Since credit card transactions like cash advance can be performed at most ATMs, are banks required to be PCI DSS compliant?

1 Answer 1


The Payment Card Industry DSS rules also apply to banks. I was at a large UK bank that had to change it's customer database to make the card information more secure from staff as part of a PCIDSS initiative. This included obscuring part of the PAN (the long number) from operators in the call centres etc.

It should be noted however, that in certain jurisdictions (i.e. the UK) there are a lot of other regulators that have much more effective security controls that are placed on banks and so whilst PCI DSS is applied to the cardholder data usage, it is not the be all and end all.

  • 1
    Are the controls you mention standardized or at the whim of individual bank?
    – Drew Lex
    Jan 30, 2013 at 14:06
  • It's a mixture. There are legal, contractual, regulatory and ethical standards to apply. Clearly the bank owns it's own appetite to risk and therefore can have it's own take on these standards. There is a balance between cost, security and functionality that each bank has to make a decision on before investing in an effective control framework. In my experience, it's rare for a bank not to take security standards seriously. Jan 30, 2013 at 14:10
  • Yep-having worked with almost all the major banks represented in the UK, I can state they take it more seriously than almost all other industries.
    – Rory Alsop
    Jan 30, 2013 at 14:37
  • 1
    @RoryAlsop - I can't say the same about US banks. There idea about required 2-factor authentication is a complete and total joke. A secret question ( asked when you log into a unknown electronic device ) while a second authentication is not what should be implemented.
    – Ramhound
    Jan 30, 2013 at 16:07
  • That is... scary, to be honest.
    – Rory Alsop
    Jan 30, 2013 at 16:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .