In line with PCI PIN requirement 1-1, all 

POI devices processing transactions through Toro Gateway must be PCI PTS approved under one of the following approval classes: PED, EPP, SCRP, or UPT.

 For SoftPOS solutions, a valid CPoC or MPoC approval is required. Devices / solutions must have a valid (non-expired) approval listing on the PCI SSC website at www.pcisecuritystandards.org.

Before the integration process can begin for any POI device or solution, verification must be provided to demonstrate that the following device characteristics match the PCI PTS listing:

Any applications resident within the device that were included in the PTS assessment

Devices will not be permitted to connect if:

Additional applications have been installed that replace or disable PCI-evaluated firmware functionality (unless those applications are also PTS-validated and listed)

Default keys, passwords, or test data remain active on the device

Customers using Toro Gateway are responsible for:

Maintaining accurate inventory records for all deployed POI devices

Monitoring PCI SSC announcements for approval expirations and sunset dates

Implementing firmware updates in accordance with manufacturer security guidance

Reporting any suspected device tampering or compromise immediately

Individual payment brands may impose additional requirements including specific PTS versions, deployment timeframes, and sunset dates for certain device models. Customers must comply with all applicable brand requirements in addition to the baseline Toro Gateway requirements.

The following POI devices and solutions have been certified for use with Toro Gateway

Introduction

Permitted POI Devices and Solutions

Diagnostic Exchange

Requests and Responses

Single Tap with Online PIN

Protected Card Data

Refunds

Authorisations

Completions