PIN security

The Visa PIN Security Programme is a global programme designed to ensure all participants in the acquiring transaction processing chain maintain the highest level of Personal Identification Number (PIN) security.

The confidentiality of cardholder PINs used in Visa transactions depends on all payment system participants complying with the following applicable requirements:

  • Payment Card Industry PCI PIN Security Requirements
  • PCI PIN-Entry Device Security Requirements
  • PCI Encrypting PIN Pad Security Requirements
  • PCI Point of Interaction Requirements
  • Visa Requirements.

These requirements are designed to ensure the secure transmission of cardholder PINs from the point of entry. The PCI PIN Security Requirements complement the PCI Data Security Standards (DSS) for entities that accept or process Visa PIN-verified transactions. PIN-accepting entities must be fully compliant with the PCI PIN and PIN Transaction Security (PTS) Requirements.

How the programme works

Card issuers rely on acquiring banks and processors to ensure cardholder PINs are handled securely during processing. As a consequence, all acquiring banks, their processing agents and any other third parties involved in the processing of Visa PIN-based transactions and the associated cryptographic keys must participate in the programme. (These participants are referred to as entities in the below.)

Every three years, entities must complete and return a Self Audit Form (SA). The Self Audit includes a range of questions and, each time an entity answers ‘no’ or ‘not applicable’, an Exception Form must be completed giving details of why the entity is not compliant, what plans are in place to correct this and the planned completion date.

The SA, Exception Forms and a Self Audit Compliance Statement must be returned to Visa 45 days before a live date (for new entities) or by the due date (for existing entities). All new entities must be fully compliant before going live. For each year in between the three-yearly Self Audit, entities must complete an Annual Certification Statement to verify the continuing validity of the information in the SA.

More information

For more information on the PIN Security Programme please contact Visa at visaeuropepin@visa.com or visit www.visa.com/pinsecurity