Help shape the future of the EFTPOS device lifecycle framework
15 Dec 2025
Payments NZ is currently consulting on proposed changes to the EFTPOS device lifecycle framework – the set of policies that governs how payment terminals are registered, maintained, and retired from the network in Aotearoa New Zealand.
This framework plays a vital role in ensuring that EFTPOS devices remain secure, up to date, and capable of protecting cardholder data across the payments ecosystem.
Following an in-depth review and engagement with industry stakeholders throughout 2025, we are now inviting feedback from across the sector – and the public – on a range of proposed changes.
You can review our full consultation paper, or continue reading for a summary of the proposed changes and how to have your say.
What’s being proposed
We’re proposing several changes to improve how device lifecycle dates are set, communicated, and managed in collaboration with industry. These proposed changes include:
- Amending the current risk-based approach to setting sunset dates
Future sunset dates would be based on independent security assessments and device serviceability, while remaining aligned with global PCI security standards. - Moving future lifecycle deadlines from April to August
This proposed change is intended to avoid the busy Christmas retail period and summer holidays, making device replacements easier to plan and manage. - Establishing formal industry consultation and communications processes
Proposed new formal processes would ensure that industry participants are kept informed and have regular opportunities to provide feedback before key dates are finalised.
Security assessment
The consultation paper proposes for future sunset dates to be based on independent security assessments. Payments NZ has commissioned an independent assessment by a Qualified Security Assessor (QSA) certified by the PCI Security Standards Council to evaluate vulnerabilities and review security risks associated with PCI versions 3.x, 4.x, 5.x, and 6.x. This assessment (referred to in the consultation paper) can be viewed below:
Have your say
This is a public consultation. We welcome feedback from all stakeholders across the payments ecosystem, including device vendors, resellers, acquirers, switches, merchants, card schemes, and other interested parties.
Submissions are due by 31 March 2026.
More information
For more background on the current device lifecycle framework, see our device lifecycle webpage here. You can also view: