Does PCI DSS apply to virtual (electronic-only) PANs?
PCI DSS applies to all primary account numbers (PANs) that represent a PCI SSC Participating Payment Brand. This includes PANs that are only provided electronically (virtual PANs) as well as …
Recent FAQ Changes RSS
Latest changes to PCI SSC frequently asked questions.
Does PCI DSS apply to one-time or single-use PANs?
PCI DSS applies to all primary account numbers (PANs) that represent a PCI SSC Participating Payment Brand. Whether a one-time PAN is in scope for PCI DSS will depend on …
Where do I direct questions about complying with PCI standards?
Each of PCI SSC?s Participating Payment Brand members (American Express, Discover, JCB International, Mastercard, UnionPay, and Visa) currently have their own PCI compliance programs for the protection of their affiliated …
Does PCI DSS apply to bank account data?
PCI DSS applies for the protection of cardholder data (PAN, cardholder name, service code and expiration date) and sensitive authentication data (full track data from the magnetic stripe or equivalent …
How do I contact the payment card brands?
Contact the applicable payment brands and/or acquirer (merchant bank) for more information about PCI compliance programs.
Contact details for the PCI SSC Participating Payment Brands are provided below:
…
What is the definition of "merchant"?
For the purposes of the PCI DSS, a merchant is defined as any entity that accepts payment cards bearing the logo of a PCI SSC Participating Payment Brand as payment …
Can PFIs provide reports to their clients before sending the report to the affected payment brands?
No. It is not acceptable for reports (draft or final) to be issued to clients, acquirers, issuers, or other parties for review/amendment before being sent to payment brands and/or acquirers. …
What are acceptable formats for truncation of primary account numbers?
This FAQ reflects updates as of November 2021 for acceptable truncation formats for different PAN / BIN lengths.
Acceptable truncation formats vary according to PAN length and Participating Payment …
What is the process to initiate a software evaluation to the PCI Secure Software Standard?
Vendors that want to have their software assessed to the PCI Secure Software Standard initiate the process by engaging a qualified Secure Software assessor from the PCI SSC list of …
Is software-as-a-service (SaaS) eligible for Secure Software Standard validation and listing?
Yes, if the software in question meets all stated eligibility criteria in effect at the time of submission, software-as-a-service may be validated to the Secure Software Standard and listed on …