9F8102 Cardholder Verification Decision

In Kernel 8, the card, not the terminal, chooses how the cardholder is verified. The Cardholder Verification Decision is the one-byte answer the card returns in its GENERATE AC response to say which CVM it chose.

Values

• 00 NO CVM
• 01 OBTAIN SIGNATURE
• 02 ONLINE PIN
• 03 CDCVM (verification on the cardholder's device)
• 0F N/A
• FF CV FAILED: none of the CVMs offered is acceptable to the card

How the choice is made

The kernel offers the card a list of CVMs in the GENERATE AC command data, through the Terminal Risk Management Data (9F1D). The list comes from the reader's CVM capabilities: one set above the CVM required limit, another below it. Above the limit, "No CVM" should not be offered. The same data also carries a "CVM limit exceeded" indication and business flags such as a CDCVM bypass request for transit.

The card picks one and returns its decision. Because this can change the TVR, for example to record that online PIN will be entered, the card may also return a Card TVR. The kernel applies it, except for the bits protected by the Kernel Reserved TVR Mask.

What the kernel does with it

The kernel checks that the decision is one it offered, then sets the CVM Results and the CVM in the Outcome Parameter Set:

• NO CVM: CVM Results 1F0002, outcome NO CVM.
• SIGNATURE: 1E0000, outcome OBTAIN SIGNATURE.
• CDCVM: 010002, outcome CONFIRMATION CODE VERIFIED.
• ONLINE PIN: 020000, outcome ONLINE PIN, and "Online CVM captured" set in the TVR.
• CV FAILED, or a CVM that was not offered: 3F0001, outcome N/A, and "Cardholder verification was not successful" set in the TVR.

Common mistakes

• Applying contact-style CVM List processing to a Kernel 8 card. Kernel 8 cards decide.
• Offering "No CVM" above the CVM required limit.
• Forgetting to use the Card TVR in the authorisation, so the TVR the issuer sees does not match the one the cryptogram covers.