In this module,
we're going to discover why you may want to become compliant with any
of the PCI standards and who you can get to help.
Imagine that you're going to be in charge of Wired Brain
Coffee's compliance with PCI DSS. Well, in this module,
we're going to find out who might be asking you to comply with the standard
and also how to identify those people that can help you.
When I first became a PCI assessor,
I didn't pay attention to this part of the training because I didn't really
understand the different roles of acquirers and card schemes,
and actually, I didn't appreciate how important this was until I went
to work for Visa Europe, but actually knowing who's making your
organization comply with the PCI standard,
especially the data security standard, is vitally important because it's
that person you can talk to about any compliance problems you might
have. As well as looking at why organizations comply, we're also going
to find out about the programs and technical qualifications managed by
the PCI SSC because you may well need to find someone to help you on
your PCI journey, or perhaps you're thinking about becoming qualified
yourself.
It might surprise you to know that PCI compliance isn't generally a
legal requirement, except in certain US states and a very small
number of countries where compliance with PCI DSS has been
incorporated international or state laws.
If you're in one of those states or countries, you probably know about it.
So I guess the question you are asking yourself is why do
companies have to comply with PCI standards.
Now, do you remember this slide from the first module? It showed how
transactions went from the merchant to the acquirer through the card
scheme and then to the issuer. As you might guess,
there are contracts between all of the parties in this arrangement.
Now I know I've just said the word contract, and remember, I said this was the
bit of training that I zoned out over and I regret that.
So stay with me for about 3 minutes because this is
about to get really interesting.
Firstly,
there is a contract between the issuer and the scheme that lets the
issuer give their cardholders cards within the scheme.
That means if the contract is with Visa, they can issue cards with a Visa logo.
There is a contract between the scheme and the acquiring banks
that says the acquirer can sign up merchants and process their
transactions and an acquiring bank is going to have contracts with
each card scheme individually.
So for example, it can acquire both Visa and Mastercard transactions.
And finally,
there is a contract between an acquirer and a merchant saying that the
merchant will be able to accept all types of card transactions.
And in all of these contracts,
there are one or two requirements that are really interesting to us.
Now seriously, in the contract between the issuer and the card scheme,
the scheme will typically ask the issuer to comply with the data
security standard and that it uses suppliers who are compliant with the
card production standard.
And if the issuer uses 3DS for ecom transaction
authentication or it's a token provider,
it will also be required in that contract to comply with the relevant standards.
The contract between the card scheme and the acquirer is really
important because it's split into two parts.
The first part is similar to the scheme and issuer contract requiring the
acquirer to comply with PCI DSS and also with PCI PIN.
The second part is the one that will interest most people as it is this part
of the contract that tells the acquirer that they are responsible for the way
that they're merchants secure cardholder data and that the acquirer has to
ensure that all of the merchants it allows to accept transactions from the
card scheme comply with PCI DSS.
So it's no surprise that the contract between the acquirer and the merchant
specifies that the merchant must comply with PCI DSS.
And so the reason that most companies have to comply with PCI DSS is
because it's a condition of their acquiring contract.
And so the enforcement of this comes from the acquirer, but what
about three‑party schemes where there is no acquirer.
Again, in the first module,
we looked at the payment flows between the merchant and the scheme
in a three‑party model like Amex or discover where there is no
acquirer in the way. The transaction goes straight from the merchant
to the scheme for authorization,
as you probably guessed in the three‑party model just as the payment
transaction goes directly to the scheme, the contract is between the
scheme and the merchants and it is this scheme that makes the
merchants comply with PCI DSS.