PCI PTS v7.0 Payment Terminal Requirement: What Actually Changes for Retail Buyers

PCI PTS POI v7.0 was published on 29 May 2025 and contains 59 requirement changes plus 23 pieces of additional guidance. For a retail buyer, the headline number is the least useful fact in it. Two dates matter more: PTS POI v6 closed for new device approvals on 30 June 2026, while v6 device approvals stay valid until April 2032. Buying a v6-approved terminal in 2026 is not a compliance problem. Replacing one is a budget decision, not a legal one.

What changed in PCI PTS POI v7.0, and what it means for you

Five changes carry procurement consequences. The rest is test-procedure detail that only the laboratory and the vendor’s engineering team ever see.

Source: PCI SSC’s own announcement of PTS POI v7.0.

The third row is the one most often missed. A specification sheet claiming “secure firmware boot” tells you nothing about the key length behind it.

alt=”Kingtop S600 PCI PTS certified smart POS terminal for retail checkout” loading=”lazy” width=”600″ height=”600″>

Which PTS POI device category applies to your terminal?

The standard covers six device categories, and buying the wrong one is a procurement error that surfaces only at integration time. PCI SSC defines them as PIN Entry Devices (PEDs), Unattended Payment Terminals (UPT), Non-PIN acceptance devices (Non-PEDs) evaluated for account data protection, Encrypting PIN pads (EPPs) requiring integration into larger devices such as ATMs, secure components for POS terminals such as Secure Card Readers (SCRs), and Secure Card Reader-PINs (SCRPs), which are encrypting card readers intended for use with commercial-off-the-shelf devices such as a mobile phone or tablet.

Full definitions are on the PCI PTS Point of Interaction standard page.

A merchant who requests “a PCI certified terminal” without naming the category can receive a Non-PED device for a workflow that requires PIN entry. The approval is genuine; it simply does not cover what the terminal will be asked to do. Ask for the category, not just the fact of approval.

alt=”Kingtop V510 wireless mobile POS terminal with built-in thermal printer” loading=”lazy” width=”600″ height=”600″>

When does a PCI-approved payment terminal actually expire?

Two different dates are published for every requirement version, and they sit six years apart. Buyers routinely read only one of them.

The pattern is stated directly: PCI SSC device approvals expire six years past the effective date of a subsequent major update. The June 2026 date therefore means the laboratory can no longer evaluate a new device against v6. It does not invalidate a v6 approval already issued.

A third date decides whether a purchase is a three-year or a six-year asset. PCI SSC states that POI v6 or higher firmware expires three years from the date of approval, without extending past the overall approval expiration of the device. A v7 device approved this month carries firmware support for roughly three years. A buyer running a five-year replacement cycle is buying a support gap.

One exception: SCRP approvals expire five years after the date of approval rather than following the schedule above.

All three dates come from the additional information published alongside the PCI SSC approved device listings — the same page that records PIN support and key management fields.

Is a v6-approved device a security problem?

No, and treating it as one is the most common expensive misreading of this standard. v6 approvals remain valid to April 2032. A merchant running v6 hardware today is operating inside the approval window, not outside it.

What v6 does forbid is worth knowing for a different reason. The listing notes that Fixed Key is not allowed for POI v6 and higher devices, and that DUKPT is the only unique-key-per-transaction algorithm (ANSI X9.24) PCI SSC recognises. An approval letter showing “Fixed” dates the device to an earlier requirement version. That is a clue, not an accusation.

What to put in the purchase order

Five items, in the order they should be requested:

1. The approval number, so it can be looked up in PCI SSC’s public listing instead of accepted on a PDF.
2. The approval category — PED, UPT, Non-PED, EPP, SCR or SCRP.
3. The firmware support end date implied by the three-year rule, written down.
4. The key management method on the approval letter: MK/SK, DUKPT or Fixed.
5. Whether third-party app installation is covered, and inside what sandbox.

Items 1, 2 and 4 are all public listing fields. Nothing on that list requires a supplier to make a claim, which is exactly why it is the right list.

Where Kingtop fits

Kingtop is a China-based manufacturer of 5G PDA terminals, mobile hotspots, POS terminals, body-worn cameras and rugged tablets, supplying wholesalers, OEMs and distributors. The full product range spans handheld, POS and tablet form factors; certification records are published on our credentials page.

Worth stating plainly: the handheld families, including the KP18 5G and KP26 5G, sit outside PTS scope entirely. They capture barcodes, forms and photos. Card acceptance is a different boundary, handled by the POS line such as the V520.

Because Kingtop builds to order for OEM and ODM programmes, the approval number, category and firmware end date belong in the order attachment, confirmed per SKU rather than inherited from a brochure. The same standard applies to any supplier willing to put those three fields in writing. For a volume quotation, request it alongside the S600 specifications.

Frequently asked questions

Do I have to replace PCI PTS v6 terminals in 2026?

No. The 30 June 2026 date closed new device approvals evaluated against v6. Approvals already issued under v6 remain valid until April 2032. A replacement programme is a budget decision, and it should be justified by fleet age, not by the standard’s version number.

What is the difference between a requirement version and a device approval?

A requirement version is the rulebook a laboratory evaluates against. A device approval is the certificate issued to one model under one version of that rulebook. The rulebook version expires first — June 2026 for v6 — and the approval outlives it by roughly six years. Confusing the two produces both premature replacement and false panic.

Can I load my own application on a PTS POI v7.0 terminal?

v7.0 adds a requirement permitting third-party applications, including app stores. Whether a specific application qualifies depends on how the approval defines the sandbox. Get the answer in writing rather than from a feature list, because “supports third-party apps” and “supports your app” are different claims.

Does PCI PTS approval mean the device stays supported forever?

No. Firmware support for POI v6 and higher expires three years from the approval date, separately from the device approval itself. That is a maintenance window, and it is usually shorter than the replacement cycle buyers assume. Check it before committing to a five-year refresh plan.

Who actually requires a PCI PTS approval?

The acquirer and the card schemes, not the standard itself. PCI PTS is a standard rather than a law, and it becomes binding commercially when an acquirer declines to onboard a terminal that lacks a valid approval for its intended use.

About the author

This article was written by the Kingtop Product Team, the product and applications group at Kingtop (Shenzhen Jintaiyi Electronics Co., Ltd. and Dongguan Jintaiyi Electronics Co., Ltd.), a China-based manufacturer of 5G PDA terminals, mobile hotspots, POS terminals, body-worn cameras and rugged tablets.

Last updated: 21 October 2026

Editorial policy: Claims about PCI Security Standards Council requirements are sourced from PCI SSC’s own publications and listings, cited inline and dated. Competitor and third-party device parameters are taken from manufacturer-published sources and linked. Kingtop’s own product data is drawn from the datasheets behind our published credentials record. Where a value could not be verified against a primary source, it is described qualitatively rather than stated as a figure. Corrections are issued as dated updates at the top of this page.

Talk to us about your payment terminal programme. Send the SKU list and the approval numbers you already hold, and we will tell you which gaps are real and which are paperwork. Browse the Kingtop product range or write to us through the contact page for an OEM or ODM quotation.