SourcingJun 13, 2026·11 min read

ATM PIN Pad (EPP) Replacement: Tamper, PCI PTS Compliance, Key Injection and Choosing the Right Part

An operator's guide to the ATM Encrypting PIN Pad (EPP) — how it secures the PIN, why a tampered EPP zeroizes and stops working, PCI PTS and TR-31 compliance, why keys must be injected by an authorized party, and matching a replacement.

The fast answer (and the one hard rule)

The ATM PIN pad isn’t a keypad — it’s an EPP (Encrypting PIN Pad), the most security-governed part on the machine. It encrypts the PIN inside a tamper-protected module, it’s certified to PCI PTS, and it only works once cryptographic keys are loaded. That makes replacement a compliance job, not a swap:

RealityWhat it means
It encrypts the PIN internallyThe PIN is never plaintext outside the EPP—
It's tamper-responsiveOpening/removing it zeroizes the keys — it stops working—
It must be PCI PTS certifiedMatch a currently-valid approval level (e.g. PCI PTS 5.x)—
It needs keys injectedA new EPP can't process PINs until an authorized party loads keys—
Encrypt, tamper-zeroize, certify, key-inject. The physical swap is trivial; these four govern whether it works.

How an EPP secures the PIN

An EPP exists to keep the customer’s PIN secret end-to-end. The digits never leave the module in the clear: the EPP encrypts them with keys held inside its secure boundary and outputs only ciphertext. To protect those keys, the module is tamper-responsive — it actively watches for intrusion and erases its secrets if attacked.

Inside an Encrypting PIN PadkeypadPIN digitstamper-protected secure moduleencryptkeys heldinsideciphertext onlyTamper detected → keys zeroized → device disabled (by design)
The EPP encrypts the PIN inside a tamper-protected boundary — only ciphertext leaves. Detected tampering zeroizes the keys, disabling the device by design.

Why an EPP needs replacing

EPPs get replaced for three reasons — and only one of them is a conventional hardware fault:

ReasonWhat's happening
Tamper / zeroizedDetected intrusion or removal erased the keys; reports a tamper error—
Hardware failureDead keys, controller or connector — a genuine fault—
Compliance / end-of-lifeIts PCI PTS approval lapsed or it can't meet current key-block rules—
A 'tamper' EPP usually isn't broken — its security responded. Compliance/EOL is a planned replacement, not a failure.

PCI PTS and key-block compliance

Two compliance threads decide whether an EPP is acceptable: its device certification(PCI PTS) and the key-management standard (key blocks) it must support.

RequirementWhat to know
PCI PTS certificationDevices are approved to a version; current generation is PCI PTS 5.x (6.x emerging)—
Approval expiryOlder PTS approvals lapse — don't deploy a lapsed EPP—
TR-31 key blocksSecure key packaging; ATMs required to use compliant key blocks (TR-31 'Phase 3') from 1 Jan 2025—
Your processor's minimumYour acquirer/processor states the minimum PTS level & key-block rule they accept—
Match a currently-valid PCI PTS level and the required key-block standard. Confirm both with your processor before buying.

Replacing and injecting keys (authorized only)

The replacement workflow keeps the physical and the cryptographic strictly separate — you (or your technician) handle the part; an authorized party handles the keys:

  1. 1

    Confirm why it's being replaced

    Tamper/zeroized, hardware failure, or compliance/EOL — this sets whether you need the same model or a higher PCI PTS level.
  2. 2

    Match model + certification

    Choose an EPP for your exact ATM model, at a currently-valid PCI PTS level your processor accepts, with the right layout and connector.
  3. 3

    Fit the EPP (per procedure)

    Install it following the ATM’s documented procedure and your dual-control/ security rules for opening the machine.
    Caution: Mishandling can trip the new unit's tamper response — follow the documented fitting procedure exactly.
  4. 4

    Have keys injected by an authorized party

    Your authorized key-loading facility injects the required keys — by local key loading or remote key loading (RKL) — under your processor’s and the scheme’s procedures. The EPP can’t process PINs until this is done.
  5. 5

    Verify and return to service

    Confirm PIN encryption and a successful test transaction with your processor, verify compliance status, then return the ATM to live operation.
The EPP replacement workflow — part fit by you, keys by an authorized party.

Matching the part and sourcing

When you source a replacement, the supplier’s job is the part-and-certification fit; the keys are never part of the shipment:

Match thisHow
ATM make / modelThe EPP is model-specific — quote the exact machine—
PCI PTS levelA currently-valid approval your processor accepts—
Layout & connectorPhysical fit, key layout and interface for your model—
Key-injection planLocal vs remote (RKL), arranged with your authorized party—
Compliance horizonPrefer a level that stays valid, given approval expiries—
A reputable supplier confirms model fit and certification. Keys are handled only by your processor and authorized key-loading facility.

Browse PIN pads and keypads in our keyboards category, and related modules in terminal repair parts and other parts. For other ATM peripherals see our ATM card reader heads and cash dispenser guides. Tell us your ATM model and the PCI PTS level your processor requires, and we’ll match a compatible EPP — your processor and authorized key-loading party handle the keys.

Frequently Asked Questions

What is an ATM EPP, and how is it different from an ordinary keypad?
An EPP (Encrypting PIN Pad) is a secure PIN-entry device, not just a keypad. When a customer enters their PIN, the EPP encrypts the digits inside its own tamper-protected module, so the PIN is never available as plaintext outside the device. That cryptographic role is why an EPP is certified, key-loaded and tamper-responsive — an ordinary keyboard has none of that. On ATMs the EPP is the most security-governed component.
Why did my EPP stop working after it was opened or moved?
Because it's tamper-responsive. An EPP is designed to detect tampering — opening the secure enclosure, removing it, or physical attack — and respond by zeroizing (erasing) its cryptographic keys. Once zeroized, it can't process PINs and reports a tamper/security error, even if the hardware is otherwise fine. This is a security feature, not a fault. A tampered EPP must be re-keyed by an authorized party (or replaced) before it works again.
Can I just swap in a new EPP and run?
No. A replacement EPP arrives with no live transaction keys, so it can't process PINs until the required keys are injected — and key injection must be done by an authorized party following your processor's and the scheme's procedures, either by local key loading or remote key loading (RKL). You also must match the EPP to the ATM model and the required PCI PTS certification level. The physical swap is the easy part; keying and compliance are the real work.
What is PCI PTS, and which level do I need?
PCI PTS (PIN Transaction Security) is the standard that certifies PIN-entry devices, including EPPs. Devices are approved to a version (the current generation is PCI PTS 5.x, with 6.x emerging), and older approvals expire over time. For a compliant ATM you need an EPP approved to a currently-valid PCI PTS level for your deployment, and your acquirer/processor will state the minimum they accept. Don't buy an EPP whose approval has lapsed.
What are TR-31 key blocks and the 2025 deadline about?
TR-31 (and equivalent) key blocks are a secure way to package cryptographic keys so they can't be misused or substituted. The card schemes have phased in mandatory key-block usage; a key milestone required ATMs to use compliant key blocks (TR-31 'Phase 3') from 1 January 2025. In practice this means your EPP, host and key-management must support the required key-block standard — confirm with your processor that your equipment and keys meet the current requirement.
How do I make sure a replacement EPP will work on my ATM?
Match four things: the ATM make/model (the EPP is model-specific), the PCI PTS certification level your processor requires, the key-injection method your operation uses (local or remote key loading), and the physical layout/connector. Then have keys injected by your authorized key-loading facility before the machine goes live. A reputable supplier confirms the model fit and certification; your processor and key-loading party handle the keys.

Sources & further reading

  1. Encrypting PIN Pad (EPP) Security Requirements — PCI Security Standards Council
  2. PCI PTS PIN Security Requirements & Technical FAQs — PCI SSC (via Kiosk Industry)
  3. ATM Keypad Encryption PCI Compliance Updates — ATM Depot
  4. Terminal and PIN Entry Security Standards FAQs — Mastercard
  5. The PCI PTS 5.x Generation of Encrypting PIN Pads — Cryptera

Related guides

Sourcing·11 min read

NCR RealPOS Receipt Printers: Identify Your Model and Order the Right Printhead, Cutter and Parts

Ordering NCR RealPOS parts goes wrong in one place: the printhead comes in 9-pin and 15-pin versions that look similar and don't interchange. Here's how to read your model number and match the exact part.

Read guide →
Sourcing·11 min read

Wincor Nixdorf / Diebold Nixdorf POS Parts: Identify Your BEETLE and TH-Series Printer and Order the Right Part

Wincor Nixdorf (now Diebold Nixdorf) BEETLE systems are everywhere in European retail. The key to ordering parts is the 1750 part-number scheme — here's how to read it and match the right TH-series printer part.

Read guide →
Sourcing·11 min read

Fujitsu POS Printers (FP-1000 / FP-510): Identify Your Model, Read the KA02066 Part Scheme, Order the Right Part

Fujitsu's FP-1000 is a tank of a receipt printer — but ordering parts means decoding the KA02066 configuration scheme. Here's how to read it, and how to match the printhead and cutter to your exact build.

Read guide →

Related categories

POS KeyboardsPOS Terminal Repair PartsOther Parts

Featured parts in this guide

IBM 4614 POS Keyboard Electronic Circuit Film

IBM 4614 POS Keyboard Electronic Circuit Film

IBM 44V2036 SurePOS 300 (8410-E40) Sparta Riser Card

IBM 44V2036 SurePOS 300 (8410-E40) Sparta Riser Card

STAR TMP212D-24 thermal mechanism use for IBM 4613-118 printer

STAR TMP212D-24 thermal mechanism use for IBM 4613-118 printer

IBM 4614 POS Keyboard Electronic Circuit Film

IBM 4614 POS Keyboard Electronic Circuit Film

Need the parts mentioned in this guide?

Genuine OEM and quality-tested aftermarket parts for IBM, Toshiba, NCR, Diebold, Wincor and Hyosung systems — with worldwide shipping.

Browse ProductsRequest a Quote
← All guides