Kernel in the Cloud Release Notes

• Discover Acceptance: Expanded support for more payment options.
• Google 16kb Page Size Compliance: Fully compatible with the latest Android requirements.
• Practice Mode: Two new transaction types (Test & TestWithPIN) let merchants rehearse Tap to Pay. Best practices on how to implement can be found in the Merchant Onboarding Toolkit in the Assets -> Guide section on Visa Developer Center (VDC).
• PIN Entry UI Refresh: Optimized for larger screens and landscape mode.
• CardPresentTimeout: Reduced from 14 minutes to 2 minutes for improved security.
• Device Sensors Alternative: Enhanced support for devices without sensors.
• EMV L3 Certification: Required for Discover.

• Configurable Cancel button display during transaction (technically on overlay) — adjust height, width, and position for a tailored experience.
• Option to add a 2nd button. 2nd button aborts the tap but allows other functionality i.e. Pay-by-link. 

Improved Android integrity checks

Complementing the 25.06 release is a comprehensive toolkit to help you build engaging onboarding experiences, featuring best practices, editable images, copy translated into 47 languages, and insights from global SMB research. Preview the PDF guide here and access the full Merchant Onboarding Toolkit on VDC (Click into your KiC project -> Assets -> Guide). Note: the toolkit is ~70 mb and will take time to download from VDC.

• Merchant Category Code - Mandatory on Merchant Profile - Clients will need to include MCC in Merchant Profile going forward instead of Kernel Profile.
• Reduce card present timeout from 14 to 2 minutes - no change required from clients. 

• MPoC certified app-to-app (A2A) solution 
• Visa, Mastercard, and now American Express acceptance. 
• Connector SDK allows your merchant checkout app to seamlessly call the Tap to Pay Ready App to conduct the payment processing portion of the in-person transaction in a manner that satisfies MPoC. 

Bug fixes and enhancements.

This update includes a fix to remove trailing ’F’ in cardInfo.Pan within the authorization request to acquirers.

Update List APIs to Filter Devices/Stores by Date and Time

Prior to 24.06, list APIs filter devices/stores only by Date.

New Tags to PSP/Acquirers 

A request has been initiated to include the tags 9F66, 9F06 and 4F in Authorization calls.  

Consequently, PSP/Gateways will now find these tags in the 'emvTagData' section of the Authorization payload. This affects all PSPs. 

Note, as mentioned in the Acquirer Interface Guide section 6.1, Visa could add new elements to Auth API and PSPs could ignore if not used. 

 
KernelProfile Validation 

As part of a bug fix, an existing validation process has been established to handle the issue of duplicate InterfaceProfiles in the InterfaceProfileList in KernelProfile API, This would prevent creating KernelProfile with duplicate InterfaceProfiles in the InterfaceProfileList. 

Reversal Trigger on Timeout Scenario: A fix has been deployed to ensure that a reversal is triggered during any timeout scenarios. Post deployment, PSP Gateways should expect a reversal call for any timed-out authorizations in KiC.

NOTE: This is applicable for any PSP/Acquirer who opted for reversal support during Processor Onboarding.

Kernel Profile Validation: Post 23.07 there are validation rules implemented for KernelProfileAPI.
Swaggers in the VPD portal will be updated with validation rule information.

“cvmCode” Indicator in Authorization Message  -> Potential impact on L3: optional fields may be misinterpreted/mishandled by Payment Gateway

Supported List of Values:

• ‘00’ (hex): No CVM CV Failed
• ‘01’ (hex): Offline PIN plaintext, also MOCPINPlaintext
• ‘02’ (hex): Online PIN, also MOIPIN
• ‘03’ (hex): Offline PIN plaintext + Signature 
• ‘04’ (hex): Offline PIN enciphered, also MOCPIN
• ‘05’ (hex): Offline PIN enciphered + Signature
• ‘1E’ (hex): Signature
• ‘1F’ (hex): No CVM
• ‘3F’ (hex): Unknown

23.05 Backend updates have no impact on 23.04 SDK.

Android has deprecated the SafetyNet Attestation API but has extended the deadline to migrate to Play Integrity API. Learn more here: https://developer.android.com/training/safetynet/deprecation-timeline

Please immediately update to the 23.04 SDK as there is a known bug with the previous 22.09 SDK where the app attestation calls are not happening every 20-30 minutes. Therefore the backend is not getting refreshed and causing transactions to fail. We will also not be patching the 22.09 SDK. 

23.04 SDK is a required update. We strongly recommend updating as soon as possible, and no later than October 31st, 2023. 

Enhanced Security

1. Minimum Android OS 11 (API Level 30) requirement   -> No impact on L3: security feature
2. Migration from Google Safety Net API to Google Play Integrity API  -> No impact on L3: device attestation feature

Updates

1. Non-Randomized Shifted PIN Pad  -> No impact on L3: Online PIN block entry and encryption remains as is
2. Init, Enroll Device & KiC Eligibility API updates with custom object in the parameters & Existing API ‘s are deprecated  -> No impact on L3: device management feature, unrelated to transaction processing

Improvements

1. Worker Thread annotation support for all APIs to notify the developers to call from worker thread  -> No impact on L3: clarification 
2. Merchant Category Code(MCC) added to Merchant Profile (MCC will be deprecated in Kernel Profile API for future releases)  -> No impact on L3: KiC configuration set-up API
3. Acquirer Interface 2 new optional fields introduced (type -> used to identify POS type, countryCode -> ISO3166 Country Code) -> Potential impact on L3: optional fields may be misinterpreted/mishandled by Payment Gateway

Bug fixes

1. In-App locale issues related to device language Turkish/Azerbaijani  -> No impact on L3: UI localization
2. Kernel Profile change to add “SCA” to usage List when SCA is supported -> No impact on L3: KiC configuration set-up API
3. Visa L3 SCA test case for response code 70 edge case causes additional unexpected authorization call  -> Impact on L3 for EU Region only (SCA = Strong Customer Authentication regulation in EU)
4. Mastercard L3 SCA testcase MCD55.Test.01.Scenario.01 for response code 65 should handle DE 48 element  -> Impact on L3 for EU Region only (SCA = Strong Customer Authentication regulation in EU