Card and authentication data
DE 40
Service restriction code
- Base format
an 3
Carries service restrictions associated with the presented credential, such as permitted usage or environment constraints encoded by the selected profile. It should be evaluated with the entry mode and credential data.
Scheme specifics
Public evidence and current limits
Status describes the evidence we have reviewed. It is not a mandatory, optional, or N/A classification.
| Scheme | Evidence | What the public source supports |
|---|---|---|
| Visa | Restricted source | The selected public sources do not establish a complete current Base I/V.I.P. profile for this field. |
| Mastercard | Restricted source | The complete current dual-message definition is located in the Mastercard Customer Interface Specification. |
| American Express | Restricted source | Current authorization layouts and programming notes are participant Network Specifications in the American Express Knowledge Base.American Express Global Network Policy |
Provenance
Sources used on this page
- Wikipedia ISO 8583 field directory, revision 1352601145Secondary base source · CC BY-SA 4.0 · Public transcription of the ISO 8583:1987 field directory and format notation.
- ISO 8583:2023Official context · Current edition metadata; field and value definitions are maintained separately by the ISO 8583 Maintenance Agency.
- PCI SSC account-data classification guidancePCI Security Standards Council · Cardholder-data and sensitive-authentication-data classification context.
- Worldpay ISO 8583 Reference Guide, version 2.52Worldpay official · processor profile · Public terminal-interface interpretation of ISO 8583:1987, used as processor-scoped evidence for operational field meaning.
- American Express Global Network PolicyAmerican Express official · access context · Confirms that current authorization message layouts and programming notes are participant Network Specifications.
The base field row is attributed to Wikipedia under CC BY-SA 4.0. SchemeLens descriptions are independent summaries. Restricted network specifications are named as the missing authoritative layer, not copied or reconstructed.