For twenty years, accepting a card in person meant buying a certified piece of hardware. Soft POS collapses that requirement into an app: the NFC antenna already in a merchant's phone becomes the reader, and the security boundary moves from a tamper-proof chip to an attested software stack in the cloud.
Soft POS — the standards bodies call it CPoC and MPoC, Apple and Google call it Tap to Pay — is a software payment terminal. Instead of routing a contactless card through a certified reader with a tamper-resistant secure element, the merchant's own phone reads the card over NFC and hands the encrypted payload to an attested application.
The distinction matters because it changes who carries the security burden. A hardware terminal proves it has not been tampered with physically. A Soft POS app has to prove the same thing continuously, in software, on a device the acquirer does not control — which is why attestation and back-end monitoring sit at the centre of every certification scheme.
ANATOMY OF A TAP
The end-to-end flow looks deceptively similar to a hardware terminal, but three of the five stages have moved off the device entirely.
“The moment you stop shipping hardware, onboarding stops being a logistics problem and starts being a software problem. That is the whole unlock — a merchant can be live in the time it takes to download an app.”
MPoC (Mobile Payments on COTS) replaced the older CPoC and SPoC standards in 2022 and is the only route that lets you take both the card read and the PIN on a commercial off-the-shelf device. It is modular: you certify components, not one monolithic product, which is why most merchants inherit certification from their provider rather than pursuing it directly.
Averages across 1,400 UK merchants onboarded to Cashless Ai between January 2025 and June 2026. Your acquirer pricing will differ; the shape of the curve rarely does.
| CRITERIA | HARDWARE TERMINAL | CASHLESS AI SOFT POS |
|---|---|---|
| Upfront cost per till | £220 – £400 per unit, plus spares | £0 — the phone is already paid for |
| Time to first payment | 5 – 12 days including shipping | Under 30 minutes, fully self-serve |
| Certification model | PCI PTS POI, re-certified per device | PCI MPoC, inherited from the provider |
| PIN entry | Physical keypad on the terminal | CVM on glass with remote cloud PIN |
| Peak throughput | Highest — dedicated lane hardware | Strong, but battery and OS updates bite |
| Best fit | Fixed high-volume checkout lanes | Pop-ups, field sales, delivery, queue-busting |
Take a real tap on your own phone today
WRITTEN BY
Aria Chen
Head of Payments, Cashless Ai
Aria leads acquiring and in-person payments at Cashless Ai. She spent eight years shipping terminal firmware before deciding the terminal was the problem.
Replace multi-vendor clutter with one intelligent ecosystem. Get up and running in under 24 hours.
