[Autogenerated] Okay,
now we've covered the difference between reports on compliance and
self assessment questionnaires or essay cues.
Let's use that knowledge to help us answer the six really critical
questions we have to address when we talking about achieving PC Idea
says compliance for an organization,
these questions are Who is asking you to comply with PC?
Idea says, Why are they asking you to be compliant?
What authority do they have to request this?
What happens if you don't?
How did they want you to provide evidence of your compliance?
And finally, have they set a deadline?
Because the assets of these six individual questions
will help you out to the real question.
You need to be asking yourself which is again to find that destination.
It's actually no.
Do I have to do this because that's what it might sound like.
But what flexibility is there in determining the destination?
So let's stop off with what I hope is the simplest question.
Who is asking to comply with PC Idea says on For most organisations,
there are going to be five possible answers to this question.
The first on perhaps what's going to be the most common is that
you're a merchant and you accept payment cards.
And so you're being asked to comply with PC I DSS boil merchant or
acquiring bank or acquirer or directly by a conference.
The second is that your service provided to that type of
merchant and the merchant asking you to comply with PC Idea
says there's a contractual obligation.
The third is quite similar again your service provider,
but this time you're being asked to comply with PC Idea
says by Financial Institution Typically in acquiring
banker in issuing bank Fourthly, you might be that finance institution,
and you're being asked to comply with PC I DSS by one of the five card
brands that comprise the PC Eyes Security Standards Council.
Finally,
you might have just self determined there's a local law or a
regulation which requires you to comply with PC,
Idea says.
So I decided to tell yourself to become PC ideas s compliance.
Also, it's really useful to know why someone else is asking you to be complied.
So not just that.
They are, because again, if you understand their view of the world,
it can help you deal with any negotiations.
So I'm going to look at these five common scenarios in a bit more detail.
And as we go through these scenarios,
what may surprise you is it will almost certainly be a
contractual requirement that an organization has to
demonstrate its compliance with PC, Idea says.
And provide that to another organization.
And just to be clear, when I say a contract,
I mean a written agreement between the organization that's
demonstrating its compliance in the organization that's asking
somebody to demonstrate its compliance.
Firstly, if you're emergent the business that accepts payments by card,
the merchant or acquiring bank,
the acquirer that processes payment card transactions for
merchants have contracts with card brands that allow them to
provide this acquiring service.
Part of those contracts specify that they will follow specific security rules,
and those security rules require the acquirer to ensure
that all their merchants comply with PC.
Idea says so here,
the chain of compliance is from the car brands to the
acquirer and then to the merchant in three party schemes
like Amex or American Express, where there is no acquirer.
The merchants contract directly with American Express
requires the merchant to be compliance.
So it's the acquire this enforcing compliance.
They're asking the merchant to comply because of their contract
with the card brands requires them to do this.
The authority comes in the contract they signed with the merchant
Iwill Say you will be PC Idea says Compliance.
If the merchants not compliant than the card brand
may actually charge a penalty,
where or an assessment or or some people call it fine
either directly to the merchant or to the acquirer will
then pass it on to the merchant.
How a merchant provides evidence of its compliance typically depends on
the number of transactions they process annually.
Larger merchants on there, called Level One,
or level two, need to have an on site assessment.
Smaller merchants Level three and Level four will be out to self assess This.
This leveling is defining the car brand rules,
and in each car brand is slightly different.
I'm not gonna cover them in detail here.
The acquirer will tell the merchant what they need to do,
and typically emergent will also be given a deadline for compliance.
And here's weather can be some negotiation.
Everyone knows that when you move from a self
assessment to needing an on site assessment,
which Intel's getting that external help on that external
Ceta you'll find merchants will find that they were nowhere
nearest compliance is perhaps, they thought,
And so this is definitely where much it can negotiate on In my experience,
all the acquires in the Browns.
They're gonna be very happy if you've got a realistic
costed timetable to get compliance on.
Certainly, this course can help you do that.
So if you become a merchant, they so what?
We need to report on compliance in six weeks time,
or, I mean, that's not reasonable.
But that's not reasonable.
You can You can give a project.
Planets as well get complies on this date on most acquires,
and car brands will accept that now if you're a service provided to emergent.
The reason the merchant is asking you to comply with PC,
idea says, is because they're acquiring.
Bank is demanding that they are complying with PC ideas s,
which means that if you store process,
transmit Carter's or data on the merchants behalf or you could
affect the security of the cardholder data.
You also need to be compliance.
Un.
There's an additional wrinkle here.
Some of the car brands have a rule that says merchants should only use
service providers that have registered also with the car brand.
A registration with a car brand for service provider means paying the
car brand of fee and sending the attestation of compliance or all the
reporting complies directly to the car brands.
You know this isn't totally enforced,
and the approach of varies between car brands on the
region's The car brand operates in a single car brand might
be different in different regions, so here the merchant is enforcing compliance.
But asking their service provided to comply because of their compliance is
dependent on the compliance of the service provider,
and their contract with the acquirer requires the merchant to be
compliance now because this is a subjective contractual negotiation
between merchants and service providers,
he lost to find that service providers don't actually
want to put this in their contract, and they don't want to comply,
and merchants sometimes struggled to enforce this.
The merchant will ideally what the service provider to have
an on site assessment and provide the service providers
reporting complies to the merchant.
But the merchant may also accept a self assessment questionnaire
or or even the merchant might include the service provider in the
scope of the merchants own PC Idea, says assessment.
So the service provider essentially becomes part of the merchants environment.
Assessed the deadline given by the merchant to the
service provider will be the same deadline.
Is the merchants agreed with its acquirer.
As you know, from the service providers perspective,
there's lots and lots of room for negotiation about
how that complies is demonstrated.
Who's gonna bear the cost on at what stage of full compliance is required?
If your organization is a financial institution
issuing or accepting payment cards,
the car brands whose cars you accept or issue will
require you to comply with PC, Idea says.
So it's the car brand that's asking the financial institution to be compliant,
and this requirement will be really clearly laid out in the contract
between the car brand on the financial institution.
If the institution doesn't want to comply with PC idea cess when the car
brand will be very happy not to sign the contract with them,
this is usually very non negotiable.
The contracts between card brands and acquirers and issuers typically got
very large penalty clauses if the contracts are broken,
for example, by somebody not being PC ideas as compliance.
But it's really interesting.
But generally the car brands don't require issues and acquires to
demonstrate their compliance on a regular basis by giving the card
brand secure reporting compliance.
They're only going to ask us such evidence if another event
prompts him to question the financial institutions.
PC Idea says compliance on most common,
this is going to be because there's been a data breach of the
financial institution on the card bramble that say,
Well,
you need to prove you were PC ideas has complied
before that data breach occurred.
Typically,
the financial institutions going to agree to be compliant as
they signed the contract with the car brand on.
There really is almost no negotiation for this contractual requirements.
And if you're a service provided to a financial
institution that issues or excess payment cards,
they're asking you to comply because again they're contract with the car brands,
requires them to ask you to be compliant.
You might also have to register and supply evidence of your
complies directly to the card rounds.
So again,
running through our quick checklist if you're a service
provider to an acquiring bank or issuing bank is the
acquiring bank or the issuing bag.
Who's asking you to comply with PC?
Idea says.
But asking for this because their contract with the car brands
requires it and they can make this request because it we part of
their contract with a service provider.
Now, unlike the Merchant to Service provider relationship,
the financial institution to service provider relationships much
more stringent in terms of PC ideas as compliance.
Because two of the major card brands require all service providers to their
issuers or acquirers toe also be registered with the car brands.
This requires the service provider to send their evidence of
compliance directly to the car brands.
If the service provider doesn't do this,
the car brand will tell their customer,
the acquirer or the issuer to stop using that service provider
to this requirements pretty non negotiable.
Depending on how many transactions of service provider processes,
they will be required to either provide a report on
compliance if they process more than 300,000 transactions a
year for a self assessment questionnaire.
If they process less than this now,
some cars brands actually can be flexible here on time table,
and they may give new service providers 12 months become PC idea,
says compliance.
But because the service providers ultimately dealing with the financial
institution whose the card brands customer and the car brand really cares
about the security of third party service providers to their customers that
tests be really little room to negotiate here,
the final scenario we need to consider is when a merchant or any
organization decides for itself to comply with PC,
Idea says,
because it believes it's got a legal or regulatory requirement to do this now.
There are some countries and U.
S states that require PC ideas s compliance with certain organization.
They put them in their laws.
And that's outside the scope off this, of course.
And here you can see why it is important to understand why an
organization wants to become compliance because within the
payment ecosystem complies with PCR.
GSS is very tightly controlled in all cases,
starts with a car brand,
asking somebody else to comply with PC idea set and then
complies flows down from that changes,
like a chain of compliance between the car brands and then the other
entity that wants to be complied with PC idea cess.
In this sense, the card brands are the law,
the police, the judiciary and as such, they establish pretty clear rules.
However,
when organizations understand that other regulations or
national laws require compliance with PC,
Idea says,
then it's the responsibility of the organization to
work out the answer to the questions.
Why they being us to comply?
What happens if they don't?
How are they going to prove their compliance?
The regulator, if they need to.
When did it have to be compliant by and to what
degree they can negotiate compliance?
So bear in mind as well as we're going through this course,
I'm only talking about compliance as it relates to car brand
rules and not to national auto local laws.