The Signal
IDEMIA Wins First EMVCo Certification for PQC Payment Cards
IDEMIA Secure Transactions says EMVCo has certified its first payment-card platform to provide access to post-quantum cryptography and crypto-agility services. The Java Card platform combines a hardware accelerator with IDEMIA’s Sphere PQC
Quantum.world Team · Written with AI · fact-checked ·
EMVCo certifies IDEMIA’s payment-card platform
On October 29, IDEMIA Secure Transactions announced that it had received the first EMVCo certification for a payment-card platform offering access to post-quantum cryptography (PQC) and crypto-agility services. The company says the certification lets banks prepare card programs for future quantum threats while keeping them compatible with existing payment infrastructure. The announcement covers a certified platform, not a named bank’s card launch.
The platform is built on Java Card and runs current payment applications, according to IDEMIA. Its design adds a route for card applications to use post-quantum algorithms without requiring banks to replace the payment experience customers already use. IDEMIA describes the certification as an industry first.
A hardware accelerator handles card-side cryptography
IDEMIA’s design pairs a secure chip with a dedicated hardware post-quantum accelerator. Applications can access the IDEMIA Sphere PQC library, which the company says is adapted to the memory and processing limits of payment cards. That combination puts the cryptographic work on the card rather than relying only on changes to banks’ wider systems.
EMVCo certification establishes that the submitted platform meets the applicable certification requirements; IDEMIA presents it as compatible with current payment infrastructure. The announcement does not name a card issuer, set a commercial rollout date or say that newly issued cards are already using PQC in transactions. The milestone is therefore a certified technical option for issuers, rather than evidence of a live deployment at a bank.
Crypto-agility gives issuers room to update algorithms
The second part of the offering is crypto-agility: services intended to let card security adapt as algorithms and standards change. For payment cards, which remain in circulation after issuance, that flexibility can reduce the need to tie a card’s security to one cryptographic choice for its full service life. IDEMIA says banks can preserve existing card programs while preparing for quantum-resistant offline payments.
Marc Bertin, CTO of IDEMIA Secure Transactions, framed the preparation as work banks should begin before quantum computers can threaten current cryptography:
“Post-quantum security is not a challenge banks can afford to address only when quantum computers become capable of breaking today’s cryptography.”
Marc Bertin, CTO, IDEMIA Secure Transactions
Certification is a platform milestone, not a rollout
The announcement signals that post-quantum functions can be incorporated into a certified payment-card platform while existing applications remain supported. It does not establish that payment networks, terminals or issuing banks have begun deploying those functions at scale. Banks would still need to decide when and how to adopt the capability within their own card programs.
IDEMIA’s immediate result is narrower and more concrete: a certified Java Card platform with a hardware PQC accelerator, access to the Sphere library and crypto-agility services. No issuer or deployment schedule accompanies the announcement, leaving adoption details for banks to determine.