I know that sensitive authentication data such CAV2/CVC2/CVV2/CID4,PIN cannot be stored in any format or even encrypted or hashed (Requirement 3.2).

But banks are storing these data and they are certified. How they are bypassing these requirements?

The second point is about recurring (not tokenization) payment which needs the CVV in order to process the payment. How can this be implemented if the merchants or service providers are not allowed to store the CVV?

  • 2
    Generally speaking, banks are not certified as PCI compliant. Merchants and Service Providers are required to become compliant and banks are responsible for ensuring their merchants and service providers are compliant.
    – AndyMac
    Feb 21, 2017 at 15:23
  • 2
    In my experience (Europe mostly), banks do certify against various sections of PIC. Some banks will be Merchant, Issuer and Acquirer so will need to certify against all 3 sections.
    – Rory Alsop
    Mar 27, 2017 at 8:05

2 Answers 2


So banks are known as "issuers" in PCI DSS, in section 3.2 of PCI DSS you can note in the guidance

Entities that issue payment cards or that perform or support issuing services will often create and control sensitive authentication data as part of the issuing function. It is allowable for companies that perform, facilitate, or support issuing services to store sensitive authentication data ONLY IF they have a legitimate business need to store such data.

Further it states that,

For non-issuing entities, retaining sensitive authentication data post-authorization is not permitted.

Because they issue cards, they're allowed.

To answer your second question, if you need the CVV code to authenticate a recurring payment, tokenization is generally how to work around needing the CVV. You submit the payment information to the processor, they give you a token back representing the information, which can then be used later to submit a payment with their payment credentials, but does not contain any actual information of the client and can be safely stored. This allows you to submit payment without the CVV for recurring payments.

  • 1
    Thanks for your comment, can you give me an example of << support issuing services>>, is this any payment gateway does this ?
    – Petr
    Feb 22, 2017 at 6:09
  • 1
    A payment gateway would not necessarily be supporting issuing services, any company that helps assign a physical card to a consumer would be supporting issuing services, so if for instance your bank has a third-party company that helps run the data systems that issue your bank card, that third party would be supporting issuing services. I've never work on the issuer side of PCI so I couldn't tell you a concrete example of a company like that.
    – Ryan Kelso
    Feb 22, 2017 at 12:09

For tokenzation and card-on-file transactions, it is a common myth/mistake to believe the CVV/CV2 is required for these transactions. As long as they are flagged correctly, you will not require this data.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .