Get with the program people!
The PCI standards have been around for almost four years now and you would think with all of the press that has been given the PCI standards that the key participants in the standards would be intimately knowledgeable with these standards. However, the more and more I talk to acquiring banks, the more I am amazed that most acquiring banks still are not with the program. It is time for all acquiring banks to get a clue about the PCI standards and their responsibilities regarding the PCI standards.
Acquiring banks have many responsibilities under the PCI standards. The first of which is to understand and support the PCI standards. However, it is painfully obvious from trying to work with acquiring banks that most are clueless about the PCI standards, let alone do they understand their responsibilities. Card brands and the PCI SSC have focused on educating QSAs, merchants and service providers in the PCI standards to the detriment of educating acquiring banks. I cannot tell you how many conversations I have had with acquiring banks where they have no idea of what their responsibilities are regarding the PCI standards let alone regarding knowledge of the PCI standards themselves. What I dearly love are those acquiring banks that tell me that they have no responsibilities in regards to the PCI standards, that it is a merchant program.
This is not just a problem in the United States, this problem is worldwide. This is a very big issue in Asia where acquiring banks seem to be totally clueless about the PCI standards. It is a bit better in Europe, but because European acquiring banks have been brainwashed to believe that Chip and PIN gives them a security edge, the acquiring banks there are not aggressively promoting PCI compliance. But at least the European acquiring banks seem to have a basic understanding of the PCI standards and some of their responsibilities.
Another responsibility of acquiring banks is to be the final arbiter between merchants or service providers and their QSAs. According to the card brands, if a merchant or service provider is at loggerheads with their QSA over whether a PCI requirement has been met, the acquiring bank is supposed to be the final arbiter of that dispute. Yet in the handful of instances where I have been involved in such disputes, the acquiring bank has provided limited or no assistance with the dispute.
An even bigger problem is with small merchants that are trying to decide which Self-Assessment Questionnaire (SAQ) to file. Again, the card brands have stated that the decision regarding which SAQ to file is the responsibility of the acquiring bank and no one else. Yet time and again, our small merchant clients contact my Firm because the acquiring bank has told them it is up to a QSA to determine the SAQ to file.
Then there is the acquiring banks’ responsibility to follow the PCI standards. Yet time and again, I run into instances where the acquiring bank is transmitting cardholder data insecurely to or from the merchant or service provider. The number of acquiring banks that use FTP or electronic mail for the transmittal of cardholder data is just staggering and after four years of the PCI standards existence is unacceptable. Yet, when you bring this issue up, a lot of the acquiring banks will tell you that PCI standards are for merchants, not for them. The other excuse I hear is that the acquiring bank is working on securing their transfer of cardholder data. Again, after four years of the PCI standards, you are just now getting around to securing the transmission of cardholder data? Unbelievable.
This year we started receiving calls from banks and credit unions that drive their own ATM networks that had been requested by their ATM network interconnection provider such as NYCE and Pulse to obtain a PCI Report On Compliance. What a wakeup call. In a number of cases, the institution was shocked that the PCI standards applied to them and questioned us extensively to confirm that they really had to go through the process.
As a QSA out in the field, these attitudes are just no longer acceptable. The PCI program flounders in part because one of the key constituents is not on board. It is time for the PCI SSC and the card brands to educate the acquiring banks and get them engaged.
PCI Guru 