing 9F33 without updating the Level 3 test configuration. It is part of the approved setup.