Overview

Payment industry standards for securing cardholder data continually evolve in an effort to protect merchants and consumers. CardConnect works closely with the card brands to ensure that the CardPointe Gateway and related services are certified for compliance with industry standards and mandates.

Historically, CardConnect has worked to certify features and devices across a wide-range of payment processors; however, to better scale and support the CardPointe Gateway, and to provide our merchants with peace of mind and compliance with industry standards and certifications, we have made the difficult decision to limit future development and certification efforts to the following processing platforms:

  • First Data Rapid Connect
  • First Data North
  • First Data Omaha
  • First Data South

Moving forward, all new card-not-present and e-commerce CardPointe Gateway features that require certification by the card brands (for example, the Visa and Mastercard Stored Credentials Mandate) will only be available for merchants processing on these First Data/Fiserv platforms.

Additionally, all new EMV-certified card-present payment devices (for example, Ingenico Tetra series Bolt terminals) will only be certified and available for merchants processing on the Rapid Connect platform.

Select a topic from the left pane for more information on our current compliance and certification initiatives. 

Card-Not-Present Payment Certifications

All new card-not-present payment certifications in progress are limited to merchants processing on First Data/Fiserv platforms. To take advantage of these new features and the CardPointe Gateway's compliance with card brand and industry standards, you or your merchants must be boarded to one of these platforms.

Each feature certification effort requires processor-specific development, testing, and validation before the feature can be made available for merchants using a given platform. 

We are currently in the process of certifying the CardPointe Gateway for compliance with the following standards and mandates:

EMV Payment Device Certifications

All new EMV payment device certifications in progress are limited to merchants processing on the First Data Rapid Connect platform. To take advantage of new EMV-certified payment devices and terminals (for example, Ingenico Tetra series Bolt terminals), you or your merchants must be boarded to the First Data Rapid Connect processor.

All new EMV payment devices must be tested and certified for data integrity and security compliance. PCI PTS payment devices require additional validation to ensure that they meet the standards defined by the PCI Council for use within a point-to-point encryption (P2PE) solution (for example, the Bolt Terminal solution).

The following EMV payment devices were recently certified and are now available only for merchants on the Rapid Connect Platform:

  • Bolt Clover Flex terminal
  • Bolt Clover Mini terminal
  • Bolt Desktop/CardPointe Virtual Terminal card reader device (ID TECH Augusta)
  • Bolt Mobile/CardPointe Mobile card reader device (ID TECH VP3300)
  • CardPointe Terminal (Ingenico Desk 3500/Desk 5000) 

Additionally, we are currently in the process of certifying the following new devices:

  • Ingenico Tetra series terminals (Lane/3000, Lane/5000, and Lane/7000) for use with the Bolt Terminal solution 
  • Bolt Unattended card reader device (ID TECH VP5300)

Understanding PCI PTS Device Lifecycles

PTS payment devices that are validated by the PCI council for use within a P2PE solution are assigned a PCI version number, which corresponds to a validation period. In addition to each manufacturer's product support lifecycle, the PCI version and expiration date should play a significant role as you plan to support and upgrade your payment devices in the field.

Additionally, PCI PTS devices are granted a 5-year grace period, effective after the date of the PCI version expiry, in which the associated P2PE component (for example, the version of the Bolt Terminal application running on the device) can be revalidated. 

For example, a PCI v3.x device with an expiry of April 30, 2021 may remain in use until April 30, 2026 as long as the device is running a PCI-validated application.

As described in the Bolt Ingenico Telium End-of-Life Notice, Ingenico is ending support for the current Telium series of terminals, and these devices are no longer available from the manufacturer. Current devices in the field are supported through the PCI expiry date (dependent on the PCI version); however new Bolt Terminal and CardPointe Terminal orders will only be fulfilled with Ingenico Tetra series terminal devices, which are certified and available only to merchants on the First Data Rapid Connect platform.

The following table provides detailed lifecycle planning information on the available PCI PTS devices:

Hardware Vendor POI Application Model PCI Version PCI Version Expiry Last Time to Order Vendor End of Life Vendor End of Service Replacement Device
Clover Bolt (for Clover) 1.4.x Clover Mini
(2nd Generation)
v5.x April 30, 2026 TBD TBD TBD TBD
Clover Flex
(2nd Generation)
v5.x April 30, 2026 TBD TBD TBD TBD
ID TECH - Augusta v4.x April 30, 2023 TBD TBD TBD TBD
- SecuRED v3.x April 30, 2021 TBD TBD TBD Augusta
- SREDKey v3.x April 30, 2021 TBD TBD TBD SREDKey 2
-

SREDKey 2

v5.xApril 30, 2026TBDTBDTBDTBD
Ingenico Bolt 1.6.x - 2.0.0 iPP310/iPP320/iPP350 v3.x April 30, 2021 March 31, 2018 June 30, 2018 June 30, 2021 Lane 3000 or 5000
v4.x April 30, 2023 December 31, 2019 March 31, 2020 March 31, 2023 Lane 3000 or 5000
iSC250-Touch v4.x April 30, 2023 December 31, 2019 March 31, 2020 March 31, 2023 Lane 7000
iSMP4 v4.x April 30, 2023 TBD TBD TBD TBD
Bolt 2.0.1 Lane 3000 v5.x April 30, 2026 TBD TBD TBD TBD
Lane 5000 v5.x April 30, 2026 TBD TBD TBD TBD
Lane 7000 v5.x April 30, 2026 TBD TBD TBD TBD

Bolt Terminal PIN Debit Support

PIN Debit support is now available on Bolt Ingenico terminals for merchants processing on Rapid Connect.

Support for PIN Debit on the First Data North platform is now deprecated; all new or existing merchants who want to begin to accept PIN debit transactions must be boarded to the Rapid Connect platform. See Accepting PIN Debit Cards in the Bolt Terminal Developer Guide for detailed requirements.

FAQs

Why is CardConnect making this change?

This decision was not something we took lightly, and we understand that changing your processor to match your gateway may have not been in your plans for the immediate future. We chose to move forward in this direction to provide the best possible experience for our merchants via updated technology and streamlined support.

Technology: Moving to the First Data Rapid Connect platform gives your business access to multiple upcoming products we'll be releasing within the next year. These products include our new line of Tetra devices, providing the latest in in-person payment technology. Additionally, you will get access to other updates like PIN Debit acceptance, Bolt Unattended devices, and the Card Account Updater API.

Support: With your current configuration, your business is reliant on two separate support teams: one for your gateway and one for your processor. By moving to First Data Rapid Connect, a Fiserv Platform, your support needs will be consolidated into one 24/7, award-winning support team for all of your processing questions and concerns.

Can I use my existing devices if I switch processors?

Yes, we can work to reprogram your current devices remotely once your account is set up.

What if I don't make this change?

If you are not on a First Data/Fiserv processing platform, and you do not migrate to one, you will be subject to potential fines and downgrades, as well as limited access to future CardConnect products and services.

What fines could I incur? What downgrades?

Fines: These will be dependent on your current processor and how they choose to pass through fines they are assessed.

Downgrades: Just like any other downgrade, this will be dependent on how you are priced by your processor. Downgrades occur when a transaction does not include certain parameters correctly within the transaction data.

Will CardConnect cover those fines?

The potential fines are part of an industry-wide mandate. Should you choose to remain on a non-certified platform, CardConnect will not reimburse fees that occur as a result.