FprEN 18031-3:2024
The EU standard for the fraud-protection requirement of the Radio Equipment Directive: 33 requirements on internet-connected radio equipment that transfers money, monetary value or virtual currency, covering access control, authentication including two-factor for transfers, secure updates, secure storage, secure communication, logging, cryptographic keys, general equipment hygiene with verified boot, and cryptography, each with its own assessment criteria.
FprEN 18031-3:2024 is a compliance framework from European Union (EEA) with 9 domains and 33 controls. The largest domains are 6.8 General equipment capabilities (GEC) – FprEN 18031-3:2024 (7 controls), 6.2 Authentication mechanism (AUM) – FprEN 18031-3:2024 (6 controls), 6.5 Secure communication mechanism (SCM) – FprEN 18031-3:2024 (4 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (9)
6.1 Access control mechanism (ACM) – FprEN 18031-3:2024
| Code | Title |
|---|---|
| fpren-18031-3-2024::ACM-1 | Use access control to govern entities' access to security and financial assets |
| fpren-18031-3-2024::ACM-2 | Access control that admits authorised entities only |
6.2 Authentication mechanism (AUM) – FprEN 18031-3:2024
| Code | Title |
|---|---|
| fpren-18031-3-2024::AUM-1 | Authenticate entities before they read confidential, change sensitive, or use financial and security functions (network, user and machine interfaces) |
| fpren-18031-3-2024::AUM-2 | One-factor authentication as the floor; two-factor for money transfers over the network |
| fpren-18031-3-2024::AUM-3 | Validate the properties of authenticators |
| fpren-18031-3-2024::AUM-4 | Authenticators can be changed |
| fpren-18031-3-2024::AUM-5 | Password strength for factory default and user-set passwords |
| fpren-18031-3-2024::AUM-6 | Resistance to brute-force attack |
6.3 Secure update mechanism (SUM) – FprEN 18031-3:2024
| Code | Title |
|---|---|
| fpren-18031-3-2024::SUM-1 | Provide a mechanism to update software and firmware that affects security or financial assets |
| fpren-18031-3-2024::SUM-2 | Install only updates whose integrity and authenticity are verified at installation |
| fpren-18031-3-2024::SUM-3 | Internet-connected equipment can apply updates automatically or on scheduled or triggered approval |
6.4 Secure storage mechanism (SSM) – FprEN 18031-3:2024
| Code | Title |
|---|---|
| fpren-18031-3-2024::SSM-1 | Use secure storage for security and financial assets kept persistently on the equipment |
| fpren-18031-3-2024::SSM-2 | Secure storage protects integrity |
| fpren-18031-3-2024::SSM-3 | Secure storage protects the secrecy of confidential data, configuration and security parameters |
6.5 Secure communication mechanism (SCM) – FprEN 18031-3:2024
| Code | Title |
|---|---|
| fpren-18031-3-2024::SCM-1 | Use secure communication for security and financial assets sent over network interfaces |
| fpren-18031-3-2024::SCM-2 | Integrity and authenticity protection to best practice |
| fpren-18031-3-2024::SCM-3 | Confidentiality protection to best practice where needed |
| fpren-18031-3-2024::SCM-4 | Replay protection to best practice |
6.6 Logging mechanism (LGM) – FprEN 18031-3:2024
| Code | Title |
|---|---|
| fpren-18031-3-2024::LGM-1 | Log internal activities relevant to financial assets and their protection |
| fpren-18031-3-2024::LGM-2 | Store log data persistently on the equipment |
| fpren-18031-3-2024::LGM-3 | Retain a minimum number of the latest events, always including the latest |
| fpren-18031-3-2024::LGM-4 | Time information on persistently stored log data |
6.7 Confidential cryptographic keys (CCK) – FprEN 18031-3:2024
| Code | Title |
|---|---|
| fpren-18031-3-2024::CCK-1 | Confidential cryptographic keys of at least 112-bit security strength |
| fpren-18031-3-2024::CCK-2 | Generate confidential cryptographic keys with best-practice cryptography |
| fpren-18031-3-2024::CCK-3 | Preinstalled confidential cryptographic keys practically unique per unit |
6.8 General equipment capabilities (GEC) – FprEN 18031-3:2024
| Code | Title |
|---|---|
| fpren-18031-3-2024::GEC-1 | No publicly known exploitable vulnerabilities affecting security or financial assets |
| fpren-18031-3-2024::GEC-2 | Factory default exposes only the network interfaces and services needed for setup or basic operation |
| fpren-18031-3-2024::GEC-3 | Optional services and interfaces in the default state can be enabled and disabled |
| fpren-18031-3-2024::GEC-4 | Document the exposed network interfaces and services of the default state |
| fpren-18031-3-2024::GEC-5 | No unnecessary physical external interfaces |
| fpren-18031-3-2024::GEC-6 | Validate input from external interfaces that can affect security or financial assets |
| fpren-18031-3-2024::GEC-8 | Equipment integrity: cryptographically verified boot from a root of trust |
6.9 Cryptography (CRY) – FprEN 18031-3:2024
| Code | Title |
|---|---|
| fpren-18031-3-2024::CRY-1 | Best-practice cryptography for protecting security and financial assets |
What is FprEN 18031-3:2024 and who does it apply to?
FprEN 18031-3:2024 is a compliance framework from European Union (EEA) with 9 domains and 33 controls. The EU standard for the fraud-protection requirement of the Radio Equipment Directive: 33 requirements on internet-connected radio equipment that transfers money, monetary value or virtual currency, covering access control, authentication including two-factor for transfers, secure updates, secure storage, secure communication, logging, cryptographic keys, general equipment hygiene with verified boot, and cryptography, each with its own assessment criteria. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does FprEN 18031-3:2024 actually require?
FprEN 18031-3:2024 has 33 controls organised across 9 domains. The largest domains are 6.8 General equipment capabilities (GEC) – FprEN 18031-3:2024 (7 controls), 6.2 Authentication mechanism (AUM) – FprEN 18031-3:2024 (6 controls), 6.5 Secure communication mechanism (SCM) – FprEN 18031-3:2024 (4 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of FprEN 18031-3:2024 do I already cover?
FprEN 18031-3:2024 does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement FprEN 18031-3:2024?
Start your FprEN 18031-3:2024 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about FprEN 18031-3:2024 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 33 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,248 frameworks.
Get Started Free →Free forever, no credit card required