Visa Personal Identification Number (PIN) Security Program update

Visa has announced the sunset of its PIN Security compliance program, effective October 1, 2023.

Important information about the Visa PIN Security Program

Important note: Effective October 1, 2023, Visa has sunset the Visa PIN Security Program and will no longer proactively validate Payment Card Industry (PCI) PIN security requirements. While the program will no longer be in effect, clients, processors and service providers will still be required to comply with PCI PIN security requirements. A PCI PIN Security Attestation of Compliance requires a Qualified PIN Assessor (QPA) to test and assess the requirements and controls and recommended to be conducted every 2 years. Please review the FAQ below for further detail.

FAQ

• Why is Visa sunsetting its PIN compliance program?

Visa’s decision to sunset the compliance program reflects a shift towards a multi-layered security approach, recognizing the evolving landscape of payment security and where the risks of a PIN compromise sit comparatively to other emerging data compromise trends prevalent in the industry.

• Will acquirers, Third Party Agents, and Processors still be required to be compliant with PCI PIN Security requirements?

Yes, they remain responsible for protecting PIN data in accordance with industry security standards and Visa Rules at all times. Additionally, the sunset of the compliance program does not waive or alter any fees, non-compliance assessments or other liabilities associated with a compromise resulting from a violation of the Visa Rules which results in the loss of Visa account data with PIN. It is important to emphasize that Visa’s decision to update its compliance program should not be misinterpreted as a reduced emphasis on the PCI PIN standard. Compliance with the industry standards is necessary to maintain a secure payment ecosystem.

• Will entities still be required to submit to Visa evidence of compliance with PCI PIN Security Requirements?

While Visa does not require scheduled submissions of validation of compliance with PCI PIN Security Requirements, acquirers, third-party agents, and processors, who are involved in handling PINs for Visa transactions or provide key management functions or support PIN entry devices, must maintain compliance with PCI PIN Security Requirements. This is achieved through a Qualified PIN Assessor (QPA) to carry out the assessment.

• Can entities validate compliance with PCI PIN Security Requirements through a self-assessment?

No, PCI PIN Security Attestation of Compliance requires a Qualified PIN Assessor to test and assess the requirements and controls and are recommended every 2 years.

• Does the program sunset affect the type of point of interaction (POI) acceptance devices that can be used by merchants?

No. PCI PIN Security Requirements mandate that all cardholder-entered PIN must be entered in a device that is validated and approved against one of the following:

• One of the versions of the PCI PTS standard, as members of Approval Classes Encrypting PIN Pad (EPP), PIN Entry Device (PED), Secure card reader for pin (SCRP) or unattended payment terminal (UPT) (collectively known as POI Devices) and Approval Class HSMs, or
  • Federal Information Processing Standards (FIPS) 140-2 or FIPS 140-3 level 3 or higher

When the POI devices are purchased and owned by a merchant, the acquiring entity sponsoring the usage of the devices into a payment network ultimately bears the responsibility for any non-compliance.

• Are acquirers expected to remove PTS devices with expired approvals from production?

Already deployed devices can remain in use beyond the expiration of their PCI PTS approval, but it is recommended that they are replaced as soon as they are added to the PCI's PIN Transaction Security Devices With Expired Approvals list.

• Will the sunset affect my listing on the Visa Global Registry of Service Providers?

Yes, since the PCI PIN validation documents will no longer be submitted to Visa, the existing entities listed on the Visa Global Registry will remain until the document expires and the information will subsequently drop from the site.

• Does Visa require entities to be listed on the PCI SSC PIN Listing?

While the PCI SSC PIN Listing program can be a useful tool to manage and demonstrate compliance with PCI PIN Security Requirements, Visa does not require entities to be listed on PCI SSC website.

Additional questions?

Please contact your Visa Account Executive or Ecosystem Data Security team if you have additional questions.