EMV - PIN unblock

I'm trying to do a PIN unblock on Pax Pinpad (A30)

I receive a script from the credit company that is supposed to make PIN unblock through the 72/91 tag (it differs between credit companies) and then the option to enter a PIN resumes.

I do see that the script is received correctly, but something in the order of my actions with the script causes the PIN unblock to not perform.

In 2nd gen AC I update the relevant TAGS: 8A, 89
Then I receive the script through 72/91 and update the relevant tag,
And then I just transfer it the way I received it complete the transaction - and that's probably where my problem comes from,

• How can I really know that the script I receive will even contain the unblock pin command?
• What actions should I do from the moment I receive the script?

The idea behind handling the issuer response is that you don't need to understand it, but blindly execute it. There are multiple ways how the data may be organized in the card and how the update process may look like. As you've already seen, it may happen explicitly through script processing containing a command doing a change, but it may be implicit through data passed during second cryptogram generation.

Even though, ISO7816 may define commands to perform some operations, card applications do not need to use them directly to have the same result. It is up to the issuer to have this knowledge and you won't be able to tell for sure. EMV standard requires to pass issuer script commands without modification or interpretation. Same goes to Issuer Authentication Data that may be part of the CDOL2 and be sent with second cryptogram generation or be explicitly sent to card in External Authenticate command if the card indicates it in AIP. Multiple ways leading to same result.

Answering your questions then:

• You will not be able to tell if the issuer response contains PIN unblock or not basing on the EMV standard. You may only do that having the knowledge about card application used by the issuer and it is uncommon to have this knowledge on the acquiring side.
• Just provide the data you received in the authorization response to the EMV kernel - it is heavily tested during approval and it will perform the rest in the required order.

This is the general idea how this works. If you face some issues in implementation, you will need to provide logs for anyone to help you.