An 8-byte number derived from a secret key and transaction data, used to secure EMV chip card (including EMV contactless) transactions. The Issuer (or Visa/Mastercard) will verify the number and, if correct, the Application Cryptogram provides integrity and authentication, since it proves that the transaction data has not been altered and that it was generated by the real card (as only the real card has the secret key).

• If the card requests that the transaction is sent for online authorisation, then the Application Cryptogram is called an ARQC (Authorisation ReQuest Cryptogram).
• If the card declines the transaction, then the Application Cryptogram is called an AAC (Application Authentication Cryptogram).
• If the card approves the transaction, then the Application Cryptogram is called a TC (Transaction Certificate).