PCI-DSS for Financial Institutions and Issuer

Question

Here is the scenario:

A financial institution outsourced all PCI-DSS-related activities. Therefore (in theory), it does not store, transmit, or process credit/debit card data. It also issues debit cards but, it only initiates the process by taking basic client information. Then, the information is forwarded to a service provider that issues and sends the debit card to the client. However, the company has been required to be PCI-DSS compliant.

In my humble opinion, PCI-DSS has not been 'designed' to work for financial institutions. It is more focused on service providers and merchants. In fact, the SAQs are for merchants and service providers only. I am not aware of SAQs for financial institutions.

Questions:

1. How can that financial institution prove that it is PCI-DSS compliant? What tools and processes can they use considering that the current ones are designed for merchants and service providers (e.g. SAQs)?

2. Can they use the SAQ (if so, which one?)to evaluate their compliance and put N/A on the related not applicable requirements? Can they use the prioritised approach?

3. If a requirement is N/A because it has been outsourced, who does own the responsibility to the requirement, the financial institution or the outsourcing company that handles the credit card information? In other words, am I correct in assuming that even if the financial institution outsources all the credit/debit card processes, it is still responsible to make sure that the outsourcing company is PCI-DSS compliant?

Answer 1

As a card issuer your requirement for compliance will come from the rules of the card scheme (i.e. Visa or Mastercard). I mostly know Visa Europe's rules but understand that Mastercard's rules are pretty similar. So to answer your specific questions:

Q1. It depends on your contract with the card scheme, often issuers do not have to validate their compliance to the card scheme (i.e. they are not required to send the card scheme a RoC or SAQ on an annual basis), but they are contractually obliged to comply with PCI DSS and other PCI standards applicable to card issuers. Some issuers choose to have an annual external assessment and keep the RoC on file in case the card scheme asks for evidence that the issuer is compliant.

Q2. Again it depends on your contract with the scheme. If the FI is wholly outsourced (ie there is no cardholder data anywhere in the institution) then it could use the requirements from SAQ-A in a partial RoC - there is a FAQ on the PCI SSC website about this: https://pcissc.secure.force.com/faq/articles/Frequently_Asked_Question/Can-a-partial-PCI-DSS-assessment-be-documented-in-a-Report-on-Compliance-ROC

Q3. Typically the card scheme has an approved list of suppliers that issuers are permitted to use - you should check the scheme's rules and then their list - e.g. Visa Inc has a 'Member Issuer Processor Program'.

However, despite a provider being listed by a card scheme, you have complete responsibility for ensuring the third party's compliance with PCI DSS on an annual basis (all the 12.8 requirements apply), and as your compliance is wholly dependent on the third party this is your main responsibility.

Finally, if you are in Europe, Visa Europe has produced specific guidance for issuers that you can get from Visa Europe.

Answer 2

Q1:

First of all everyone needs to be PCI-DSS compliant. Being compliant means you adhere to the requirements listed in the PCI-DSS guidelines. The applicability of those guidelines depends on your environment.

The way they can proof they are compliant is to list down their scope of operations and map the relevant and irrelevant controls ( for the irrelevant controls you list down why they are irrelevant).

Q2:

It's not as simple for an FI. In general FIs have a QSA assigned that reviews and decides what is applicable and what not. Remember that there are way more stringent requirements if you exceed a certain amount of transactions a year.

Q3:

Simply saying "I am outsourcing therefore it's not my problem" won't work. You need to show how you ensure your 3rd party vendor is adhering to PCI-DSS (e.g. contractually require them to obtain the certification themselves).