PCI requirements to handle physical credit cards in non-payment contexts?

Question

I can't be too specific unfortunately, but let's assume a company has to receive, do some physical operation on credit cards, and send them back.

No card data will ever touch a computer, and payments for the service are handled separately through a PCI-compliant provider.

Does the company need PCI-compliance?

Answer 1

Who requires you to be compliant?

PCI DSS is not a law, and nothing in the PCI DSS can require you to be compliant if you don't want to. The usual meaning when people say "X needs to be PCI DSS compliant" is that either X has signed a contract where they agree to comply with PCI DSS, or want to sign a contract of a type where every partner will require them to be compliant - e.g. taking credit card payments.

If you don't want to be compliant, and haven't agreed to be compliant, then you can blatantly violate all PCI DSS conditions with two major risks:

• the payment card industry may not want to talk to you, possibly in other aspects as well - e.g. if one of your products obviously goes against PCI DSS, then you may find out that you're unable to receive credit card payments for any products and services. That third party PCI-compliant provider might easily consider it good practice to refuse service to you if they believe you're misusing credit card data. Also, issuing banks may take action against you to prevent their cards being used in such a way - for example, if I as an issuing institution noticed that "End-users (bank customers) are sending cards" to some third party in sufficient numbers to warrant their attention, then it would be a proper and reasonable reaction to contact all customers who had transactions with you, notify them that their cards were compromised by doing this and asking them not to do it ever again, blocking all involved cards, requiring them to be replaced, and blocking any future card payments to you as potentially fraudulent.
• if your cardholder data are fraudulently used, you might be held liable, as knowingly violating "well known industry standards" can be considered negligence and put you at fault if some fraudster manages to obtain that CC data and harm your customers. Due to this, you might want to follow at least some of PCI DSS guidelines anyway, as they include a lot of best practices for secure handling of data.

Answer 2

PCI DSS 3.2 states: "PCI DSS applies to all entities involved in payment card processing—including merchants, processors, acquirers, issuers, and service providers. PCI DSS also applies to all other entities that store, process, or transmit cardholder data and/or sensitive authentication data."

There is an FAQ on the PCI SSC site that asks if PCI applies to paper with cardholder data and the answer was: "Yes, PCI DSS requirements are applicable if a Primary Account Number (PAN) is stored, processed, or transmitted by any media, including paper records. PCI DSS Requirements 9.5 through 9.8 specifically addresses the safeguarding of physical media, including paper records, containing cardholder data."

Given those two together, it looks like it would apply in the case of handling the media of the plastic card. As Jeff pointed out in a comment, if you don't have an agreement that contractually obligates you to PCI DSS, applicability gets interesting.

Not knowing the particulars of the process you're asking about, what I'd look at is whoever is sending the cards to the company in question. Are they a merchant or service provider that is obligated to be PCI DSS compliant? That company should be looking at 12.8, "Maintain and implement policies and procedures to manage service providers with whom cardholder data is shared, or that could affect the security of cardholder data, as follows:". This is followed by subrequirements that talk about written agreements that acknowledge responsibility, diligence processes to understand who has what responsibility on different requirements, etc.

In my experience with QSA audits, what I would expect to happen is the QSA would request a list from the merchant that included all entities with whom the merchant shared card data in any capacity. Then they would dig into that. While your company might not have any direct obligations, the merchants/service providers that you're working with that do have obligations could be in a bad situation if they needed to show evidence that they knew you were PCI DSS compliant and could not.