Discover insights from leading mobile app security experts | Promon

Inside an EMVCo SBMP evaluation: What labs test and how to prepare

Written by Morten Ruud | Feb 12, 2026 2:30:26 PM

The business case for EMVCo SBMP certification 

Mobile payment providers are entering a phase where global expansion, regulatory expectations, and card-scheme alignment all hinge on one capability: demonstrating strong client-side protection. As a result, EMVCo Software-Based Mobile Payment (SBMP) evaluations have become a strategic milestone for mobile payment apps, wallets, payment SDKs, and Tap-to-Mobile solutions.

EMVCo SBMP evaluations increasingly serve as a commercial prerequisite for scheme participation and partnerships with major payments networks. For many payment providers, SBMP readiness directly influences whether an app can be approved, onboarded or scaled. Delays in evaluation or remediation can translate into missed launch windows and added certification cost.

Most evaluation setbacks don’t stem from backend design flaws. They originate on the device itself. There, exposed keys, weak runtime protections, or evadable integrity checks create openings attackers can exploit. These failures slow launches, increase fraud risk, and force avoidable redesigns late in the release cycle.

This guide offers a global view of what labs typically focus on during an EMVCo SBMP evaluation, why mobile apps struggle, and how teams can build readiness directly into their development and compliance roadmap.

Regional lenses: When SBMP pressures intensify

The majority of SBMP expectations apply globally. However, two regions face distinct forces that shape team preparations and priorities.

EMEA: Regulatory alignment is a core requirement

SBMP expectations map naturally to PSD3, PSR, DORA, and GDPR requirements for mobile payments. Providers must demonstrate strong, repeatable client-side safeguards that stand up to audit scrutiny. SBMP readiness directly strengthens regulatory posture and reduces compliance risk.

Read more: Transaction Risk Analysis under PSD2: Turning compliance into competitive advantage

APAC: Scale across high-risk, fragmented environments

In APAC, wallets, superapps, QR payments, and Tap-to-Mobile offerings must operate securely across fragmented devices, custom ROMs, rooted phones, and cloned app ecosystems. SBMP-aligned protection becomes essential for expanding cross-border, maintaining scheme relationships, and protecting high-volume payment flows.

These regional sections do not change the core evaluation framework. But they influence how aggressively teams must implement and validate protections.

Why understanding SBMP evaluations matters now

SBMP evaluations assess whether a mobile payment app can withstand real-world attacker techniques—static, dynamic, and tamper-based. This is not theoretical compliance or a checklist exercise. It is a practical, attack-resistance assessment.

For mobile payment providers, the consequences of misalignment are operational and strategic:

  • Late-stage redesigns that disrupt launches

  • Evaluation cycles that stretch by months

  • Increased fraud exposure through key extraction and cloning

  • Risk to card-scheme partnerships

  • Regulatory friction and lack of confidence (particularly in EMEA)

  • Inability to safely scale across high-risk device ecosystems (particularly in APAC)

Understanding how evaluations work is now a prerequisite for reliable roadmap execution and partnership with major card schemes.

Learn more: Insecure mobile payment systems

SBMP in context: What EMVCo defines (and what It doesn’t)

EMVCo’s SMMP framework establishes required outcomes for secure, software-based mobile payments. Labs assess whether an app can resist defined categories of attack, but EMVCo does not prescribe methods or mandate how a provider must implement those controls.

This allows teams to adopt flexible approaches. But it also means evaluators expect robust, repeatable, multi-layer protections, not ad hoc patches. EMVCo aligns closely with what regulators and ecosystems already expect: protection of sensitive logic, safeguarding of keys, and resistance to tampering. Gaps in consistency or coverage are among the quickest ways to fail.

SBMP readiness also strengthens parallel mandates:

  • In EMEA, it reinforces controls expected under PSD3, PSR, DORA, and GDPR.

  • In APAC, it supports cross-market wallet expansion and partnership requirements for global schemes.

This clarity positions SBMP as both a security benchmark and a compliance accelerator.

What labs typically examine during an SBMP evaluation

Because SBMP requirements are global, evaluation focus areas are consistent across labs. Process details may vary, but the core attack categories assessed do not. Labs focus on attack surfaces that criminals target first. That means those that influence fraud risk, key extraction, app cloning, and runtime manipulation.

These are the four core focus areas typically assessed in an EMVCo SBMP evaluation. Below is a global breakdown, with region-specific context where it meaningfully alters emphasis.

Static analysis: What the app reveals at rest

Static analysis mirrors the techniques attackers use before the app ever runs. Evaluators look at:

  • How resistant the application is to reverse engineering

  • Exposure of sensitive logic, configuration files, or payment operations

  • Visibility and structure of cryptographic routines

  • How key material is obfuscated and safeguarded

  • Integrity controls around embedded assets

This phase often reveals whether client-side protections are structurally sound or easily bypassed.

APAC note

Static weaknesses are widely exploited in markets with high rates of app cloning and fraudulent wallet replication.

Dynamic analysis: How the app behaves under pressure

Dynamic analysis examines how the app behaves under active manipulation on compromised devices. Evaluators probe:

  • Debugger and instrumentation resistance

  • Protection against hooking tools

  • Root/jailbreak detection and resistance to common bypass techniques

  • Runtime integrity checks and environment validation

  • How sensitive computations behave under observation

  • Resilience against forced code-path manipulation or unauthorized API calls

In practice, teams need to assume compromised devices exist in the field and prove the app can still enforce controls when they do.

Tamper and repackaging detection

Evaluators expect the application to detect and respond to modification attempts. They require clear, reliable mechanisms for:

  • Detecting cloned or modified application packages

  • Validating app integrity checks across builds and devices

  • Providing safe, predictable app responses to app tampering events

  • Protecting update channels and app provenance

EMEA note

Strong tamper detection supports operational resilience requirements under DORA and strengthens overall audit readiness.

Read more: DORA incident reporting for financial mobile apps

White-box cryptography: Protecting keys under full visibility

White-box cryptography is critical to SBMP.

Evaluators assess whether keys and sensitive computations remain secure even if attackers enjoy full visibility into the runtime environment. They examine:

  • Resistance to extraction techniques

  • How cryptographic logic is protected in static and dynamic contexts

  • Whether white-box implementations maintain integrity under stress

  • Exposure of sensitive operations in the binary

Weak or custom white-box solutions are a top cause of SBMP delays.

Where mobile payment apps most commonly fail SBMP evaluations

Across labs, markets, and payment models, failure patterns are consistent. Most issues arise from implementation gaps rather than fundamental design flaws.

This common SBMP failure path shows how client-side gaps lead to delays, rework, and higher compliance costs.

Weak or inconsistent client-side protections

Security measures are applied unevenly across modules or build versions. Static, dynamic, and integrity controls are often added at different stages by different teams.  This results in uneven coverage that evaluators quickly identify.

Exposed keys or sensitive logic

If key material, authentication flows, or payment logic can be extracted or inspected with common tools, evaluation outcomes deteriorate rapidly. Extractable keys, visible cryptographic operations, or exposed business logic lead to immediate risk findings.

Integrity controls that are easy to bypass

If tamper or repackaging checks can be patched, disabled, or skipped, evaluators treat it as a systemic control gap. The app is flagged as failing to meet expected attack-resistance levels.

Runtime protections that fail under real-world conditions

Apps may appear strong and pass controlled tests but fail in broader device ecosystems. This is particularly the case in APAC, where rooted, emulated, or customized environments are common.

Security added too late in the roadmap

Last-minute rushes to “add protection” integrations before certification often lack the depth and consistency evaluators expect. They result in fragile measures that cannot withstand lab scrutiny.

Additional context

Evaluators do not expect perfection. They do expect coherent, layered, repeatable defenses that hold across environments, devices, and release versions. Inconsistent application rather than insufficient sophistication is the strongest predictors of SBMP rejection.

When client-side controls fall short, the impact is operational and financial as much as technical.

A practical SBMP readiness framework: How teams can prepare effectively

Teams that succeed treat SBMP as a foundational requirement, not an end-of-project hurdle. Teams that pass consistently follow a predictable approach: align early, use evaluation-aligned tools, and maintain rigorous protection consistency.

This is a practical SBMO readiness framework that is designed to reduce certification risk and keep releases predictable.

Step 1: Incorporate SBMP requirements early

Treat client-side safeguards as part of your architecture and early threat modeling, not an afterthought. Early alignment minimizes redesign and protects delivery timelines.

Step 2: Use an EMVCo-evaluated software protection tool

An evaluated SPT aligns directly with SBMP requirements for shielding, integrity protection, and white-box cryptography. This reduces both engineering burden and certification risk.

Step 3: Validate protections across real device conditions

SBMP isn’t tested in ideal environments. Evaluate behavior across rooted devices, emulators, fragmented hardware, and hostile environments. This is especially important for APAC deployments.

Step 4: Maintain consistency across releases

App shielding and asset protection must remain stable and predictable across builds. Version drift or inconsistent integration is a frequent cause of SBMP setbacks.

Step 5: Connect SBMP readiness to broader strategic goals

  • EMEA: Strengthen PSD3, PSR, and DORA compliance evidence.

  • APAC: Enable predictable scaling into fragmented device ecosystems and high-growth wallet markets.

Overall, readiness is less of a technical exercise and more about consistent, layered, evaluation-aligned protection.

How Promon supports SBMP success

Promon delivers EMVCo-evaluated app shielding and asset protection that align directly with the attack categories labs examine. White-box cryptography is incorporated internally as part of the protection layer. While we are not an evaluation lab, we help ensure your application brings the multi-layer, coherent defenses evaluators expect.

Promon enables teams to:

  • Withstand static and dynamic analysis

  • Protect key material and sensitive logic inside the application

  • Detect and respond to tampering and repackaging

  • Ensure consistency across devices, environments, and releases

  • Reduce evaluation timelines and avoid late-stage redesigns

With post-compile integration, minimal developer overhead, and cross-platform flexibility, Promon supports both EMEA’s regulatory needs and APAC’s high-velocity scaling environments. This is critical for payment providers operating in both EMEA’s regulatory landscape and APAC’s fast-moving market.

Making SBMP predictable, scalable, and repeatable

SBMP evaluations are no longer niche. They are a critical step in mobile payment strategy. By understanding lab focus areas, preparing early, and adopting evaluation-aligned protections, teams can transform SBMP from a source of uncertainty into a repeatable, reliable part of the product lifecycle.

With strong client-side security in place, teams can reduce certification risk, accelerate time to market, and reinforce trust with regulators, card schemes, and customers across EMEA, APAC, and beyond.