payments - Retail Systems

RS
34 RS June - July 2012
roundtable
JK: It is for the small merchants – it’s just easier for them.
AY: My question to you Jeremy is; where do they go? Some of
them don’t even know what PCI is and they wouldn’t know who
to outsource to if you asked them. There are great solutions
out there, some with one vendor, others across several vendors.
JK: They have a relationship with their acquiring bank and so
that has to be the gateway for them. How good it is, I don’t
know. Some of the acquirers will have hundreds of thousands
of small merchants. Do they talk to them all individually or do
they just blitz them? However, those acquirers will have access
to suppliers who are PCI approved service providers so they can
give the smaller merchants this information. Essentially I’ve got
to work with the UK cards and the UK acquirer groups. Firstly
we need to be able to get some information to the merchants
and then once they’ve read that give them a list of people they
should be talking to, let them know how much it’s going to cost
and tell them what they’re going to get. And we need to let
them know what could happen to them if they don’t go this
route. The brands don’t differentiate between big and small
merchants when there’s a data breach, they just come in and
hit you. For small merchants it’s end of game.
AY: When chip and PIN came out there was a whole load of
education. Not just to the consumers but to the retailers as well
and that was pushed down by the acquirers. We don’t have that
same infrastructure for PCI and I think it’s that whole education
process that’s lacking, that’s what the retailers need.
JK: In some regard we’ve done a sort of top down approach.
We’ve started off at the big retailers and we’ve gone down
to the next level and now we’re getting down to the smaller
merchants. Whether that’s right or wrong, I don’t know.
“Outsourcing PCI is key for tier 3 and 4 retailers.”
AH: I think there’s a vast difference between the council
interpretation of the standard and the acquirer interpretation
of the standard. And sometimes you almost get the feeling that
they don’t want you to worry. They want you to be seen to be
trying so therefore there’s a small, tiny penalty per merchant
should you not register with the PCI DSS there’s a small monthly
fee, but that is all. So if you don’t meet the requirements you
tick a box for an implementation plan and this is never reviewed
and that almost gives you the ability to perpetually say: ‘We’re
working on implementation.’ At the moment acquirers don’t
appear to be serious.
CP: UK card acquirers, who come together on a monthly
basis and meet in a non-competitive environment, they’ve
been really trying and worrying about how they’re going
to get at the small business merchants. So, encouraged by
Jeremy, they have started to put together an education
package particularly focused at level 4 merchants around the
e-commerce environment. That was sustained and upheld
by the PCI council in the autumn. When the council asked for
suggestions of what they should focus on in a 12 month period
they got 31 suggestions, that was whittled down to 13. These
were voted on by the participating organisations, of which there
are over 600 across the world. The vote came out in favour of
e-commerce solutions and education for smaller merchants but
they broadened that and said e-commerce education. Here in
the UK we’re focused on smaller merchants, looking at risk and
looking at cloud. And in the UK the card acquirers have come
together and they’ve written some guidance which has been fed
into the special interest group, which will hopefully be published
before September/October.
AH: Say a retailer already knows what they’re meant to
be doing. I meant in the process of monitoring someone’s
compliance maintenance, there is the ability to just indicate
that you have an implementation plan in place. Even if that plan
is that you’re waiting for your payment supplier to provide a
solution – that is also accepted. But this could roll over into a
number of years and in my opinion it’s not a realistic review of
that retailer’s compliance.
CP: Waiting for your supplier is another area that is being
addressed. The challenges for merchants has been that some
of the suppliers are saying: ‘Well there’s nobody chasing me
to do it. You’re going to pay for it Mr merchant.’ The merchant
says: ‘No I’m not.’ So that’s also been addressed now. Visa
particularly have launched a program to get the service
providers to register online to indicate they are compliant or
that their solution means card data is not in the merchant’s