I have a question regrading PCI DSS requirement, I know that the sensitive authentication data such CAV2/CVC2/CVV2/CID4,PIN cannot be stored with any format even encrypted or hashed (Requirement 3.2).

But the banks are storing these data and they are certified, how they are bypassing theses requirements.

The second point is about recurring (not tokenization) payment which needs the ccv in order to process the payment how this can be implement if the merchants or service providers are not allowed to store the cvv.

  • 1
    Generally speaking, banks are not certified as PCI compliant. Merchants and Service Providers are required to become compliant and banks are responsible for ensuring their merchants and service providers are compliant.
    – AndyMac
    Feb 21 '17 at 15:23
  • In my experience (Europe mostly), banks do certify against various sections of PIC. Some banks will be Merchant, Issuer and Acquirer so will need to certify against all 3 sections.
    – Rory Alsop
    Mar 27 '17 at 8:05

So banks are known as "issuers" in PCI DSS, in section 3.2 of PCI DSS you can note in the guidance

Entities that issue payment cards or that perform or support issuing services will often create and control sensitive authentication data as part of the issuing function. It is allowable for companies that perform, facilitate, or support issuing services to store sensitive authentication data ONLY IF they have a legitimate business need to store such data.

Further it states that,

For non-issuing entities, retaining sensitive authentication data post-authorization is not permitted.

Because they issue cards, they're allowed.

To answer your second question, if you need the CVV code to authenticate a recurring payment, tokenization is generally how to work around needing the CVV. You submit the payment information to the processor, they give you a token back representing the information, which can then be used later to submit a payment with their payment credentials, but does not contain any actual information of the client and can be safely stored. This allows you to submit payment without the CVV for recurring payments.

  • 1
    Thanks for your comment, can you give me an example of << support issuing services>>, is this any payment gateway does this ?
    – Petr
    Feb 22 '17 at 6:09
  • 1
    A payment gateway would not necessarily be supporting issuing services, any company that helps assign a physical card to a consumer would be supporting issuing services, so if for instance your bank has a third-party company that helps run the data systems that issue your bank card, that third party would be supporting issuing services. I've never work on the issuer side of PCI so I couldn't tell you a concrete example of a company like that.
    – Ryan Kelso
    Feb 22 '17 at 12:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.