POS terminal device used to process chip card payments

AUC (Application Usage Control) specifies restrictions that limit an application geographically or by specific transaction types.

It is a 2-byte data element located in Tag 9F07.

If this data object is present, the terminal will perform the following checks:

  • If the transaction is being performed at an ATM, the “Valid at ATMs” bit value must be set in the AUC.
  • If the transaction is not being performed at an ATM, the 'Valid at terminals
    other than ATMs' bit value must be set in the AUC.
  • If the AUC and the ICC (Issuer Country Code) value are present in the ICC, the checks listed in the table below must be performed.
Table showing checks based on AUC and Issuer Country Code (ICC) values

The Terminal Application Usage Control byte values and their descriptions are listed below:

Table of Terminal Application Usage Control byte values and descriptions

Why is AUC necessary?

AUC allows the issuing bank to restrict, via the chip, where and for which transaction types a card can be used. For example, a card that can only be used domestically, or a card that is blocked from cash withdrawals, can be defined through the AUC. The terminal checks these restrictions during the transaction.

Conditions that can be controlled with AUC

  • Whether the card can be used at ATMs or at terminals other than ATMs
  • Whether domestic and international cash transactions are permitted
  • Whether domestic and international purchases of goods and services are permitted
  • Whether cashback transactions are permitted

If the check fails

If the transaction does not comply with the restrictions defined in the AUC, the terminal sets the “requested service not allowed” bit in the second byte of the TVR. This does not mean the transaction will automatically be declined. The terminal compares the TVR against the action codes (TAC/IAC) to decide whether the transaction should be declined or sent to the bank.

Distinguishing domestic from international

To determine whether a transaction is domestic or international, the terminal compares the card's country code (Issuer Country Code, 5F28) with its own country code. If the two codes match, the transaction is considered domestic; if they differ, it is considered international.