An open, on-device Cardholder Verification Method (“CVM”) controller may receive CVM policies from issuers and store the policies in a database. The open, on-device CVM controller may then receive a request from a remote mobile device, and automatically determine at least one issuer associated with the request. Appropriate CVM policies may be retrieved and transmitted to the remote mobile device. An open, on-device CVM application executing on the mobile device may then receive a CVM authentication request, associated with a payment token, from a payment application. Responsive to the authentication request, a CVM policy may be accessed based on the payment token. It may then be arranged for an authenticator of the mobile device to authenticate a user in accordance with the CVM policy. When the user is authenticated, an authentication success indication may be sent from the open, on-device CVM application to the payment application.