Castles Technology wins full PCI MPoC validation for SoftPOS suite

Full certification across software, monitoring and end-to-end solution gives payment providers three routes to phone-based card acceptance.

By Disrupts Editorial Team Sat, 17 October 2026 AI level 2 of 5

AI level 2 of 5: drafted by our AI editorial assistant from the company's announcement; fact-checked, edited and signed off by Mark Walker, Editorial Director. What the levels mean

A long data center aisle is flanked by dark server racks displaying numerous glowing orange and green lights, leading to a bright windowed control area with desks, chairs, and monitors, under bright overhead ceiling lights.

Castles Technology, the France-headquartered Android payment hardware maker, has completed PCI MPoC (Mobile Payments on COTS) validation across its entire SoftPOS portfolio, a move that hands acquirers, payment service providers, gateways and independent software vendors a menu of three distinct paths to phone-based card acceptance. The company says it is the first in its tier to hold simultaneous validation across all three delivery models: a standalone SDK, an Attestation and Monitoring service, and a fully integrated end-to-end solution.

The significance of the triple validation lies in what it removes from a partner's compliance burden. PCI MPoC is the security framework that governs software-based payment acceptance on commercial off-the-shelf devices such as Android smartphones and tablets. Meeting it requires not just certified software but ongoing device attestation and security monitoring. By operating that monitoring infrastructure itself, Castles Technology allows a PSP or ISV to embed phone-based acceptance without having to build or maintain the underlying security stack.

SoftPOS matures from experiment to infrastructure

SoftPOS has moved well past the pilot phase. Driven by post-pandemic demand for flexible checkout and the economics of omnichannel retail, acceptance-on-phone has become a standard line item in acquirer roadmaps across Europe, Latin America and Asia-Pacific. The use cases the industry cites most often are table service, last-mile delivery, field sales and pop-up retail, all environments where a dedicated hardware terminal is either impractical or commercially unjustifiable for the merchant.

Jean-Philippe Niedergang, CEO for EMEA, Pacific and LATAM at Castles Technology, framed the validation as a response to a market that has matured past the adoption question: "SoftPOS has reached the point where the question for many payment providers is no longer simply whether to offer it, but how. Some want to own the entire experience, while others want to get to market quickly or avoid building complex security infrastructure themselves."

The CastlesPay MPoC Solution, which supports contactless acceptance and PIN entry on Android devices, sits alongside the company's existing hardware terminal range. Castles Technology is explicit that SoftPOS extends rather than displaces dedicated point-of-sale hardware, a framing that has become the consensus position among the major terminal vendors as they try to reassure their hardware customer base.

Convergence read-across: payments infrastructure meets device security

The broader implication of full-stack MPoC certification is strategic rather than narrowly technical. As payment acceptance migrates onto general-purpose devices, the security perimeter shifts from dedicated, tamper-resistant hardware to software-defined attestation running on consumer-grade silicon. That is a convergence of the payments and cybersecurity stacks, and it raises questions that go beyond any single vendor's product roadmap.

For fintech investors and payments infrastructure capital allocators, the relevant signal here is that compliance complexity is becoming a managed service in its own right. The pattern mirrors what happened in cloud security and, before that, in PCI DSS compliance for card-not-present e-commerce: the burden migrates from in-house engineering teams to specialist providers who can amortise certification costs across a large partner base. Castles Technology, with its stated network of thousands of bank, PSP and fintech partners globally, is positioning its A&M service as that amortisation layer for MPoC.

The competitive landscape in certified SoftPOS infrastructure is still forming. Visa's Tap to Phone programme and Mastercard's equivalent have driven demand, but the number of vendors holding validated full-stack MPoC credentials remains limited. Regulatory timelines in markets such as India and Brazil, where central banks have set aggressive deadlines for contactless acceptance expansion, will likely accelerate partner demand for outsourced compliance infrastructure of exactly the kind Castles Technology is now certified to provide.