A compliance assessment and security testing process provides assurance that a vendor's smart card product complies with a card association's security guidelines and is approved for use in a smart card electronic payment system under a card association's brand name. A certificate of compliance is assigned to the product if approved. The security guidelines are updated as new security threats and developing attack potential are recognized and product certifications are accordingly updated. When security vulnerabilities are discovered in the vendor's smart card product, risk analysis is conducted to determine if the vulnerabilities pose an unacceptable level of risk to the member banks.