🏧 POS terminals and in-store payments around the world

EMV reaches 97% of the world, but whole pockets remain outside

EMV is the set of specifications for chip payment cards. The name comes from Europay, Mastercard, and Visa, the three networks that published the first common specifications in 1996. Governance passed to EMVCo, set up in 1999 and now owned in equal shares by American Express, Discover, JCB, Mastercard, UnionPay, and Visa. EMVCo publishes royalty-free specifications for contact chip, contactless chip, QR codes, tokenization, and 3-D Secure (EMVCo, 2026).

In the fourth quarter of 2025, 97% of card-present transactions were EMV transactions (EMVCo). Behind that figure are migrations driven not by technology but by the liability shift. Under this rule, fraud losses fall on whichever party has not upgraded to chip. A merchant whose terminal reads only the magnetic stripe therefore absorbs fraud that a chip read would have stopped. This mechanism, and nothing else, is what got terminal fleets replaced. Each market set its own liability shift date, so national migrations were staggered.

The 97% global figure covers card transactions only, not all in-person payments. A country with a fully migrated terminal base can still see little card volume. India, Indonesia, Nigeria, and Kenya now handle most of their in-person payments outside the card terminal, where QR codes and agent networks have taken over. In those markets, an acceptance plan sized on the migration rate alone commits spending with no relation to actual card volumes. The last section of this guide covers that case.

Contactless limits, country by country

In a contactless payment, the card or mobile device talks to the terminal by radio, from a few centimeters away, with no insertion or stripe read. The radio layer is governed by ISO/IEC 14443. Application processing runs in the EMV contactless kernels installed in the terminal, one for each accepted network. The exchange takes a few hundred milliseconds and is a full EMV transaction, dynamic cryptogram included. The radio layer is the same for every EMV contactless card. What varies by country is the limit above which cardholder verification becomes mandatory, and who sets it.

Three models coexist. In the European Economic Area, the limit is set by regulation: it comes from the PSD2 technical standards on strong customer authentication. In the UK, the conduct regulator, the FCA, sets it. The FCA kept the same mechanism after Brexit and raised the limit. Elsewhere, the central bank sets it, or the domestic scheme, the operator of the national card network, sets it directly. The source determines how fast the limit can change. A scheme can revise its limit in a few months, while a limit written into regulation takes years to change.

• The cumulative counter lives on the card, not in the terminal. It resets at the first transaction with PIN entry. A cardholder who makes a string of small payments will eventually be asked for a PIN, even though the merchant changed nothing.
• Offline mode is not universal. In Norway, BankAxept works offline and is even a designated channel for cash withdrawals at stores (Norges Bank, December 2025). A terminal that must be online for every transaction cannot serve the same uses.
• The domestic scheme’s limit and the international network’s limit often differ on the same co-badged card. The cardholder just sees a decline; the configuration explains it.
• Unattended terminals follow their own rules. In transit, tolls, and vending, networks allow fallback flows that general retail does not have.

What a terminal must be able to read, by country

A European or US contactless reader handles ISO/IEC 14443 radio types A and B. That covers EMV cards and the mobile wallets that emulate them. It is not enough everywhere. Two markets built in-person acceptance on different radio technologies, and a third on scanning a code displayed on a screen.

Japan runs on FeliCa, a technology developed by Sony, standardized as JIS X 6319-4, and known in the NFC world as type F. FeliCa transmits at 212 or 424 kbit/s, a speed chosen to keep pace with Tokyo subway gates. That requirement shaped Japan’s payment ecosystem: Suica, iD, and QUICPay all depend on it. A standard EMV contactless terminal imported from Europe reads none of the three, so you need a FeliCa-certified reader. That reader is the first hardware cost of a Japan launch, and it has to be decided when you select hardware, not when you roll out.

South Korea took the opposite path. Samsung Pay popularized MST there. MST emulated the magnetic field of a stripe, so it worked on terminals with no NFC. The mobile wallet reached an old terminal base without replacing it, until Samsung dropped the MST module starting with the Galaxy S21 in 2021. Korea’s terminal base had to switch to NFC on a short timeline, and Apple Pay’s arrival exposed how far behind it was.

PCI PTS, EMV L1/L2/L3, and scheme approval: three gates, not one

A payment terminal holds cryptographic keys and protects PIN entry. It needs three separate types of certification, issued by three different bodies on review cycles that do not line up. None of them replaces the others. Mixing them up is the most common mistake in multi-country acceptance projects, even though each involves different contacts, timelines, and geographic scope.

Hardware security falls under the PCI Security Standards Council and its PCI PTS POI standard, short for PIN Transaction Security, Point of Interaction. It covers resistance to physical tampering, PIN pad protection, key management, and detection of case opening. The current version is 7.0 (PCI SSC, document library, accessed August 2026). Approvals are dated and they expire. A terminal still on sale may be certified under a version whose approval window is closing. That blocks new deployments but does not stop merchants from using terminals already in the field.

SoftPOS, MPoC, and Tap to Pay: the phone becomes the terminal

SoftPOS turns an ordinary smartphone into a contactless acceptance point, with no extra hardware. A certified app reads cards and wallets through the device’s NFC. The security framework is the PCI MPoC standard, short for Mobile Payments on COTS, where COTS means commercial off-the-shelf. The PCI Security Standards Council published it in 2022. It merges two earlier standards, SPoC for PIN entry and CPoC for contactless, into a single framework that allows both on the same device (PCI SSC).

The best-known implementation is Apple’s Tap to Pay on iPhone. It is available in more than 60 countries and territories, and merchants can only integrate it through a certified payment provider (Apple, developer.apple.com/tap-to-pay/regions, accessed August 2026). Coverage is nearly complete in Europe, including the UK, Switzerland, Norway, and Ukraine. It remains patchy in Asia-Pacific, where the list includes Australia, Hong Kong, Japan, Malaysia, New Zealand, Singapore, and Taiwan. India, mainland China, Indonesia, Thailand, and South Korea are not on it.

These gaps do not mean the rollout is running late. In these markets, in-person acceptance developed around something other than contactless cards: QR codes in India and Indonesia, VANs and local flows in Korea, closed-loop wallets in China. An equipment project that assumes worldwide availability runs straight into this map. The vendor’s published country list gives coverage market by market, and checking it up front takes 10 minutes.

National POS-to-terminal protocols

The POS-to-terminal protocol is how the merchant’s point-of-sale software talks to the payment device. It is separate from the authorization message exchanged with the acquirer, which remains ISO 8583 in the vast majority of markets, with a dialect for each network. The POS-to-terminal protocol, by contrast, almost never follows a global standard. It is national, sometimes proprietary, often legacy. Adapting it is the most expensive line item in an international rollout, and requirements documents rarely mention it.

In two markets, this goes as far as shaping how the industry is organized. In South Korea, a layer of licensed intermediaries, the VAN companies, sits between the merchant and the issuers and handles authorization and batch submission. They are Nice Information & Telecom, KIS Information, KICC, and Smartro. An integrator accepting payments in Korea goes through a VAN for in-person payments, or a PG (payment gateway) for remote sales. Direct connections are not an option. In Japan, the legacy authorization network is CAFIS, run since 1984 by NTT Data, a telecom operator rather than the banks. CARDNET, an industry joint venture set up in 1995, is the alternative. Every card integration in Japan goes through one of the two.

Europe does have a standardization effort, called nexo. The nexo association publishes acceptance protocols based on ISO 20022, aiming to make terminals, POS systems, and acquirers interchangeable across Europe. Adoption is moving forward through national specifications rather than market demand. France’s CB 6.0 standard, known as FRV6, is an example: it builds on nexo and has been mandatory for new terminals since January 1, 2025. So convergence is real. But it is limited to Europe and moves only as fast as the national specifications that adopt these protocols.

When the government plugs into the checkout

Across a growing part of Southern Europe and the Balkans, the terminal is no longer just a commercial device. It has become a tax reporting device, linked to the cash register and monitored by the tax authority. The goal is the same everywhere: automatically match payments taken on the terminal against the revenue declared to the tax authority. The technical rules, deadlines, and penalties, on the other hand, differ completely from one country to the next.

The Greek regime targets the software layer rather than the hardware on the counter. Connecting to IRIS does not require replacing terminals, but the POS software must support this payment method. A foreign merchant that sets up a Greek entity is subject to the same rules as local merchants. When choosing a provider, the first criterion is its ability to support IRIS Commerce and the AADE (Greek tax authority) system. Price comparison comes second.

Accepting payments where terminals never arrived

A large share of global retail takes payments without a card terminal and will never adopt one, because two other models have filled the gap. Interoperable QR codes cut the cost of an acceptance point to that of a printed sticker: the merchant has no device to pay for and no lease to sign. Agent networks turn a person with a phone into a financial service point. Both models have reached national scale where terminal rollouts never did.

India is the clearest example. The Reserve Bank of India’s Payment Systems Report 2026 shows declines at the same time in bank ATMs, POS terminals, and micro-ATMs. Over the same period, the number of UPI QR codes reached 73.13 crore, or about 731 million acceptance points, up 7.8% in six months. Together, these trends show one instrument replacing another, not a failure to deploy card terminals. In India, acceptance is built around the static QR code and the audio confirmation device known as the Soundbox.

These standards share a common base, the EMVCo QR Code specification, which defines the code’s data structure. They do not share governance or pricing rules: each one answers to its own central bank or national operator. Southeast Asia has added cross-border interoperability. The region’s central banks have linked their standards under the Regional Payment Connectivity agreement. The bilateral links are run by NITMX, PayNet, ASPI, NETS, NAPAS, the National Bank of Cambodia, and LAPNet. As a result, a Thai traveler can pay an Indonesian merchant by scanning the local QR code from their usual app.

Sub-Saharan Africa took another path: the agent. Nigeria’s network grew from 83,560 agents in January 2019 to 1.92 million in August 2024 (SANEF / Central Bank of Nigeria). The Guidelines for the Operations of Agent Banking in Nigeria, dated October 6, 2025, now govern that growth. In Kenya, Kenswitch reports 26 member banks and more than 2,500 ATMs, with about 40,000 terminals and 50,000 agents connected (Kenswitch, 2026). In Egypt, Aman, a Raya Holding subsidiary, claims more than 250 branches, more than 200,000 merchants, and 150,000 terminals (Aman, 2026). An agent offers a wider range of services than a terminal: the same service point also handles deposits, withdrawals, and bill payments.

Opening a country: the order of checks

International acceptance projects rarely fail because of the card itself: global networks work everywhere, and provider tooling is mature. They fail on local obligations that were missing from the original requirements and surfaced too late to absorb. The order of the checks matters as much as what they cover.

• Which instrument actually carries in-person payments? Card, QR, agent, closed-loop wallet. The answer drives everything else, and you cannot infer it from GDP.
• Is there a domestic debit scheme, and does the contract cover it? eftpos in Australia, Interac in Canada, girocard in Germany, Bancontact in Belgium, DinaCard in Serbia, MyDebit in Malaysia, NAPAS in Vietnam. A contract that leaves it out turns away some local cardholders at the counter.
• Is an intermediary layer mandatory? VANs in Korea, Shva in Israel, Prosa or E-Global in Mexico, Redsys in Spain, NCCC in Taiwan. Answer this before choosing a terminal.
• Which hardware approvals does the market require, and how long are they valid? PCI PTS POI, EMV Level 1 and 2, then national approval. Ask for expiration dates, not just proof that the certificate exists.
• Does the terminal carry tax obligations? POS pairing in Italy, the myAADE registry and IRIS in Greece, interconnection and reporting elsewhere. The penalty hits the merchant, and the commercial liability flows back to the provider.
• Which radio technologies must you read? FeliCa in Japan, Octopus in Hong Kong, QR wherever it dominates. This determines the hardware model, and therefore the lead time.
• Is SoftPOS available, and does it make sense? Check service coverage, then the mix of phones your staff uses. Both conditions must hold.
• Who is the leading local aggregator? In emerging markets, it is the real technical entry point. That choice, not the scheme contract, determines coverage.