Issuer PIN Security Guidelines - Visa

Using This Document
Purpose This manual provides guidelines for PIN security in the issuer domain during:
• Use of issuer approved1 devices for PIN entry during transactions requiring
PIN entry, for example non POS/ATM or ‘On-Us’ ATM transactions .
• Cardholder PIN management .
The intent of these guidelines is to manage the exposure of PINs and associated
data (processed during the types of transaction within the scope of this
document) that could be used to clone cardholder payment devices for use in
any payment channel .
These guidelines represent best practice for issuer PIN management unless
business needs dictate otherwise .
Under these guidelines, issuer PIN security management is at the issuer’s own
risk .
Acquirer PIN security requirements for the secure management, processing,
and transmission of PINs during online and offline payment card transaction
processing at ATMs, and attended and unattended point-of-sale (POS)
terminals are provided in the PCI PIN Security Requirements . Cardholder
PIN entry in the acquirer domain should be performed using PED/EPPs in
accordance with payment-system brand requirements that relate to the PCI PTS
Program
This manual is designed to provide PIN security guidelines for all payment
accounts that use a PIN, including those associated with magnetic stripe cards,
chip cards, ‘hybrid’ cards that incorporate both a magnetic stripe and a chip or
any other cardholder payment device form factor .
These guidelines were derived from existing Visa and MasterCard
documentation and finalized in this version by representatives of the two
payment-system brands .
Payment-system brand rules that relate to topics in this document supersede
any guidelines on those topics .
1A device, possibly provided by the issuer but not necessarily, whose use for cardholder PIN entry is permitted under conditions specified by
the issuer .
Issuer PIN Security Guidelines 1
Visa Public © 2010 Visa. All Rights Reserved.