PCI compliance, or Payment Card Industry Data Security Standard (PCI DSS) compliance, is a set of security standards and requirements aimed at protecting credit card data.
Adhering to PCI compliance is necessary for any organization that handles credit card payments or processes, stores, or transmits credit card data. As such, merchants who accept card transactions — regardless of method (i.e. eCommerce, in-store, over-the-phone, etc.) must meet and maintain PCI compliance.
While all card-accepting merchants — regardless of size/number of transactions — are required to maintain PCI compliance, the level of compliance each merchant is responsible for is dictated by transaction volume. The larger the business, the higher the validation level, resulting in more stringent compliance requirements:
The requirements for each level are mostly the same, with the main difference being the number of requirements that must be met, as well as the level of detail required in the documentation.
Please Keep in Mind: Merchants who experience a security breach that compromises cardholder data may be advanced to a higher validation level. For example, the card brands may decide to move a Level 2 merchant who suffered a breach to Level 1. In this case, the merchant would be responsible for a more rigorous level of compliance.
Regardless of compliance level, there are twelve categories of PCI DSS requirements that all card-accepting merchants must meet. Failure to do so may result in financial penalties imposed by the card brands. The categories (listed below) are composed of more than 275 questions/requirements that are dependent upon the compliance level the merchant falls under.
In general, a business must do three things to become PCI-compliant:
While the PCI DSS is a set of standards, not laws, almost every state has enacted legislation that requires merchants to notify their customers of security breaches. Both state and federal privacy regulations also forbid merchants from storing unencrypted cardholder data.
Did you know? Cardholder data refers to personally identifiable information (’PII’) associated with the owner of a debit, credit, or prepaid card. This includes PIN numbers, social security numbers, card numbers, and more.
Failure to comply with PCI standards can result in costly consequences — including fines, legal fees, card replacement costs, forensic audits, decreases in stock equity, reputation damage, and loss of business.
Payment processors don’t have to provide compliance assistance, so you should make a concerted effort to find a full-service partner, like Propelr, to help simplify your compliance needs to ensure you’re meeting all requirements. A true payments partner can help reduce your risk of exposure and act as your security advisor by identifying system vulnerabilities that could be targeted by cybercriminals. Your payments provider should also be well versed in the latest compliance rules, as well as the various payments technologies that help decrease — or even remove — your systems from PCI scope.
.jpg)
Ever wonder what actually happens when a customer swipes their card? Five key players work together behind the scenes: the issuing bank, the card brands, the processor, the payment gateway, and the sponsor bank. This breakdown covers who's who and what each one is responsible for.
.svg){kind=icon}
.svg){kind=icon}
Propelr has partnered with Atrium Campus, a leading provider of cloud-native campus card management solutions, to embed secure payment acceptance directly into the Atrium platform, enabling institutions to seamlessly integrate modern payment capabilities into their campus technology ecosystem.
Late-night businesses no longer have to choose between capturing every sale and getting paid quickly. Learn how Propelr's new 3am ET cutoff gives merchants greater flexibility and faster access to funds.
.svg)