5 mins read
Azure Payment HSM v2 entered public preview on September 17, 2026, in the western United States and western Europe. Marvell Technology, Microsoft and Utimaco built it jointly, combining Marvell LiquidSecurity hardware security modules with Utimaco Atalla Payments Module software on Microsoft Azure. The pitch to banks and payment service providers is direct: meet PCI PIN Security and PCI HSM obligations, keep cryptographic key sovereignty, and never rack a payment HSM again.
What Azure Payment HSM v2 Actually Replaces
For anyone who has not worked inside a card processing stack, payment HSMs are the appliances that handle PIN translation, card issuance cryptography and key management. They are expensive, physically audited under PCI Security Standards Council rules, and they usually sit in a cage in a data centre a processor pays for whether transaction volumes rise or fall. The capital sits idle at 3am and strains at Black Friday.
Utimaco contributes the cryptographic software. Its Atalla lineage runs back decades in the payments market, and per the announcement it is the only payment software certified across multiple hardware platforms. Marvell contributes the hardware, and this is the technically interesting piece: payment HSMs were historically single-tenant appliances, and LiquidSecurity is built for dense multi-tenant use. Multi-tenancy is what makes a cloud payment HSM service economically possible at all. Without it you are just renting someone else’s cage.
Cary Ussery, senior vice president and general manager of Marvell’s Multimarket Business Group, framed it as meeting demand for cloud-scale payment services. Soumya Subramanian, vice president of cloud security engineering at Microsoft, put it as removing the operational burden of managing payment-specific HSMs. Stefan Auerbach, Utimaco’s chief executive, called the multi-vendor arrangement an industry first.
Fintechbits analysis
Why This Is a Second Generation, Not a First Entry
Microsoft has offered an Azure Payment HSM since roughly 2022, so v2 is an upgrade rather than a market entry. The earlier version was closer to a hosted single-tenant appliance with a per-hour bill attached, which solved the procurement problem and left the operational one largely intact. Describing v2 as cloud-native and fully managed is a meaningful change in kind, not just a version bump, assuming the elasticity claim survives contact with real PCI auditors.
The pattern is familiar from elsewhere in bank infrastructure. Payment security modernisation tends to arrive as a managed service years after the rest of the stack moved, because the compliance surface is unforgiving. Fintechbits covered a comparable move when Bluefin shifted to AES encryption ahead of PCI deadlines, and the same dynamic applies here: vendors move first, buyers move when the auditors are comfortable.
The Compliance Barrier Azure Payment HSM Still Has to Clear
Here is the reason to care and also the reason to wait. Payment HSM estates are one of the last genuinely unmoved layers of bank infrastructure, and they are unmoved for a good reason. The regime around PIN and key management is punishing, and nobody inside a processor gets promoted for being first to move PIN translation into another company’s cloud. Every large acquirer has evaluated this and most concluded the audit risk outweighed the operating saving. A public preview in two regions does not change that calculus.
What would change it is the first tier-one issuer or acquirer willing to say publicly that it passed a PCI PIN audit running on the service. Until then this is a credible product hunting for a reference customer brave enough to be named. Preview status also means no production attestation yet, which is precisely the artefact a bank’s second line will ask for before a migration business case gets written.
How Azure Payment HSM v2 Compares With AWS and Thales
The competitive frame matters. AWS Payment Cryptography is the closest analogue and has been generally available for longer, AWS CloudHSM covers adjacent ground, and Thales sells its own cloud HSM options into the same accounts. Microsoft’s differentiation is not the cloud and not the silicon, it is the Atalla software, because that is what many incumbent processors already run on premises. Migrating to a familiar cryptographic engine on unfamiliar infrastructure is a far easier internal sell than learning a new engine and a new platform at once.
Read this alongside the broader move of payment licensing and infrastructure into cloud-native form, of which Checkout.com going live with direct US acquiring is another example. The direction is consistent even where the pace is slow.
Public preview covers two regions and carries no production PCI attestation. Watch for general availability, the region list at launch, and whether any named bank or processor moves a live PIN workload onto it within the next two quarters.
What to Watch Next on Azure Payment HSM v2
Three things will show whether Azure Payment HSM v2 becomes real infrastructure or stays a preview. First, the move from public preview to general availability with a published region list rather than two. Second, a named bank or payment processor confirming it has passed a PCI PIN audit while running on the service, because that attestation is what unblocks every other buyer in the queue. Third, pricing, which Microsoft has not disclosed at scale. The economics of a managed payment HSM only work if the multi-tenant model lands below the cost of owning and auditing the hardware. On present evidence Azure Payment HSM v2 is a well-built answer to a problem banks have complained about for a decade, waiting on the one customer prepared to go first.
