Aonax SoftPOS SDK validated under PCI MPoC

What PCI MPoC is

MPoC is PCI SSC's security standard for accepting card payments on commercial off-the-shelf (COTS) devices such as ordinary Android phones. It builds on PCI's earlier SPoC and CPoC standards and covers the whole product: the software on the phone, the back-end services that monitor it, and the processes around them, including cryptographic key management, attestation and ongoing vulnerability management.

What was validated

• Product: Aonax SoftPOS SDK, version 2.1
• Submission: new MPoC product validation
• Type: MPoC SDK, for partners to build into their own merchant apps
• Card entry: contactless, on the phone's own NFC
• PIN: entered on the phone screen
• Transactions: online authorization
• Lab: Bank Card Test Center (BCTC), Beijing; evaluation submitted 8 July 2026
• PCI SSC acceptance: 23 October 2026

From the attestation

Excerpts from the Attestation of Validation. Contact details and personal signatures are not shown.

What it means for acquirers, banks and PSPs

Merchants can take contactless cards and mobile wallets — with PIN on the screen when needed — on an ordinary NFC Android phone, with no extra card reader. Payment providers building their own Tap to Phone app start from an SDK that has already been through a PCI MPoC evaluation, together with the team that took it there. Combined with our scheme-level SoftPOS testing — most recently Level 3 for Visa, Mastercard, JCB and American Express — that shortens the path from integration to launch.