PCI Security Standards Bulletin: PCI SSC Announces Suspension of ISO Format 4 Pin Block Support Dates

PCI Security Standards Bulletin: PCI SSC Announces Suspension of ISO Format 4 Pin Block
Support Dates

11 March 2021


PCI Security Standards Council (PCI SSC) is suspending the ISO Format 4 PIN Block support dates which were
previously communicated in version 3.0 of the PCI PIN Standard. The dates are currently being reevaluated to determine
how best to support migration from TDEA (Triple Data Encryption Algorithm) to AES (Advanced Encryption Standard)
across the payment ecosystem.

In response to feedback from stakeholders, the PCI SSC is suspending the effective dates for entities to support ISO
Format 4 PIN Blocks which were previously communicated in version 3.0 of the PCI PIN Standard. The original dates
were based on a phased approach that targeted January 2023 for entities to support ISO Format 4 PIN Blocks decryption
and January 2025 for entities to support ISO Format 4 PIN Blocks encryption. While these dates have been removed from
the PIN Standard requirements, the PCI SSC encourages entities to continue their migration efforts from TDEA to AES.
ISO Format 4 is the only ISO format that supports the Advanced Encryption Standard (AES). Revised effective dates will
be communicated at a later date.

The PCI SSC recognizes that the migration to AES is a major effort across the ecosystem and we are reevaluating how
best to support this effort. PCI SSC will continue to solicit stakeholder feedback on the progress of migration efforts and
the time frames needed for organizations to implement the changes properly. Additionally, PCI SSC is preparing an
Information Supplement for release in 2021 that will provide detailed guidance on implementing ISO Format 4 PIN Blocks.
This Information Supplement will serve as a resource to help organizations understand what an ISO Format 4 PIN block is
and why migration is important, as well as provide guidance for migration planning.