What is changing on 31 October 2026?
The PCI Security Standards Council (PCI SSC) sets the security standards that payment apps and devices are assessed against. Three of them cover accepting cards on commercial off-the-shelf (COTS) devices such as phones and tablets:
| Standard | What it covers | Status |
|---|---|---|
| SPoC (Software-based PIN Entry on COTS) | PIN entry on a phone or tablet, used with a separate secure card reader | Sunset period 1 May to 31 October 2026 |
| CPoC (Contactless Payments on COTS) | Contactless card and device payments read by the phone itself | Sunset period 1 May to 31 October 2026 |
| MPoC (Mobile Payments on COTS) | Both PIN entry and contactless payments on the same COTS device; first published in November 2022, version 1.1 in November 2024 | The current standard for new solutions |
According to the PCI SSC sunset bulletin published on 1 May 2026, the council keeps accepting new SPoC and CPoC submissions until the sunset period ends on 31 October 2026. After that date no new submissions are accepted. Solutions that are already listed remain valid through their normal lifecycle and expire on their existing reevaluation or expiration dates.
In May 2026 the council also published an MPoC SDK Integration Report (version 1.1), which clarifies how listed software development kits are built into MPoC software. It adds no new technical or testing requirements.
Do stallholders need to change anything now?
For most event vendors, no immediate change is needed. The sunset applies to vendors submitting new solutions for evaluation, not to merchants using an app that is already listed. A phone payment app that works today does not stop working on 1 November because of the sunset.
What changes over time is the mix of solutions on the market. As older listings reach their expiry dates, payment providers will move to MPoC-based apps or retire products. Useful questions to ask your payment provider before the summer event season:
- Is the phone acceptance solution listed by PCI SSC, and under which standard?
- When does that listing expire, and what is the plan after it?
- Does the app support PIN entry on screen, or does it need a separate card reader for transactions that require a PIN?
- What happens if the connection drops mid-transaction: does the app hold a limited number of payments offline, or decline them?
- Which phone models and operating system versions are supported?
Organisers who hand out payment phones or terminals to volunteers, such as at a school fete or a charity day, should ask the same questions. Our EFTPOS at events guide covers the broader choice between dedicated terminals and phone-based acceptance.
Why are phone payments more common at events?
The Reserve Bank of Australia's 2025 Consumer Payments Survey shows how far everyday payments have moved to cards and devices:
- Cards made up around 73 per cent of consumer payments in 2025.
- Device-based payments, where a phone or watch is tapped instead of a card, were around 40 per cent of card payments, up from 31 per cent in 2022.
- 43 per cent of consumers used a mobile device for a contactless payment during the survey week, up from 35 per cent in 2022.
- Cash was still around 19 per cent of in-person payments by number, so most stalls still need a cash float.
For a stallholder, a phone that accepts cards removes one more device to charge and carry. For an event network, it means more payment traffic coming from devices that are also running messaging, social media and photo uploads at the same time.
What does a phone payment app need from the network?
Phone-based acceptance still needs a working internet connection so each transaction can be authorised. Payment data is small, but it is sensitive to delay and dropouts. At a busy market the mobile network near the stalls is shared with thousands of visitors, and that is usually when taps start to time out.
A practical plan for phone payments:
- Give payment phones their own network. A separate payment SSID, isolated from guest WiFi, keeps queues moving when the public network is busy. See EFTPOS payment networks.
- Avoid captive portals. A splash page that expires mid-afternoon can silently cut off a payment app. Payment networks should use a password, not a portal.
- Plan by device, not by stall. Count about 1.5 to 2 devices per staff member, then add dedicated terminals. Each access point serves around 50 devices, and in open areas one access point covers about 900 m².
- Keep a second internet path. The payment network should fail over to a second link if the primary one drops. Our backup internet service is designed for this.
- Update phones before the event. MPoC includes requirements for detecting and responding to compromised platforms, so a phone with outdated or modified software may be refused by the payment app. Update operating systems and apps the week before, not on the morning.
How do phone payments compare with dedicated terminals?
| Factor | Phone-based acceptance | Dedicated terminal |
|---|---|---|
| Setup | App on an existing phone, sign-in per user | Terminal paired to a merchant account, often with built-in mobile data |
| Network | Uses the phone's WiFi or mobile data | WiFi, mobile data or ethernet, depending on the model |
| PIN entry | On screen under MPoC, or through a separate reader | Physical PIN pad |
| Battery | Shared with calls, messages and the camera | Dedicated battery, often swappable |
| Suits | Low to moderate volume stalls and roaming sellers | High volume bars, food stalls and ticket boxes |
Many events use both: terminals at the busiest points and phones for roaming sellers or overflow queues. Either way, payment devices should sit on the same protected network. A site survey helps place access points where queues actually form rather than where power happens to be.
What should organisers send when planning event payments?
To plan a payment network that suits both phone and terminal acceptance, it helps to know:
- A site map with stall, bar and ticket box positions
- The number of payment devices per stall, and whether they are phones, terminals or both
- Opening hours and expected peak times
- Whether live streaming or large uploads share the site
- Power availability at each stall
You can send your floor plan or event details and we will suggest how many access points, which internet paths and what network separation suit your payment mix. For markets specifically, see our market stall WiFi page.
Questions people ask
Does the SPoC and CPoC sunset mean my phone payment app will stop working?
No. The sunset ends new SPoC and CPoC submissions after 31 October 2026. Solutions already listed stay valid until their own expiry or reevaluation dates. Ask your payment provider when your app's listing expires and what replaces it.
What is PCI MPoC?
MPoC (Mobile Payments on COTS) is a PCI Security Standards Council standard for solutions that accept both PIN entry and contactless payments on commercial off-the-shelf devices such as phones. It was first published in November 2022 and updated to version 1.1 in November 2024.
Can phone payments work without internet at an event?
Each transaction normally needs a connection to be authorised. Some solutions can hold a limited number of payments offline under rules set by the provider, but this varies and carries risk. Plan a stable connection rather than relying on offline mode.
Should payment phones use the guest WiFi?
No. Put payment phones on a separate, password-protected payment network without a captive portal, so busy guest traffic or an expired login page does not interrupt transactions.
Sources
- PCI Security Standards Council: PCI SPoC and PCI CPoC Sunset Bulletin (May 2026)
- PCI Security Standards Council: 2026 MPoC SDK Integration Report v1.1 Bulletin
- PCI Perspectives: PCI Mobile Payments on COTS (MPoC) Standard version 1.1 now available
- PCI Perspectives: Just published, PCI Mobile Payments on COTS
- Reserve Bank of Australia Bulletin: Consumer Payment Behaviour in Australia (May 2026)
- Reserve Bank of Australia Bulletin: Cash Use in Australia, what the 2025 Consumer Payments Survey tells us (April 2026)
- Australian Cyber Security Centre: Secure your Wi-Fi and router
Event dates, prices and product details can change. Check the organiser or manufacturer before you plan around them. Planning figures are starting points; every network is confirmed against the actual site.