PTS v5 hard stop extended by 1 year to 30 April 2027 following clear evidence of new PTS terminals availability squeeze

Barry Levett

CEO

For my final blog post of 2025, I decided to look at the revised PTS v5 'hard stop' of 30 April 2027 and see it as yet another opportunity for accelerated adoption of SoftPOS by PSPs, acquirers and their merchants.

On 11 September 2025, the PCI Security Standards Council (PCI SSC) announced an important global change affecting payment terminals. The validity period for PTS POI (PIN Transaction Security – Point of Interaction) version 5 devices was extended by one year. The previous expiration date was 30 April 2026, but it became clear that the hardware vendors and their supply chains were struggling to meet that deadline as they faced a mix of technology and skills shortages. To quote PCI SSC's own press release on this announcement:

"(This) extension is intended to support secure deployment continuity in the face of widespread ecosystem challenges, such as limited technician availability, constrained hardware supply, and complex upgrade timelines, particularly in embedded, unattended, and multi-component environments."

So, what does v6 offer which is not in v5? What are merchants and their customers likely to be missing out on as their migrations are delayed by another year? There appear to be three core security benefits associated with v6 which are worth noting:

1. Stronger encryption standards: These algorithms safeguard sensitive payment data during transmission and storage.

2. More advanced authentication methods: Multi-factor authentication strengthens transaction security and access controls.

3. Improved physical security: Devices are designed with stronger tamper-resistance features to prevent unauthorised access or data breaches.

For more than a decade, card acceptance has been constrained by vendor hardware: PTS POI terminals have to be ordered, shipped, installed, maintained, tracked, reported on, and eventually replaced.

Acquirers are obligated by the PCI SSC to maintain a complete and accurate inventory of every PTS device they deploy. Records of device models, their versions, serial numbers, PCI-PTS approval class and expiry dates, chain of custody records, device swaps, replacement and returns, and even secure destruction of device records, must all be auditable by PCI assessors, schemes and regulators. Monitoring, inspection and record retention requirements have only increased over time.

In addition, many of the larger payment service providers (PSPs) and acquirers rely on device variants which need localised EMV kernels, contactless kernels, national debit requirements (such as girocard in Germany and Interac in Canada), and local acceptance apps.

The costs associated with all this are initially carried by the PSP or acquirer and passed onto merchants via rental contracts. The onerous nature of all this is evident right now in the reported problems of PSPs the world over, with the expiring PTS POI v5 terminal fleets and their inability to roll out new v5 terminals to hit the initial deadline, now only four months away. The earlier hard stop on v5 terminals caught many in the channel off guard, as PSPs have grown used to phased, multi-year version cycles which typically allow up to three years for new versions to be deployed across their estates.

In addition, some terminal vendors have decided to 'end of life' older Android hardware instead of upgrading product lines to v6. This has created gaps in product portfolios which were not likely to be filled in time. Simultaneously, there have been delays in certification of new localised variants of v6 and v7 terminals. For example, PCI SSC reported that only a handful of Multilane v6 terminals were approved across all vendors by the end of Q1 2025, and there is strong evidence of backlogs in certifications of regional variants.

The unreadiness of the supply chain for v6 is further compounded by Android security patch lifecycles not being aligned with payment security cycles, leading to shorter terminal life unless PTS vendors commit to long-term patching and firmware upgrades.

Some PSPs, anticipating potential shortages of v5 devices as the original install deadline approached, had been bulk buying from their PTS vendor partners, further accentuating shortages in the supply chain. Others have embarked on a multi-vendor strategy to support their merchant estates more resiliently. However, again, the original hard stop deadline was not giving them enough time to cement new vendor relationships to ensure they could replenish their terminal fleets in time.

As pressure in the supply chain built, both to buy and install v5 PTS before the impending deadline, or lay their hands on enough v6 devices to support swap outs over the next 18 months, newer Android terminal costs rose by between 15-35 per cent, according to industry analyst Aite-Novarica over the last two years (2023-2024).

Simultaneously, many merchants were reportedly resisting replacement of v5 hardware, partly due to their own budgetary constraints, and because of a perception amongst many of them that the v5 PTS devices they are using in their stores today, had more life left in them.

All of these factors taken together were starting to put many PSPs in jeopardy of violating PCI programme rules come May 2026. Many were likely to be still deploying stockpiled v5 terminals after the 30 April 2026 deadline.

The extra year provides PTS hardware vendors, PSPs and merchants themselves with more breathing space to complete upgrade activity. But could PSPs also use the extra time to design and roll out new SoftPOS offerings? Mypinpad would certainly like to think so. It may not be plain sailing for all PSPs looking to move rapidly away from their current hardware dependencies to SoftPOS, but eliminating current onerous hardware dependencies, and thus allowing merchants a wider choice of which mobile device to take payments on, can only be a positive and more sustainable step for agile PSPs.

There is no doubt that the hard stop of PCI PTS v5 on 30 April 2027, even if it is delayed by a year, is still representing the biggest shake up in payment terminal estates — since PSPs and acquirers were forced to roll out EMV-certified terminals as the so-called 'Chip and PIN' revolution rolled out across the world from 2005 onwards. It's a shake-up which can only stimulate thoughts of accelerating adoption of SoftPOS.

Mypinpad will soon publish a white paper which we've written to explore the coming of age of SoftPOS in a good deal more detail. Look out for it on our website and via Mypinpad's ongoing external communications if you are signed up to receive those updates.

And I'll be continuing to share my thoughts and views on the market in the New Year. But in the meantime, have a great break.

Crossed the Chasm: The coming of age of SoftPOS provides solid foundations for rapid adoption of consumer device-based Tap to Everything innovations