2026-08-26 Author : ZCS
An unattended payment terminal is PCI PTS–approved payment hardware designed to accept transactions without staff assistance. A POS system is broader: it typically combines checkout software, payment hardware, peripherals, and staff-operated retail workflows.
The practical difference is simple: retailers buy POS systems to run checkout; equipment manufacturers buy unattended payment components to embed in kiosks, vending machines, lockers, or ticketing equipment.
A vending-machine manufacturer sourcing an embedded card reader and a café purchasing a full checkout system may both say they need a "payment terminal". In reality, they are solving fundamentally different hardware, integration, and compliance problems.
For businesses evaluating open SDK and custom ODM POS hardware outside traditional retail, the same principle applies: determine whether you need a finished device or a certified payment component that fits inside your own product.
| Attribute | POS system | Unattended payment terminal |
|---|---|---|
| Primary purpose | Runs a retail or hospitality checkout workflow | Accepts payments without a cashier or attendant |
| Transaction initiation | Usually cashier- or staff-assisted | Customer initiates and completes the transaction |
| Typical user | Store associate, restaurant staff, pharmacy employee | Customer at a kiosk, vending machine, parking meter, or locker |
| Software layer | Inventory, tax, receipts, promotions, reporting, employee controls | Often payment-focused; the host machine controls vending, access, ticketing, or dispensing |
| Hardware form | Countertop terminal, tablet POS, handheld POS, receipt printer, scanner | Outdoor payment unit, card slot, contactless reader, PIN pad, embedded module |
| Relevant PCI PTS scope | Often attended PED-based payment hardware, depending on the device | UPT for a complete device; EPP or SCR/SCRP for embedded payment hardware |
| Typical buyer | Merchant, retailer, restaurant, pharmacy | Kiosk builder, vending OEM, locker manufacturer, transit or parking operator |
A self-checkout kiosk may contain both: POS software that manages the sale and an unattended payment terminal that securely captures card, PIN, and contactless payment data.
An unattended payment terminal is a Point of Interaction (POI) payment device designed to process a card-present transaction without an employee present to assist the customer. PCI SSC distinguishes this hardware from attended payment devices through its PCI PTS POI approval categories.
Common unattended deployments include:
The important question is not whether the deployment is called a kiosk, vending machine, or POS system. The key question is whether the payment device is a complete terminal or a payment component embedded inside equipment you manufacture.
A complete UPT is a finished, deployable payment terminal evaluated as an unattended payment device.
Best for:
Trade-off: Faster deployment, but usually less mechanical, firmware, enclosure, and workflow flexibility.
A POS platform typically bundles payment hardware with checkout software, merchant onboarding, payment-processing services, reporting, and support.
Best for:
Trade-off: It can be simple to deploy, but it is often unsuitable for an OEM that needs to place payment hardware inside a proprietary vending machine, locker bank, or ticketing enclosure.
An embedded module is intended to be installed inside a larger product designed by an OEM or system integrator.
Best for:
Trade-off: More engineering and validation work upfront, but better control over enclosure design, mounting depth, cabling, communications, branding, and machine workflow.
| Supply model | What the buyer receives | Best unattended use case | Main limitation |
|---|---|---|---|
| Integrated payment POS | Hardware, POS software, payment relationship, service bundle | Turnkey retail or managed kiosk programs | Limited control over processor, firmware, enclosure, and hardware architecture |
| Uncertified white-label terminal | Low-cost hardware with unclear certification history | Usually not appropriate for public self-service payments | High certification, acquirer, security, and lifecycle risk |
| Complete UPT | Finished PCI PTS-approved unattended payment device | Parking, kiosk, retrofit, standalone payment point | Fixed form factor and limited custom integration |
| Embedded EPP/SCR module | Certified payment component for integration into a host machine | Vending, lockers, ticketing, OEM self-service equipment | Requires mechanical, electrical, software, and manufacturing integration |
For integrators pursuing a proprietary product, Android POS terminal factory solutions can be relevant when the requirement extends beyond branding into SDK access, firmware behavior, peripheral interfaces, and enclosure-level customization.
PCI PTS POI uses a modular security framework. The applicable approval class depends on whether the product is a finished unattended terminal or an embedded component. PCI SSC's device-category materials distinguish UPTs from components such as EPPs and secure card readers.
| PCI PTS category | What it covers | Typical use |
|---|---|---|
| UPT | A complete unattended payment terminal | Parking kiosk, finished vending payment terminal, outdoor payment station |
| EPP | Encrypting PIN Pad component | PIN entry integrated into a kiosk, vending machine, or self-service enclosure |
| SCR | Secure Card Reader component | Card-reading function integrated into equipment |
| SCRP | Secure Card Reader with PIN entry capability | Embedded card-and-PIN payment component |
| PED | PIN Entry Device, commonly associated with attended payment use cases | Countertop or staff-assisted payment environments |
A device cannot be treated as compliant for unattended deployment merely because it accepts cards or contactless payments. Its PCI PTS approval must cover the relevant function and deployment type.
For example:
PCI PTS certification supports hardware security, but it does not automatically make the entire deployment PCI DSS compliant. The integrator and merchant still need to secure networks, remote access, payment flows, update processes, and the surrounding cardholder-data environment.
PCI SSC published PCI PTS POI Modular Security Requirements v7.0 in May 2025. The revision consolidated separate PED, EPP, and UPT evaluation programs into one modular document, allowing vendors to select the applicable requirement modules for the device under evaluation.
For 2026 sourcing projects, ask suppliers:
A certificate that once appeared on an approved-device list may no longer be suitable for new deployments after expiry. Verify the device status directly through PCI SSC documentation and confirm the acquirer's acceptance policy before committing to volume production.
For a broader supplier-validation workflow, see this PCI-certified POS terminal sourcing guide.
For device integrators, payment acceptance is only one part of the design. The payment module must physically fit the machine, connect reliably to its controller, and remain serviceable across hundreds or thousands of unattended locations.
Evaluate these five areas
1. Certification scope
Confirm the device's precise PCI PTS category and capabilities. Do not rely on generic statements such as "PCI compliant" or "supports EMV."
2. Mechanical integration
Check cutout dimensions, mounting depth, antenna position, display placement, service access, cable routing, connector type, and tamper-protection requirements before enclosure tooling begins.
3. Environmental durability
Outdoor and semi-outdoor deployments may require temperature tolerance, moisture protection, dust resistance, UV resilience, vandal resistance, and an ingress-protection rating appropriate to the location.
4. Software and remote management
For large fleets, confirm SDK/API access, controller compatibility, remote firmware deployment, telemetry, fault reporting, transaction-log handling, and key-management support.
5. Lifecycle and supply continuity
Ask about certification expiry, component availability, minimum-order quantities, security-support period, replacement strategy, and long-term production control.
A module with an attractive unit price can become expensive if it requires enclosure redesign, cannot support over-the-air updates, or lacks a reliable replacement path after certification or component changes.
Q1. Is an unattended payment terminal the same as a kiosk?
No. A kiosk is the overall enclosure and customer interface. An unattended payment terminal is the secure payment hardware within that kiosk. A kiosk may include a complete UPT, or it may contain embedded EPP and SCR/SCRP components.
Q2. Does a vending machine need its own PCI certification?
Usually, the payment function is covered by the PCI PTS-approved payment device or module, not by a separate certification for the entire vending machine. However, the integrator must install and operate the component according to its evaluated configuration and maintain PCI DSS responsibilities for the wider environment.
Q3. Can an attended POS terminal be repurposed for unattended use?
Not automatically. A device approved for attended use may not have the correct UPT-class approval or security design for an unsupervised deployment. Confirm the exact PCI PTS category and acquirer acceptance requirements before deploying it.
Q4. What happens when a PCI PTS approval expires?
An expired approval can create risk for new purchases and deployments. Existing installed devices may be handled under acquirer- or payment-brand-specific transition policies, but new projects should avoid relying on expired or soon-to-expire approvals unless the payment partners explicitly approve the rollout.
Q5. Who is responsible for PCI DSS compliance in an embedded-payment deployment?
Responsibility is shared. The module manufacturer is responsible for maintaining the payment device's PCI PTS approval. The machine OEM, system integrator, operator, processor, and merchant remain responsible for securing the surrounding environment, including networking, remote access, installation controls, software updates, and operational procedures.
Choose a POS system when you need a complete checkout workflow operated by staff. Choose a complete UPT when you need a ready-to-deploy unattended payment device. Choose an EPP or SCR/SCRP module when you are building payment acceptance into your own vending machine, locker, kiosk, ticketing system, or self-service equipment.
For OEM and ODM projects, the most important purchasing question is not "Which POS terminal should I buy?" It is: "Do I need a finished PCI PTS-approved terminal, or a certified payment component designed to become part of my own machine?"
Home 
How Fiscal POS Hardware Differs from Standard POS Hardware? 
