PCI CPoC and SPoC sunset: a restaurant device audit
On October 31, 2026, the PCI Security Standards Council (PCI SSC) closed submissions under two of its standards for phone- and tablet-based card acceptance: Software-based PIN Entry on COTS (SPoC) and Contactless Payments on COTS (CPoC). "COTS" means commercial off-the-shelf devices, the ordinary smartphones and tablets many restaurants now use for tableside payment, line-busting and patio service. Nothing at your counter stops working because of this date. It is still a good moment to find out what your phone-based payments actually run on, how long that approval lasts, and what happens to service when those devices fail.
What the PCI Council announced
The Council's sunset bulletin dated May 1, 2026 set the timeline:
- The sunset period ran from May 1, 2026 to October 31, 2026.
- During the sunset period, new SPoC and CPoC submissions were still accepted.
- At the end of the sunset period, "No new PCI SPoC or PCI CPoC submissions will be accepted by PCI SSC."
- Existing listings "Remain valid through their normal listing lifecycle" and "Expire in accordance with their existing reevaluation or expiration dates." They also stay eligible for annual checkpoints and change submissions while active.
The bulletin sums it up this way: "there is no change to the lifecycle treatment of currently accepted and listed PCI SPoC and PCI CPoC solutions." It points vendors toward the PCI Mobile Payments on COTS (MPoC) standard for future products.
MPoC is not new. The Council published it on November 16, 2022, and describes it as combining "many of the aspects of the existing PCI SPoC and PCI CPoC standards." The main difference is "including the entry of both PIN and contactless cardholder data on the same COTS device." The Council's MPoC program page encourages merchants and their acquirers to use its official listing when choosing an MPoC solution.
What it means for a restaurant floor
For most operators, the sunset is a vendor-side change. Your payment provider or POS company is the one that submits solutions for evaluation, not you. Three practical points follow from the bulletin:
- No immediate shutdown. A phone-based payment app listed under SPoC or CPoC keeps its listing until its own expiry or reevaluation date.
- The approval ages. After October 31, PCI SSC accepts no new submissions to those two programs. Over time, phone-based acceptance options are likely to move toward MPoC, and older listings will drop off as they reach their expiry dates.
- PIN and contactless on one device. Under the older standards, PIN entry and contactless were covered separately. MPoC covers both on the same device, which matters if your guests use debit cards that ask for a PIN.
What the bulletin does not tell you is which standard your own provider's app is listed under or when that listing expires. Only your provider, or the Council's listing, can answer that. This is why the useful response is an audit, not a hardware purchase.
The 30-minute payment device audit
Build one table that covers every device that can take a card in your restaurant. Most owners know their counter terminals. Fewer can name every phone or tablet that has a tap-to-pay app installed, who it belongs to, and how it behaves when the Wi-Fi drops.
| Column | What to record | Where to get it |
|---|---|---|
| Device and location | Counter terminal, server handheld, manager phone, patio tablet | Walk the floor; check your POS device list |
| Ownership | Restaurant-owned or staff personal phone | Manager knowledge, MDM or device list |
| Payment app and version | Which app takes the card on this device | The device itself |
| PCI program | Dedicated hardware terminal, SPoC, CPoC or MPoC | Ask your payment provider in writing |
| Listing expiry or reevaluation date | The date the listing runs to | Provider, or the PCI SSC listings site |
| PIN debit support | Can a guest enter a PIN on this device? | Provider documentation or a live test |
| Offline behavior | What happens to a tap when the network is down | Provider documentation, then a test during a slow shift |
| Fallback device | Which device takes over if this one fails | Your own plan |
The PCI program column is the new one. Ask your provider a short question by email so the answer is on record: "Which PCI program is our phone-based payment solution listed under, and what is the listing's expiry or reevaluation date?" If the answer is MPoC, note the date and move on. If it is SPoC or CPoC, ask what their plan and timeline are for moving to MPoC, and whether it will require a new app, new devices or a new agreement.
A worked example: how much revenue rides on phones
The point of the audit is to put a number on your exposure. Use your own POS reports for this; the figures below are illustrative only.
Suppose a full-service restaurant runs two counter terminals and six phones used for tableside payment. Pull last month's card sales by device from your POS and payment reports:
- Total card sales for the month: $120,000
- Card sales taken on the six phones: $54,000
- Share taken on phones: $54,000 / $120,000 = 45%
Now take your busiest service. If Friday dinner brings $6,000 in card sales and 45% of it runs through phones, that is about $2,700 per Friday riding on those devices. If the phone app had a problem on a Friday, whether from an expired listing, a forced update or a network fault, the two counter terminals would have to absorb roughly $2,700 in payments that normally happen at the table. At an average check of $60, that is about 45 extra checks walked to the counter in one service.
That arithmetic tells you whether you need a third hardware terminal, a second phone-payment provider, or simply a written plan for servers to bring checks to the counter. A restaurant at 10% phone share can treat this as a paperwork task. A restaurant at 45% should treat it as an uptime issue.
Decision table
| What the audit shows | What to do |
|---|---|
| Provider confirms MPoC listing | Record the listing date. Recheck at contract renewal. |
| Provider confirms SPoC or CPoC, expiry more than a year out | Get the provider's MPoC plan in writing. Put the expiry date on your calendar with 90 days of warning. |
| SPoC or CPoC, expiry within a year, or no clear answer | Escalate with your account rep. Price a hardware terminal or alternative before the date, not after. |
| Phones take more than a third of card sales | Add a tested fallback for your busiest service: spare hardware terminal, charged and logged in. |
| Staff personal phones take payments | Ask your provider and acquirer what they require for personally owned devices. Consider restaurant-owned devices you control. |
| Guests often pay with PIN debit | Confirm PIN entry works on the device. If not, route those guests to a terminal that supports it. |
Test offline behavior before the holidays
Phone-based acceptance depends on the phone, the app, the network and the provider's service all working at once. Whatever standard the app is listed under, the operational failure you are most likely to meet is connectivity. Before the November and December rush, run one short test during a slow afternoon:
- Put one handheld in airplane mode and try a small payment. Note exactly what the screen says.
- Restore the connection and confirm whether the payment was stored and sent, declined, or lost.
- Write down the result in plain words for the shift manager: "If the phones show X, send checks to counter terminal 1."
- Check that each device has a charger at the station, and that the spare terminal is charged and logged in.
If your POS keeps working without an internet connection (KwickPOS, for example, advertises a True Offline Mode), your team can keep running service while you sort out payment. Card acceptance still depends on what your payment provider supports offline, so confirm that separately.
What to keep on file
- The completed device table, with the date you made it.
- Your provider's written answer about the PCI program and listing date.
- The offline test result and the one-line fallback instruction for managers.
- A calendar reminder 90 days before any listing expiry date.
The October 31 date did not change anything on your floor overnight. It does mean no new SPoC or CPoC listings can be added, so every existing one will eventually reach its expiry date, and the restaurants that know their dates in advance can plan replacements on a slow Tuesday instead of during a Friday rush.
Frequently asked questions
Does my tap-to-pay app stop working after October 31, 2026?
Not because of this date. The PCI SSC bulletin says existing SPoC and CPoC listings remain valid through their normal listing lifecycle and expire on their existing reevaluation or expiration dates. What ended on October 31 is new submissions to those two programs.
What is the difference between CPoC, SPoC and MPoC?
CPoC covers contactless payments on commercial off-the-shelf devices such as phones, and SPoC covers software-based PIN entry on them. MPoC, published by the PCI SSC in November 2022, combines aspects of both and covers PIN and contactless entry on the same device.
Who is responsible for moving to MPoC, the restaurant or the provider?
Solutions are submitted for evaluation by the companies that build them, so the move is mainly a vendor task. The restaurant's job is to ask its provider which program its solution is listed under, when the listing expires, and what any transition will require.
How do I check which standard my payment app is listed under?
Ask your payment provider in writing for the PCI program and the listing's expiry or reevaluation date. The PCI SSC also publishes official listings of SPoC, CPoC and MPoC solutions on its listings site.
What should I do if phones take a large share of my card sales?
Calculate the share from your POS device reports, estimate the card sales at risk on your busiest service, and keep a tested fallback ready, such as a charged spare hardware terminal and a written instruction for staff to send checks to the counter.
Sources
- PCI Security Standards Council Bulletin: Announcement of Sunset Periods for the PCI SPoC and PCI CPoC Standards, PCI Security Standards Council, 2026-05-01
- Just Published: PCI Mobile Payments on COTS, PCI Security Standards Council (PCI Perspectives blog), 2022-11-16
- Mobile Payments on COTS (MPoC), PCI Security Standards Council
- KwickPOS home page (Cloud + Offline Hybrid, True Offline Mode), KwickPOS
Checked November 3, 2026. Photo: Kampus Production / Pexels.
Build the next event playbook
Start with the DarfarPOS uptime plan, then review delivery integration, weekly reporting, and staff training.