Payday: Getting PCI Compliance Right With These Action Steps
July 22, 2021
How is your payments security looking these days? If your answer is “not great”, embrace these strategies.
The Payment Card Industry (PCI) compliance protocol is now 14 years old and with the expansion of corporate (and individual) payment options over the past decade, companies would do well to measure their payment compliance success.
If that evaluation finds your PCI protocol compliance is lacking, it’s also high time you took the steps needed to ensure your payments operation is 100% compliant.
Here’s a checklist to ensure your payments system is compliant and that it fully adheres to CPI regulatory requirements.
PCI compliance explained. Basically, PCI compliance means meeting the regulatory mandates laid out by the PCI’s Security Standards Council.
That council is composed of representatives from top-tier credit card firms, including Visa, MasterCard, Discover, American Express, and JCB International. Each company has a say in enforcing the PCI Data Security Standards. If you’re not PCI DSS compliant, then your company isn’t payment compliant.
The cost of PCI non-compliance. If you’re not handing company payments (i.e., credit cards, debit cards, ACH payments, and other electronic payments) properly, you’re risking big fines.
For example, if your firm isn’t PCI compliant and you suffer a data breach or other system security breakdown, non-compliance penalties can run up to $500,000. In addition, non-compliant companies risk having their merchant accounts suspended, which means your company can’t accept credit card payments. Under rules covering the Visa/Mastercard Terminated Merchant File rules, it may take years to have your merchant accounts up and running again. For most companies, that’s enough to put them out of business.
PCI Compliance Structure. Overall, PCI payments compliance includes four clearance and category levels, numbers one through four.
Level 1. This level is dedicated to larger corporations who handle heavy payment loads (a minimum of six million payments annually.) Level 1 includes big-box retailers who deal with heavy consumer payment volumes, with each one having to pass a quarterly PCI compliance audit.
Level 2. Level 2 companies handle between one million and six million payment transactions annually. Aside from quarterly audits, a Level 2 company may also be required to conduct an annual payment security risk assessment on a once-annually basis.
Level 3. Level 3 companies handle between 20,000 and one million payment transactions annually. This level also requires quarterly PCI audits and also mandates that companies undergo an annual risk assessment using the PCI Self-Assessment Questionnaire (SAQ).
Level 4. Level 4 companies are at the smaller end of the scale, payment compliance-wise. The level is designated for companies that handle under 20,000 ecommerce transactions and less than one million additional transactions annually. A Level 4 company must also complete an annual PCI-SAQ evaluation and may also have to undergo a quarterly compliance audit.
Three Ways to Improve PCI Compliance
With awareness of the payment compliance responsibilities and what’s at stake on the PCI regulatory front, here are several action steps that, when taken, can improve your company’s payment compliance efforts.
Study the actual standards used by regulators. The PCI Security Standards Council offers companies a thorough list of security standards (find the list here).
On the list, compliance officers can review a general compliance action along with actions to clear the general payment compliance hurdle.
For instance, the standards list includes this “general” compliance requirements along with helpful steps in complying with it.
General compliance requirement: Build and Maintain a Secure Network and Systems.
Actions to fulfill the requirement:
Install and maintain a firewall configuration to protect cardholder data.
Don’t use vendor supplied defaults for system passwords and other security parameters.
The PCI Security Standards Council list also includes sections on protecting cardholder data, maintaining a vulnerability management program, and implementing strong access control measures, among other compliance items.
Reduce your payment compliance scope. Proceeding on a successful payment compliance path means knowing the lay of the land. After all, compliance officers won’t secure payments if they’re not aware where the biggest vulnerabilities lie.
That’s why it’s imperative that compliance officers know what consumer data their company holds, how and where that data is stored, and which company personnel, consultants and business partners have access to that data. Additionally, it’s a good idea to separate your company’s cardholder data environment from the rest of your payment network. That aids in curbing compliance scope and reduces your vulnerable target areas.
Make payment compliance a regular issue. Proper payment compliance needs to be a regular business activity.
Yes, the PCI compliance structure only calls for quarterly or annual PCI external testing. Yet to clear those testing and auditing hurdles, companies should make specific actions a regular occurrence. Those actions should include:
— Self-testing, self-auditing, and compiling a thorough history of data user lists,
— Applying and monitoring the use of robust passwords, data encryptions, and system security policies.
— Training employees on potential cybersecurity threats.
— Regularly assessing your company’s internal payment security risks.
— Eliminate all unnecessary payment data to protect against potential data breaches.
All of the above should be spokes in an ever-rolling wheel of payment compliance processes. Ideally, team members will come to accept it as part of their daily employment responsibilities.
That not only makes for a stronger PCI payments compliance structure, it also contributes to a more trusting and validating experience for your customers over the long haul.
Asif Alam is the Chief Executive Officer at Compliance.ai. A leader in shaping disruptive technology, his experience includes building products using AI and natural language processing for GRC, payments, lending, risk, trading, and new solutions, from Fortune 500 companies to startups.
In his most recent role, he served as the Chief Strategy Officer of ThoughtTrace, unlocking new revenue streams and markets, and reignite portfolio growth. ThoughTrace was then acquired by Thomson Reuters in 2021.
He brings more than 20 years of management and business experience; increasing profitability, unlocking new revenue streams and markets, and reignite portfolio growth for companies like Thomson Reuters, Crux Informatics, and Finastra. Asif is a forward-thinking expert driving engagement via client forums, public presentations, and white papers.
Cesar Lee is a Principal at WRV, a venture capital fund focused on early-stage investments in hardware, semiconductor, and other technology-related companies. Previously, he was an investment professional at Riverwood Capital, a technology-focused, late-stage venture capital, and private equity fund. He began his career at RBC Capital Markets, where he was part of the Mergers & Acquisitions group for two years and the Equity-linked & Derivatives group for one year. While at RBC, Cesar spent a majority of his time working on M&A advisory transactions for technology companies.
Cesar’s investment experience includes buyouts, later stage, early stage and seed rounds. Cesar has completed transaction in the U.S., Latin America, and Asia, and in technology sectors including data centers, software, semiconductors, consumer electronics, robotics, big data, and internet.
Maria Devassy is a RegTech, Content, and Technology leader with over 20 years of experience helping companies bridge the gap between technology, product, and business. Maria has held leadership positions with MetricStream, KPMG, Oracle Corporation, and other technology companies. She has launched several successful RegTech products, business partnerships, and advised Fortune 100 clients on risk management, audit, advisory, and compliance business across Industries.
Hugh Cadden is a recognized expert in derivative financial and trading markets including futures, options, and swaps. Hugh is currently a senior consultant and expert with OnPoint Analytics, Inc. an economic, finance and statistical consultancy specializing in expert testimony for complex litigation. He has been specializing in the organization, operation, and regulation of financial and trading markets for over 40 years. Hugh’s experience includes both the public and private sectors and he has held senior level positions with the U.S. Commodity Futures Trading Commission including serving as Director of the Division of Trading and Markets and Deputy Director of Enforcement. He has been qualified as an expert on financial and trading market matters before the Commodity Futures Trading Commission, the Securities and Exchange Commission, the U.S. Tax Court, Financial Industry Regulatory Authority, National Futures Association, American Arbitration Association and federal courts.
Drake Ross is a former bank regulator who specialized in compliance with consumer protection regulations while at the OCC, FDIC, and OTS. While at these agencies, he provided extensive training and guidance and developed materials to ensure full comprehension and proper application of rules, laws, policies, and guidance, and served as a Subject Matter Expert in numerous areas. Because of his expertise, he often presented at agency and industry events. He also played a significant role in successful windup of the 2008 IndyMac Bank failure, where because of his extensive knowledge of the FDIC deposit insurance regulations, he was called upon to administer highly-complex insurance determinations.
Carliss Chatman is an Assistant Professor of Law teaching Contracts, Agency and Unincorporated Entities, Corporations, and Transactional Skills. Her work is influenced by over two decades of service on non-profit boards and involvement with community organizations. Through leadership positions, she has developed expertise in corporate governance and non-profit regulation. She has also been instrumental in strategic planning and fundraising efforts. Prior to law teaching, Professor Chatman was a commercial litigation attorney in Houston, Texas. In practice, she focused on trial law, appeals and arbitration in pharmaceutical, health care, mass torts, product liability, as well as oil, gas, and mineral law. In addition to negotiating settlements and obtaining successful verdicts, Professor Chatman has also analyzed and drafted position statements regarding the constitutionality of statutes and the impact of statutory revisions for presentation to the Texas Legislature.
Sign me up for all regulatory updates
Get access to EITL Forum recordings
Mariam is an Operating Principal at Cota Capital. Mariam has experience providing guidance on strategic and operational planning to Venture and Growth stage companies. Prior to Cota Capital, Mariam spent her career in management consulting as a Director at KPMG. She has experience leading global transformation programs and developing innovative service offerings for Fortune 500 companies in the Technology sector. Mariam has an MBA from UCLA’s Anderson school of management with an emphasis in Finance and Entrepreneurship. She has a Bachelors in Science in Finance and a Bachelors in Science in Economics from Santa Clara University.
Chris Callison-Burch is an Associate Professor in Computer and Information Science Department at the University of Pennsylvania. His research interests include natural language understanding and crowdsourcing. He has served the Association for Computational Linguistics as the General Chair for the ACL 2017 conference, as an action editor for the Transactions of the ACL, as an editorial board member for the Computational Linguistics journal, and an officer for NAACL (the North American chapter of the ACL) and for SIGDAT (the special interest group for linguistic data and corpus-based approaches to natural language processing)
Tom Ladt is an experienced executive and investor. Tom has lead and served on the boards of several public and private companies serving highly regulated industries such as technology, healthcare, real estate, and food processing. Tom has also served in key governmental roles and on numerous community boards.
Jeroen Plink is a global executive with a proven track record of developing and growing businesses, teams, and technologies with innovation and passion. Jeroen was CEO of Practical Law US during its acquisition by Thomson Reuters. He now serves on numerous boards and acts as a strategic consultants for start-ups.
Global Legal and Compliance executive with 15+ years of success in the SaaS technology and financial services industries. Partner to the CEO and executive team in corporate transactions, business development, product expansion, and regulatory navigation during periods of intense growth and organizational change. An advocate of effective risk management that starts with sound business practices and putting the customer first.
Richard Dupree has held multiple Risk, Compliance and Operations positions at regional, national, and global financial services firms including Wells Fargo, Silicon Valley Bank, Bank of the West and BNP Paribas. Rick currently advises FinTechs and RegTechs and sits on industry panels, contributes to industry whitepapers, thought leadership efforts, and speaks at industry seminars on Risk and Compliance challenges faced by banks and FinTechs.
Brian advises clients on legal and regulatory compliance in the financial, tech, and procurement sectors. His passion is helping businesses succeed in heavily regulated environments. As counsel and trusted advisor to businesses of all sizes, and as a former regulator, policymaker, and federal official, Brian acutely understands the unintended burdens that even well-intentioned government requirements can put on innovation and business growth, as well as how to create policies that strike the right balance.
Brian served as National Ombudsman in the Obama Administration, leading the federal Office of Regulatory Enforcement Fairness in assisting hundreds of startups, entrepreneurs, and small business owners in every industry and every state.
Dr. Marsha Ershaghi Hames is Managing Director of Strategy & Development at LRN, a leader in advising and educating organizations about ethics and regulatory compliance, as well as corporate culture, governance and leadership. With the focus of inspired behavior versus required behavior, LRN is a leading voice in the industry for companies to build ethical cultures instead of “check-the-box” compliance approaches. She’s advised Department of Justice corporate monitors on successful program transformation under CIAs (Corporate Integrity Agreements. With over 20 years of experience in leading multinational ethics and compliance strategies, Marsha has become a highly sought-after thought leader on leading Corporate Compliance and Ethics practices.
Carla Carriveau is currently the Senior Managing Counsel at Wealthfront, an automatic investment service firm in Redwood City, California. Carla was previously Senior Counsel, Division of Trading and Markets, at the United States Securities and Exchange Commission. As a former regulator with over 15 years of experience in helping small businesses navigate legal and regulatory needs in the financial services sector, Carla advises Compliance.ai on financial services regulation, the regulatory landscape and industry practices.
