FAQ #1136 Diff

PCI DSS requirement 3.3 states “Mask PANRequirement 3.3 states that PAN must be masked when displayed (the first six and last four digits are the maximum number of digits to be displayed) .” See also the note under PCI DSS requirement 3.3: “This requirement does not apply to employees and other partiessuch that only personnel with a legitimate business need tocan see the full PAN.  This requirement does not supersede stricter requirements in place for displays of cardholder data (for example, for point-of-sale (POS) receipts).”

Since this requirement covers all displays of PAN, including those on paper reports, computer screens and receipts,requirement covers all displays of PAN, including those on paper reports, computer screens and payment card receipts.
Requirement 3.3 also includes the following note: "This requirement does not supersede stricter requirements in place for displays of cardholder data " for example, legal or payment card brand requirements for point-of-sale (POS) receipts.  It should be noted that the maximum digits allowed per PCI DSS may be more than aredifferent than what is specified in existing regulations(see FACTA below). Please note, however, that PCI DSS does not override any other laws that legislate what can be printed on receipts (such as the U.S. Fair and Accurate Credit Transactions Act (FACTA) or any other applicable laws).  PCI DSS does not override laws, government regulations, or other legal requirements that govern what can be printed on receipts.  Entities are encouraged to contact their acquirer or the applicable payment brand to determine if any such regulations apply.

Also note that any paper receipts received and/or stored by merchants for legitimate business reasons and which contain the full PAN must adhere to the PCI DSS, especiallythat contain PAN must adhere to applicable PCI DSS requirements, including Requirement 9 regarding physical security.