You are launching a payment card program—whether as an issuer, a program manager, a fintech, or a co-brand partner—and the plastic in your customer’s wallet is the one physical touchpoint of your entire brand. Yet an EMV contactless payment card is not a printed PVC rectangle. It is a certified, key-loaded security product governed by EMVCo and the payment schemes, and a vague purchase order is where most launches go wrong. This guide walks procurement, product, and program teams through exactly what to specify—interface, certification, body, personalization, key custody, and total cost—so your first batch clears terminals, passes scheme audits, and ships on time.
Define the card profile: dual-interface is the procurement baseline
Start with the physical and electrical profile. A modern payment card should be an ID-1 / CR80 card to ISO/IEC 7810 (85.6 × 54.0 mm, 0.76 mm nominal thickness) with a dual-interface chip: a single secure element that exposes both a contact interface to ISO/IEC 7816 and a contactless interface to ISO/IEC 14443 (NFC, 13.56 MHz). Contactless now dominates in-store tap-to-pay volume, while the contact plate remains mandatory for ATMs and some legacy terminals. From a procurement standpoint, default to dual-interface (contact + contactless) cards unless you have a concrete reason to drop the contact plate—doing so protects you from terminal gaps and future scheme mandates.
Also specify the chip’s flash memory (typically 32–80 KB for a multi-application EMV applet set), the operating system, and the supported applications up front. Java Card and GlobalPlatform are the de-facto standards; the card OS decides which scheme applets you can load later. If you only need a single scheme and a pure contactless experience, a contactless-only card can save a little cost—but dual-interface is the safer baseline for a program you expect to scale. Our dual-interface smart card breakdown explains the real buyer value in more detail.
EMVCo certification: the standards your supplier must prove
EMVCo—owned by American Express, Discover, JCB, Mastercard, UnionPay, and Visa—maintains the EMV specifications, including EMV Contactless, the unified standard that absorbed Visa payWave, Mastercard PayPass, and Amex ExpressPass. For procurement, certification is not optional. Only buy cards whose product carries current EMVCo Type Approval, and only use a personalizer that holds the EMVCo Card Production Security Standard (CPSS) accreditation plus the individual scheme personalization approvals (Visa, Mastercard, UnionPay, and so on). An uncertified card can be rejected by terminals in the field or blocked by your acquiring or processing partner, which means re-issuance at your expense.
Treat the supplier’s approval letters as a gating checklist, not a nice-to-have, and verify them against the live list rather than accepting a PDF at face value. Our smart card certifications guide decodes Common Criteria, EMVCo, and FIPS side by side, and EMVCo’s official site publishes the current approvals and contactless specifications you can cite directly in your RFQ.
Card body and durability: PVC, rPET, or composite PET?
The card body drives both cost and lifespan. Bare PVC is the lowest-cost option and fine for short-life or promotional programs. Recycled PVC (rPVC) or rPET cores meet ESG and public-tender requirements without a large cost step. Composite PET/PET-G and polycarbonate (PC) resist heat, humidity, and chemicals far better and are the right call for cards expected to survive three to five years of daily use. Magstripe is now optional: specify a HiCo (2750 Oe) stripe only if you must serve legacy, transit, or ATM environments that still read tracks.
| Body material | Typical field life | Best for |
|---|---|---|
| Bare PVC | ~1–2 years | Promotional, short-life, cost-first programs |
| rPVC / rPET core | ~2–3 years | ESG and public-tender compliance |
| Composite PET / PET-G | ~3–5 years | Daily-use payment and ID cards |
| Polycarbonate (PC) | 5+ years | Government, e-passport, high-durability programs |
Whatever you choose, write ISO/IEC 10373 acceptance criteria—bending, torsion, temperature, and abrasion—into the contract so “durability” is measurable, not a promise. For cards that must survive years in daily use, specify composite PET or PC rather than bare PVC and copy the test limits from our card durability testing guide into your spec.
Personalization: what the issuer owns vs. what the factory encodes
There are two valid models. In the factory-personalized model, you transmit cardholder and key material to the vendor under split-knowledge, dual-control procedures; the factory encodes the chip applets, prints, embosses, and attaches the magstripe CVN. In the issuer-personalized model, you receive blank or pre-personalized cards and run encoding in your own key management system (KMS) on an HSM. Either way, you own the Issuer Master Key (IMK) and the PAN range; the factory should never hold your root keys.
EMV personalization loads the scheme applets (VISA APP, Mastercard M/Chip, and so on) and the data-authentication keys (SDA/DDA/CDA), and must follow PCI PIN Security for any PIN or key handling. Decide this split before you request quotes—it changes the security questionnaire you send to every bidder. Our EMV payment card personalization guide details exactly what issuers must specify, and the PCI Security Standards Council publishes the PIN Security requirements your personalizer must meet.
Total cost of ownership: compare factory-direct vs. reseller quotes
A card quote is not a card price. The real per-unit cost bundles the body, the EMVCo-approved chip, the OS/applet license, personalization setup, key loading, fulfillment and packaging, shipping, and often foreign-exchange and reject-rate buffers. Factory-direct sourcing lowers the per-unit rate at volume but usually carries higher MOQs and tooling costs; a reseller buys you speed and low minimums at a markup. The only way to compare is a fully loaded, like-for-like quote from at least three suppliers—a low card price often hides personalization and key-loading fees.
| Cost component | Factory-direct | Reseller |
|---|---|---|
| Per-unit body + chip | Lowest at volume | Marked up |
| Tooling / MOQ | Higher barrier | Low or none |
| Personalization & key loading | Quoted separately | Quoted separately |
| Lead time | Longer | Shorter |
| Quality-risk ownership | With you (verify audits) | Shared via vendor |
Our factory-direct vs reseller analysis lays out the quality-risk trade-offs so you can plan the comparison around total cost of ownership rather than the headline number.
The procurement checklist: a spec template to send suppliers
Turn the points above into a single RFQ attachment. At minimum it should state: card profile (dual-interface, ISO/IEC 7810 ID-1, 0.76 mm), chip (EMVCo-approved, memory, Java Card/GlobalPlatform OS), contactless (ISO/IEC 14443, NFC), optional HiCo magstripe, durability (ISO/IEC 10373 limits), security printing (UV, microtext, hologram overlay), personalization scope, key custody (PCI PIN / HSM, IMK never leaves issuer), certifications (EMVCo Type Approval, CPSS, scheme approvals), QA (first-article sample + incoming inspection), lead time, MOQ, and a warranty/failure-rate SLA. Hand this to every bidder so responses are comparable.
You can start from our smart card RFQ specification template and adapt it for payment—most of the structure carries over, and the payment-specific certification and key-custody lines are the parts issuers most often forget.
Frequently asked questions
Do I need EMVCo approval, or does my processor handle it?
Your acquiring or processing partner will require an EMVCo-approved card product and may re-verify it. The product approval belongs to the card supplier; your program additionally needs scheme certification of the personalization step. You specify the approved product—don’t assume the processor covers it.
Is a magnetic stripe still required on EMV contactless cards?
For most modern POS, no—chip and contactless are sufficient. Keep a HiCo magstripe only where you must support legacy terminals, ATM cash access, or certain transit systems. Our magnetic stripe in 2026 guide covers when it still makes sense.
Can one factory do both card production and EMV personalization securely?
Yes, provided the vendor holds EMVCo CPSS and the scheme personalization approvals and follows PCI PIN Security for key loading. If a candidate lacks those, split the work: produce blanks at the factory and personalize at a certified bureau or in your own HSM.
What lead time should I plan for a new issuance?
Blank card production typically runs 2–4 weeks; personalization and fulfillment add 1–3 weeks; first-article samples and scheme/EMVCo sign-off for a new program can add 4–8 weeks. Budget 10–14 weeks end-to-end for a first issuance.
Turn the checklist into a production-ready spec
Specifying an EMV contactless payment card is less about “buy plastic” and more about buying a certified, key-managed security component with a three-to-five-year field life. Get the interface, the EMVCo and scheme certifications, the body durability, the personalization/key split, and the total cost nailed down in one RFQ, and your launch stops being a fire drill. As a card manufacturer since 2005, we help issuers and program managers turn this checklist into a production-ready spec—request our EMV payment card RFQ template or a first-article sample to start.
