ISO 8583 reference
ISO 8583 response codes (DE39)
Data element 39 is two characters wide and carries the outcome of a transaction: one value approves, every other value explains a refusal. It is the field the whole message set exists to deliver, and it is where interfaces most often disagree — because the standard names the codes but each rail decides exactly when to send them.
Below is the widely-implemented set: 54values from ISO 8583:1987 plus a few in common use that the standard never defined. Treat it as a map, not as law — your scheme’s specification wins wherever it disagrees.
How DE39 behaves on the wire
- — It appears on responses, not requests: a 0200 request earns a 0210 response, 0100 → 0110, 0400 → 0410, 0800 → 0810. The message function digit advances; DE39 carries the verdict.
- — It is two characters, and on most rails two numeric characters. A single digit, a space-padded value or an alphanumeric code is a conformance failure on interfaces that specify numeric.
- — 00 is the only unqualified approval. 10 approves a different amount than the one requested — the response DE4 is authoritative, and treating it as an approval of the original is a classic partial-approval bug.
- — A decline is not an error. Declines are answered, logged and settled like any other response; only a missing reply is a failure.
The codes
“Tested by” names the case in SwitchLab’s rail-neutral conformance pack that makes a switch produce that code. † marks values in wide use that are not part of ISO 8583:1987.
| DE39 | Meaning | In practice | Tested by |
|---|---|---|---|
| 00 | Approved | The only unqualified approval. Everything else is a decline or a qualified approval. | FN-01 Purchase approved |
| 01 | Refer to card issuer | Voice referral. The terminal should not retry automatically. | RC-01 |
| 02 | Refer to card issuer, special condition | As 01, with an issuer-defined condition attached. | — |
| 03 | Invalid merchant | The card acceptor (DE18/DE42) is unknown or not permitted for this transaction. | VAL-03 Invalid merchant type (DE18) |
| 04 | Pick up card | Capture the card; no fraud suspicion implied. | — |
| 05 | Do not honour | The catch-all issuer decline. If your switch answers 05 for everything, your decline taxonomy is broken. | RC-02 |
| 06 | Error | Unspecified error at the issuer. Prefer a specific code where one exists. | — |
| 07 | Pick up card, special condition | Capture with a fraud condition attached. | — |
| 08 | Honour with identification | Approved provided the acceptor verifies identity. | — |
| 09 | Request in progress | Interim response; the final answer follows. | — |
| 10 | Approved for partial amount | Partial approval — DE4 in the response carries the approved amount, not the requested one. | — |
| 12 | Invalid transaction | The processing code (DE3) or message type is not supported on this interface. | VAL-02 Unknown processing code |
| 13 | Invalid amount | DE4 is out of range, zero where it must not be, or otherwise unusable. | VAL-04 Zero-amount purchase |
| 14 | Invalid card number | PAN fails a structural check (length, Luhn) or does not exist. | VAL-01 PAN fails Luhn |
| 15 | No such issuer | The PAN's BIN routes nowhere the switch knows. | — |
| 17 | Customer cancellation | The cardholder cancelled at the terminal. | — |
| 19 | Re-enter transaction | Transient; the terminal may retry with a new STAN. | — |
| 21 | No action taken | The request was understood but changed nothing — often a reversal with no matching original. | — |
| 25 | Unable to locate record | Typically a reversal or inquiry whose original cannot be found. | — |
| 30 | Format error | The message is structurally wrong: a mandatory DE missing, wrong length, non-numeric where numeric is required. This is the code that proves a switch validates its input at all. | MND-01…05, FMT-01…05 |
| 31 | Bank not supported by switch | Routing exists but the destination institution is not enabled. | — |
| 39 | No credit account | The named account type does not exist for this card. | — |
| 40 | Requested function not supported | The function is valid ISO but not offered on this interface. | — |
| 41 | Lost card | Hot-listed as lost. Usually paired with a capture instruction. | RC-03 |
| 43 | Stolen card | Hot-listed as stolen. | RC-04 |
| 51 | Insufficient funds | The single most-tested decline. Must not be confused with a limit breach (61/65). | RC-05 |
| 52 | No checking account | Account-type selection does not resolve. | — |
| 53 | No savings account | Account-type selection does not resolve. | — |
| 54 | Expired card | DE14 is in the past. A switch that returns 05 here is losing diagnostic information. | RC-06 |
| 55 | Incorrect PIN | PIN verification failed. Also used by many switches when a PIN is required and absent. | RC-07, SEC-04 Withdrawal with PIN absent |
| 56 | No card record | The PAN is well-formed but unknown to the issuer. | — |
| 57 | Transaction not permitted to cardholder | The cardholder's product does not allow this transaction. | RC-08 |
| 58 | Transaction not permitted to terminal | The terminal or acceptor is not entitled — distinct from 57, and often confused with it. | RC-09 |
| 59 | Suspected fraud | Declined on a fraud rule. | — |
| 61 | Exceeds withdrawal amount limit | A limit breach, not a balance problem. Returning 51 here misleads the cardholder. | RC-10 |
| 62 | Restricted card | Geographic or usage restriction on the card. | RC-11 |
| 63 | Security violation | Commonly a missing or failed MAC. Presence of DE128 is the structural half; the cryptographic half needs an HSM. | SEC-02 MAC absent on a MAC-required terminal |
| 65 | Exceeds withdrawal frequency limit | Velocity limit, not an amount limit. | RC-12 |
| 68 | Response received too late | The answer arrived after the acquirer's timer expired. Worth testing deliberately: a switch that never produces it probably has no timer. | RC-17 Late response |
| 75 | Allowable number of PIN tries exceeded | PIN retry counter exhausted — distinct from 55. | RC-13 |
| 76 | Invalid / nonexistent 'To Account' | Transfer destination account does not resolve. | — |
| 77 | Invalid / nonexistent 'From Account' | Transfer source account does not resolve. | — |
| 78 | Invalid / nonexistent account | Account specified in DE102/DE103 does not resolve. | — |
| 80 | Invalid date | Also used for 'cutoff in progress' on some rails. | — |
| 81 | Cryptographic error in PIN block | The PIN block could not be deciphered — a key or format problem, not a wrong PIN. | — |
| 83 | Unable to verify PIN | PIN verification unavailable (HSM or key problem). | — |
| 85 | No reason to decline | Approval for a zero-value or account-verification request. | — |
| 88 † | Key synchronisation / key exchange error | Widely used for a failed key change (0800 network management). Not part of the base standard. | NM-06 Key change, key material absent |
| 89 † | Authentication failure | Chip or cardholder authentication failed. | — |
| 90 | Cutoff is in progress | The issuer is running settlement cutover and cannot authorise. | — |
| 91 | Issuer or switch inoperative | The destination is unreachable. Should trigger stand-in if the rail supports it. | RC-14 |
| 92 | Routing error — destination unknown | No route to the financial institution. Distinct from 91: nothing is down, the routing table is wrong. | RC-15 |
| 93 | Transaction cannot be completed — violation of law | Regulatory block. | — |
| 94 | Duplicate transmission | A retransmission of a request already seen (same acquirer, STAN and RRN inside the window). The switch must answer 94, not reprocess — this is the difference between a retry and a double debit. | STF-01 Duplicate transmission |
| 95 | Reconciliation error | Settlement totals do not balance. | — |
| 96 | System malfunction | An internal failure at the issuer or switch. | RC-16 |
| 98 † | Exceeds cash limit | Cash-specific limit breach. Not part of the base standard. | — |
Which of these does your switch actually produce?
Most switches answer a handful of codes correctly and collapse the rest into 05. That passes a happy-path test and fails a real certification, because the reviewer is checking whether a limit breach says 61, an expired card says 54, and a retransmission says 94 instead of debiting twice.
SwitchLab fires a 61-case battery at your switch over TCP and scores the genuine responses — 17 decline codes, a deliberately late reply, reversals including repeat idempotency, duplicate detection, and mandatory-field, format and value-domain enforcement. It takes about a minute to set up and you can run it as often as you like.