<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/05/Artboard-1-copy-8-8.webp" alt="M2P Fintech" title="" width="100%" height="383">Over the last few years, e-commerce and <a class="link" href="https://m2pfintech.com/blog/the-rise-of-digital-payments/" target="">digital payments</a> have become a comfortable cosmos for millions of shoppers worldwide. Card-Not-Present (CNP) transactions, in particular, constitute a major chunk of online payments.<h2 class="heading-node" id="cbf4">Card-not-present transactions</h2>Essential to both in-store and online businesses, CNP payments reduce the risk of customer churn and cart abandonment. Imagine a customer does not have a physical credit or has a visibly battered card that cannot be scanned. They can still pay for the purchase using the CNP facility across the counter or telephone or digital channels.But like most things in life, CNP payments are a double-edged sword. They are highly sophisticated yet so vulnerable to security breaches. When a scamster gets hold of the credit card number, name, three-digit security code (CVV), and expiration date, stealing cash and identity becomes a cakewalk.<blockquote class="block-node" id="o40ybrinh">As of 2021, CNP frauds were 81% more common than card-present scams, resulting in tremendous costs to banks and merchants.</blockquote><h2 class="heading-node" id="66f3">Cost of payment fraud</h2>The cost associated with payment fraud is immense for banks, merchants, and payment service providers. They’ll have to deal with customer refunds, additional chargeback fees, fines, and investigation charges. Though the amount is usually refunded to the victim, it still causes distress and mistrust.<h2 class="heading-node" id="b033">Best way to prevent CNP fraud — PCI 3DS</h2>The way to avert CNP fraud is to implement stringent controls that validate the identity of the cardholder. PCI 3D Secure plays a significant role in enabling identity validation and access control, thereby reducing the costs and inefficiencies associated with payment fraud in a CNP scenario. Banks and card payment service providers need to comply with PCI 3DS protocols to fortify transaction security.<h2 class="heading-node" id="deaa">What is PCI 3DS?</h2>PCI 3DS is an advanced EMV messaging procedure that authenticates cardholders when making online purchases. It facilitates seamless data exchange between merchants, cardholders, and card issuers, thereby providing an additional layer of security to avoid CNP fraud and make e-commerce secure.<h2 class="heading-node" id="f06c">Key components of PCI 3DS Core Security Standard</h2>The PCI 3DS Core Security Standard serves as a framework for EMV 3DS functions to execute security controls. It supports the integrity and confidentiality of 3DS transactions and pertains to institutions that leverage 3DSS, DS, and ACS, the key components of the PCI 3DS security standard.Here’s a quick peek into what each component means.•&nbsp;3DS Server (3DSS)&nbsp;contributes the functional interface between the 3DS requester environment and the DS.•&nbsp;3DS Directory Server (DS)&nbsp;holds the list of valid card ranges for which authentication may be available. Further, it also coordinates communication between the 3DSS and the ACS systems to ascertain whether authentication mechanisms are available for a particular card number and device type.•&nbsp;3DS Access Control Server (ACS)&nbsp;comprises the authentication rules and is managed within the issuer domain.The physical and logical security requirements for the PCI 3DS Core Security Standard are structured as follows.Baseline Security Requirements<ul class="list-node" id="qtc61d1ze"><li>These are technical and operational security requirements that reflect general information security principles and practices common to industry standards.</li><li>These requirements should be considered for all types of environments.</li></ul>3DS Security Requirements<ul class="list-node" id="qgbh7rkln"><li>They provide security controls specifically intended to protect 3DS data, technologies, and processes.</li></ul><h2 class="heading-node" id="1289">Difference between PCI 3DS and PCI DSS</h2>The PCI 3DS and PCI DSS are two separate standards intended for varying requirements and entities. The PCI 3DS applies to environments where 3DSS, ACS, and/or DS functions are performed, whereas PCI DSS applies wherever payment card account data is stored, processed, or transmitted.If you want to know more about PCI DSS, check out our blog on the&nbsp;<a class="link au nb" href="https://medium.com/m2p-yap-fintech/12-requirements-of-pci-dss-157747451888" rel="noopener">12 REQUIREMENTS OF PCI DSS.</a>Most 3D secure entities possess both PCI 3DS and PCI DSS responsibilities. In some cases, a 3DS entity does not store, process, or transmit any payment card account data. For instance, in the case of EMV payment tokens, the 3DS entity is involved ONLY in 3DS transactions. The 3DS entity may not be subject to PCI DSS in this scenario. In all other cases, entities should refer to their acquirer and/or the payment brand(s) to determine their compliance obligations to a PCI standard.So, are you looking to get PCI DSS certified and compliant? We can help.<a class="link au nb" href="https://m2pfintech.com/" target="_blank" rel="noopener ugc nofollow">M2P</a>&nbsp;has extensive experience in ensuring compliance for numerous players in the card payment industry. Write to us at&nbsp;<a class="link au nb" href="mailto:business@m2pfintech.com" target="_blank" rel="noopener ugc nofollow">business@m2pfintech.com</a>, and let’s get started!Here’s to more dynamically authenticated 3DS transactions!<a class="link" href="https://m2pfintech.com/newsletter/">Subscribe</a>&nbsp;to our newsletter and get the latest fintech news, views, and insights, directly to your inbox.Follow us on&nbsp;<a class="link" href="https://www.linkedin.com/company/m2pfintech/mycompany/">LinkedIn</a>&nbsp;and&nbsp;<a class="link" href="https://twitter.com/m2pfintech">Twitter</a>&nbsp;for insightful fintech tales curated for curious minds like you.

Prevent CNP Frauds with PCI 3DS

<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/04/pci-dss.webp" alt="M2P Fintech" title="" width="100%" height="253">The payment industry is constantly growing where every upgrade plays an important role in developing trust among users by protecting their sensitive data. So, every business that is an active participator needs to meet few security standards that act as Armour.One such globally recognized standard is PCI DSS.The PCI Security Standards Council came up with a Payment Card Industry Data Security Standard (PCI DSS) framework to protect credit and debit card transactions and card holders’ data from breaches. It is a mandate for every merchant and service provider to abide by this protocol for a smooth customer experience.<h2 class="heading-node" id="e2ee" style="text-align: justify">How was PCI DSS created?</h2>It all began during the internet boom in the late 1990s, when the initial stage of e-commerce brought in many fraudsters and excitement. When the retailers, merchants, card networks, consumers widely accepted the emerging web-driven transactions, they witnessed a steady increase in credit card fraud and scams. That is when the card networks like American Express, MasterCard, and Visa started to dig deep into the issue to create standards for payment processing systems.With Visa taking the lead in 2001 “Cardholder Information Security Program” standard was introduced, followed by the other companies implementing their security standards. But it did not meet the expectations of the merchants and POS terminals as they need to comply individually with the company-specific standards. This resulted in great difficulty for merchants as they have to comply with different standards when they are approaching multiple card networks. So, the collaboration of the major card networks such as American Express, Discover, JCB, Mastercard, and Visa birthed PCI DSS version 1.0 in December 2004.Later in 2006, the Payment Card Industry Security Standards Council (PCI SSC) was formed by a joint venture of MasterCard, American Express, Visa, JCB International, and Discover Financial Services to manage PCI development and alignment of policies to PCI DSS. PCI SSC ensures that the entities are committed to secure credit card data.PCI DSS is now a globally recognized directive where every merchant who accepts card payments must comply with the latest version, PCI DSS 3.2.1, which was released in May 2018.<h2 class="heading-node" id="edca" style="text-align: justify">Why do merchants need to comply with PCI DSS?</h2>Since there are over multiple card transactions taking place in the market, a safe business environment becomes the prime concern for the merchants to lead a long haul. A business compliant with PCI DSS always earns customers’ trust for their sensitive card information and helps boost the sale and customer confidence. As every business relies on partners, acquirers, or fellow industry mates, being a PCI DSS Compliant helps improve one’s reputation and strategies.Data breaches, payment card data theft, can be avoided as it is stored securely and monitored on a regular basis. In addition, PCI DSS even helps in improving IT infrastructure efficiency with its compliance levels and requirements.<h2 class="heading-node" id="de60" style="text-align: justify">PCI DSS Compliance levels</h2>There are four levels of PCI DSS Compliance based on the number of annual payment card transactions a business handle.Level 1:&nbsp;over 6 million TXNLevel 2:&nbsp;1 to 6 million TXNLevel 3:&nbsp;20,000 to 1 million TXNLevel 4:&nbsp;fewer than 20,000 TXNCheck out our guide to the&nbsp;<a class="link au mj" href="https://m2pfintech.com/blog/pci-dss-a-quick-guide-to-its-levels/" rel="noopener">PCI DSS Levels</a>&nbsp;and their impact on compliance.<h2 class="heading-node" id="a8f1" style="text-align: justify">Requirements for PCI DSS Compliance</h2>Every system entity and component associated with Cardholder Data Environment (CDE) must comply with the PCI DSS mandate. It includes requirements for security management, policies, procedures, network architecture, software design, and other critical protective measures.PCI DSS sets forth 12 requirements for every PCI DSS complaint established by the PCI Security Standards Council:<h3 class="heading-node" id="757b" style="text-align: justify">1. Firewall Configuration</h3>Firewalls are installed and configured to protect card holders’ data from any malware. It helps the prevention systems effectively to defend the hackers from unauthorized access to private data.<h3 class="heading-node" id="625d" style="text-align: justify">2. Password Security</h3>Businesses should not use vendor-supplied defaults for system passwords and other security parameters in their routers, modems, point of sale (POS) systems, and other third-party products. Instead, basic precautions and configurations like changing the password should be followed as the public can easily access the generic passwords and security measures.<h3 class="heading-node" id="ad5f" style="text-align: justify">3. Protection of Cardholder Data</h3>The stored cardholders’ data must be encrypted with two-fold protection and certain algorithms. Also, the primary account numbers (PAN) must be regularly scanned and monitored to avoid any unencrypted data.<h3 class="heading-node" id="1dad" style="text-align: justify">4. Encryption of Transmitted Data</h3>The cardholders’ data should be encrypted when transmitted across open, public networks like payment processors, home offices from local stores, etc. Sharing the account numbers to unknown locations must be avoided.<h3 class="heading-node" id="9653" style="text-align: justify">5. Antivirus Software</h3>All the systems used for interacting, sharing, storing PAN must be protected against malware by regularly using and updating antivirus software or programs. Also, POS providers must employ anti-virus measures and maintain up-to-date antivirus programs to prevent systems from malware.<h3 class="heading-node" id="f58e" style="text-align: justify">6. Secure Systems and Applications</h3>To add another layer of protection to the data, the providers must develop and maintain secure systems and applications. These systems and applications that are used as the storage of data for interaction must be updated regularly.<h3 class="heading-node" id="f835" style="text-align: justify">7. Restriction of Access</h3>The cardholders’ data are restricted to access by business need-to-know, and the sensitive data must be accurately documented and updated regularly.<h3 class="heading-node" id="bffa" style="text-align: justify">8. Unique Access ID</h3>Individual credentials and ID are assigned to each person with computer access to card holders’ data. Single access ID and password should not be used as it results in more vulnerability and slow response time.<h3 class="heading-node" id="57e9" style="text-align: justify">9. Restriction of Physical Access</h3>Card holders’ data must be physically stored in a secured location where any physical access is restricted. Physically written, typed, or digitally stored data must be secured in the room, and in case of any access, it should be added to the access logs.<h3 class="heading-node" id="7c0d" style="text-align: justify">10. Maintain Access Logs</h3>As mentioned in the previous requirement, all access to network resources and cardholder data must be tracked and monitored in the access logs. This proper record keeping and documentation must be maintained with utmost accuracy as it is related to sensitive data.<h3 class="heading-node" id="aecf" style="text-align: justify">11. Testing Security Systems and Processes</h3>Regularly testing/scanning security systems and processes result in less vulnerability as it involves many digital data, software programs/products, physical locations, etc.<h3 class="heading-node" id="625c" style="text-align: justify">12. Document Policies</h3>Document policies that address information security for all personnel must be maintained right from storing to transmitting/using data after POS.So, with these twelve requirements, PCI DSS comprises six objectives to ensure optimal security for merchants who accept, process, transmit, or store payment card information.<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/06/image-1.webp" alt="M2P Fintech" title="" id="jxi8l3syj" width="100%" height="253">With PCI DSS’s strong objectives and compliance requirements, the security of the payment industry is strengthened. These measures help and encourage data security and facilitate the adoption globally. So, hereby businesses that handle card payments need to be a part of this global payment card data security solution and focus on increasing the intensity to move forward by becoming ‘PCI DSS Complaint.’Look forward to our upcoming blogs as we uncover PCI SSC’s other standards such as PCI 3 DS, PA DSS, PCI PIN Security, and PCI SSF.<a class="link" href="https://m2pfintech.com/newsletter/">Subscribe</a>&nbsp;to our newsletter and get the latest fintech news, views, and insights, directly to your inbox.Follow us on&nbsp;<a class="link" href="https://www.linkedin.com/company/m2pfintech/mycompany/">LinkedIn</a>&nbsp;and&nbsp;<a class="link" href="https://twitter.com/m2pfintech">Twitter</a>&nbsp;for insightful fintech tales curated for curious minds like you.

PCI DSS: The Payments’ Armour

<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/05/banner.webp" alt="M2P Fintech" title="" width="100%" height="253">Have you ever noticed the numbers on your credit/debit/prepaid card? They have a string of numbers out of which the first six digits are called Bank Identification Number (BIN). The BIN number helps the merchant processor identify the card type, network, and the issuing bank for the transaction’s approval/decline. For instance, a Visa card starts with the number “4.” Master card starts with the number “5” and “2”, Diners starts with the number “3” and so on.They also enable merchants to accept different types of payments like digital and mobile payments.Now with the explosion of payment electronification and many becoming savvy financially, there has been a drastic increase in the number of card users. This, in turn, has led to a shortage of BINs; if we take a rather dim view, it can be observed as depletion of BINs.To stop this from happening, the International Standards Organization (ISO) amended the existing standard of (ISO/IEC 7812–1) Part 1: Numbering system from Six-digit to Eight-digit BIN in 2017. So, card networks such as MasterCard, Discover, American Express, Visa and others have started prepping for the change.<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/05/Artboard-24-copy.webp" alt="M2P Fintech" title="" id="adfawcve6" width="100%" height="253">Visa has been quite active with this change and regularly issuing updates and ready reference guides for this migration. Visa adopted this standard in 2017 and has urged its partners to migrate to the Eight-digit BIN by the end of April 2022.<h2 class="heading-node" id="69d4" style="text-align: justify">Who will be affected by this migration?</h2><ul class="list-node" id="lbi86ft9q"><li>Acquirers</li><li>Issuers</li><li>Processors</li></ul>MerchantsOn completion of April 2022, the card network’s 100,000 BINs will migrate to 10,000,000 BINs. The first Six-Digits will remain the same in this change, and the following two numbers (00,01,02…) will become part of the Eight-Digit BIN. Also, there will be no need to reissue replacement cards to the customers.Here are the key points that sum up this initiative:<ul class="list-node" id="vxdxnev6w"><li>After April 2022, the existing 6-Digit BINs will continue to function, and requests for new BINs will be assigned in 8-Digits.</li><li>6-Digit BINs will be supported, but they won’t be forced to convert to 8-Digit BINs</li><li>PCI guidance and Visa clearly outline that organizations storing the full 8-digit BINs require additional controls may include expanded scope.</li></ul><h2 class="heading-node" id="f71d" style="text-align: justify">Why the sudden urgency about this migration?</h2>While the standard is out for migrating to Eight-Digit BINs, ISO did say that they are maintaining the other issuing BINs in the six-digit sequence until the deadline of April 2022. The mandate also doesn’t require the removal of Six-Digit BINs. Therefore, the concerned parties must continue supporting both Six and Eight Digit BINs.The time taken for the adoption will significantly vary by the stakeholder. So, even though the deadline is still 10 months away, there is a concern regarding the impact of updating the backend systems. Especially those involved with issuer processing, routing, and other activities need to assess the impact and get ready for the changes.Industry watchers were almost sure that this initiative will call for a longer PAN. Still, Visa has decided to implement the same on the existing 16-digit- PAN structure. It has become quite clear that the decision will affect the PCI compliance of the existing truncation and masking rules. Any organization that stores the full BIN and the last four digits of the card will become non-compliant unless the rules are not modified.The decision did not specify any modification, and it requires organizations to handle 8-digit BIN as cardholder data. But organizations that spent massive efforts over the years to lower their PCI compliance load will face an explosion of responsibilities and remediation efforts. It will probably result in actions, expense, and their own timeline of non-compliance.So, card networks have been encouraging its vendors, agents, partners, and other stakeholders to actively assess the impact they would be experiencing across their systems. This assessment would help them to increase their efficacy and avoid any hurdles when handling transactions.<h2 class="heading-node" id="005c" style="text-align: justify">How does this change impact?</h2>As six-digit BINs are on the decline, it will be challenging to rely on them for authorization, routing, and transaction clearing. The effect might not be immediate but will slowly and surely escalate when Eight-Digit BINs become the norm. Both Merchant and Service providers might face issues in the following scenarios:<ul class="list-node" id="j85h67z8k"><li>Prepaid card’s identity</li><li>Chargeback and Fraud</li><li>Transaction processing</li><li>Merchant services and disputes</li><li>Reporting</li></ul><h2 class="heading-node" id="7198" style="text-align: justify">How to prepare for the change?</h2>Visa has issued directives for both merchants and service providers on how to handle this change. They have explicitly said that the changes are specific and may need to require a timeline extension. So, organizations, service providers, and other stakeholders are encouraged to initiate and pool the resources necessary to prepare for Eight-Digit BINs.<a class="link" href="https://m2pfintech.com/newsletter/">Subscribe</a>&nbsp;to our newsletter and get the latest fintech news, views, and insights, directly to your inbox.Follow us on&nbsp;<a class="link" href="https://www.linkedin.com/company/m2pfintech/mycompany/">LinkedIn</a>&nbsp;and&nbsp;<a class="link" href="https://twitter.com/m2pfintech">Twitter</a>&nbsp;for insightful fintech tales curated for curious minds like you.

The BIN Migration|Preparing for 8-Digit BINs

<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/04/banner1251-7.webp" alt="M2P Fintech" title="" id="47w9r0aue" width="100%" height="447">Over the past few years, we have been witnessing ongoing digital advancements, ranging from communication to the way we transact. Out of these advancements, cashless transactions are reigning supreme and are further fueled by this raging pandemic. They have taken over traditional payments and banking practices.Also, there is a multitude of payment options available today. Major players such as Google Pay, Apple Pay, PayPal have access to sensitive user data stored across international servers. These actions led to many raising their voice about user data security and privacy.Being a global concern, RBI brought forth the concept of Data Localization to protect user data from potential threats.<h2 class="heading-node" id="909f" style="text-align: justify">What is data localization?</h2>Data protection created a buzz way back in 1993 when Public Records Act ensures the data transfer is restricted outside India for security purposes from surveillance of other countries.<blockquote class="block-node" id="gvz0ve27e">Data localization is the act of storing citizens’ data within the country’s geographical boundaries to avoid any foreign accessibility.</blockquote>It also plays a crucial part in the government’s cloud computing policy.<h2 class="heading-node" id="a1d6" style="text-align: justify">RBI guidelines on the data localization Policy</h2>Reserve Bank of India (RBI) issued a circular dated April 6, 2018, stating that all authorized Payment System Operators (PSOs) in India to ensure that the data related to payment systems such as customer data, payment sensitive data, payment credentials, and transaction data should be mandatorily stored within India itself under the Payment and Settlement Systems Act, 2007.A deadline of six months was tagged along with the data localization policy. Since the payment ecosystem has ballooned in the last few years, RBI was pushed to undertake this crucial step in protecting consumers’ data.All payment firms, including American Express, Master Card/Visa, PayPal, Google Pay, WhatsApp Pay, Paytm, and Phone Pe, should adhere to the RBI’s data localization rule. Subsequently, RBI insisted system providers for unfettered access to all data on complete end-to-end transaction details/information collected/carried/processed as part of the message/payment instruction by submitting Audit Report (SAR) conducted by CERT-IN.<h2 class="heading-node" id="b109" style="text-align: justify">As per RBI’s data localization policy...</h2><ol class="list-node" id="2v2w7zt70"><li>There is no bar on payment processing outside the country, but post-processing, the data should be deleted from the foreign systems and brought back to India not later than the one business day or 24 hours from payment processing, whichever is earlier. The same should be stored only in India.</li><li>However, any subsequent activity such as settlement processing after payment processing, if done outside India, shall also be undertaken/performed on a near real-time basis by storing it only in India.</li><li>In case of any other related processing activity, such as chargeback, etc., the data can be accessed, at any time, from India, where it is stored.</li><li>RBI’s prior approval is necessary for sharing the payment system data with overseas regulators.</li><li>The banks operating in India must strictly adhere to the storage norms.</li><li>Exceptionally, a foreign leg of a transaction is permitted to store their banking data abroad. However, the domestic payment transactions should be stored only in India along with the details which include end-to-end transaction, payment, and settlement transactions — customer name, mobile number, e-mail address, Aadhar card number or PAN, beneficiary details, and payment credentials like One Time Password (OTP), PIN and passwords.</li><li>For cross-border transactions that include data with a foreign and domestic component, a copy of the domestic component may be stored abroad, if required.</li><li>System providers were given six months to ensure the directive’s compliance and report the same to RBI.</li></ol><img src="https://miro.medium.com/max/700/1*UWIdZTi2f31G70qkfQJqLw.png" alt="An image representing the RBI Data Localisation Policy" title="" width="100%" height="349">The RBI guidelines on storing payments data provoked a noteworthy impact on Payment System Operators. Indian payment firms, viz. Paytm, PhonePe, and MobiKwik backed the RBI regulations on data localization policy in protecting citizens’ data and restricting any foreign accessibility.But the representatives of top leading companies such as Amazon, Flipkart, Google, Microsoft, Facebook, and American Express met with government and RBI officials to raise concerns regarding the stringent nature of this policy (2019).Later the Indian government took the responsibility to determine the category of data to be stored locally. This categorization ensured that the data is not misused by various companies, which involves transferring it to third-party providers.<h2 class="heading-node" id="f733" style="text-align: justify">Personal data protection bill</h2>The Personal Data Protection Bill (PDP Bill) applies to the processing of personal data by the companies registered in India, foreign companies dealing with personal data of individuals in India, and the Indian Government. The PDP bill categorizes the collected data into three categories:<ul class="list-node" id="0gtvgf1gh"><li>Personal data,</li><li>Sensitive personal data and</li><li>Critical personal data.</li></ul>The PDP bill is not applicable for the processing of anonymous data.The PDP bill proposed to store sensitive personal data and critical personal data in India. However, it permits the processing of sensitive personal data by transferring it to outside of India in certain cases provided that at least a copy of that data continues to be stored in India and explicit consent is needed for the same. Whereas critical personal data can only be stored and processed within India.<h2 class="heading-node" id="e7e0" style="text-align: justify">The impact on payment industries</h2>Multinational payment systems located in India faced a major impact after the RBI’s intervention on Data Localization. Popular foreign credit card companies such as Visa and Mastercard missed the strict six-month deadline set by the RBI (2019). Usually, International payment companies store their data on global servers, but this rule made them store data locally with an additional investment.India is the fastest-growing market for mobile apps and digital banking. The Indian start-up companies in the FinTech sector often go through the toughest challenge of outsourcing technical support and shifting from cloud services to cheaper and cost-effective services.Data Localization Policy will prohibit these start-ups from opting for cost-effective cloud service providers globally and choose localized alternatives, which ends in high operational costs. But this will be a fruitful drift that leads to shielding of payments data from identity fraud and other digital breaches associated with it.<h2 class="heading-node" id="3200" style="text-align: justify">The current scenario</h2>RBI reiterated its stand on data privacy by issuing a circular stating that from April 1, 2021, all Payment system operators to submit a compliance certificate duly signed by their CEOs or Managing Directors on a half-yearly basis adhering to the RBI’s regulations on securing payments data.This again triggered an active interest in RBI’s continuous intervention on securing and continuously monitoring the data to avoid any future risks to the country. With the advancements in the digital economy, financial data security is a must for the country’s economic growth and development.Want to know more about data localization? Write to us at business@m2pfintech.com<a class="link" href="https://m2pfintech.com/newsletter/">Subscribe</a>&nbsp;to our newsletter and get the latest fintech news, views, and insights, directly to your inbox. Follow us on&nbsp;<a class="link" href="https://www.linkedin.com/company/m2pfintech/mycompany/">LinkedIn</a>&nbsp;and&nbsp;<a class="link" href="https://twitter.com/m2pfintech">Twitter</a>&nbsp;for insightful fintech tales curated for curious minds like you.

Decrypting RBI Data Localization Policy for Payment Companies

<html><head></head><body><img class="alignnone size-full wp-image-2580" src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/05/Artboard-1-copy-8-13.webp" alt="M2P Fintech" width="100%" height="100%">

<a href="https://m2pfintech.com/blog/pci-dss-the-payments-armour/">PCI DSS stands for Payment Card Industry Data Security Standard</a>. A collaboration between top reputed <a href="https://m2pfintech.com/blog/credit-card-processing-a-definitive-guide/">credit card</a> brands such as American Express, Discover, JCB, Mastercard, and Visa in 2004 resulted in PCI-DSS launch. Organizations who store or process, or transmit the cardholder data either as clear or in an encrypted manner should comply with PCI regulations.

A short survey showed that most people give the above description when quizzed about PCI-DSS. When we further probed them about the levels present in this compliance, we came up short. So, we came up with a quick read of the PCI-DSS compliance levels.
<h2 id="6c0f" class="rz sa ps bn ds sb sc sd fr se sf sg fv sh si sj fz sk sl sm gd sn so sp gh sq dr">PCI DSS Compliance levels</h2>
Divided into four levels, the PCI Compliance levels are based on the number of credit or debit card transactions processed by a business annually. These levels determine what needs to be done by an enterprise to remain compliant.
Level 1:
Applies to merchants who process more than six million real-world credit or debit card transactions annually. An authorized PCI Qualified Security Assessor will conduct an annual internal audit and an on-site evaluation of the organization to:
· Authenticate the assessment’s scope;
· Evaluate technical information and documentation;
· See whether the PCI-DSS standards are being met;
· Assist and guide the compliance process and
· Also, evaluate the compensating controls
On successful evaluation, the QSA will present an RoC (Report on Compliance) to the organization’s acquiring bank, thereby demonstrating its compliance.
Level 2:
Applies to merchants who process between one and six million real-world credit or debit card transactions. Security testing reports on network hosts and applications should be completed on a defined frequency. The RoC is also applicable for level 2 organizations.
Level 3:
Applies to merchants who process annually between 20,000 and one million e-commerce transactions. A yearly assessment must be done using the relevant SAQ (Self-Assessment Questionnaire)along with a quarterly PCI scan.
Level 4:
Applies to merchants who process annually fewer than 20,000 e-commerce transactions or those who process up to one million real-world transactions. They must complete a yearly assessment using the SAQ and a quarterly PCI scan.

<h2 id="7604" class="rz sa ps bn ds sb aed sd fr se aee sg fv sh aef sj fz sk aeg sm gd sn aeh sp gh sq dr">What is this Self-assessment questionnaire?</h2>
PCI-DSS lists several kinds of SAQs for every level, and it is also based on how the merchant processes card information. Given below are some of the types of SAQs applicable to levels 2–4:
SAQ A: Merchants who outsource their entire card data processing to certified third parties. The transactions also include e-commerce transactions.
SAQ A-EP: Applies to E-commerce merchants who outsource their payment processing but not the site’s administration.
SAQ B: Applies to E-commerce merchants who don’t receive cardholder data, but they have control over the process through which data is redirected to a third-party payment processor.
SAQ B-IP: It applies to merchants who don’t store cardholder data in electronic form but will use IP-connected point-of-interaction devices. These merchants may handle either card-present or card-not-present transactions.
SAQ C-VT: Applies to merchants who process cardholder data via a virtual payment terminal.
You must select the right SAQ because every level has compliance requirements based on how payment card data is processed.

<h2 class="rz sa ps bn ds sb aed sd fr se aee sg fv sh aef sj fz sk aeg sm gd sn aeh sp gh sq dr">How to become a PCI DSS compliant</h2>
The PCI DSS specifies six control objectives for an organization to achieve compliance:
1. Build and maintain a secure network
2. Protect cardholder data
3. Maintaining a vulnerability management program
4. Implementing strong access control measures
5. Regular monitoring and testing of networks
6. Maintaining an information security policy

<h2 id="2e3a" class="rz sa ps bn ds sb aed sd fr se aee sg fv sh aef sj fz sk aeg sm gd sn aeh sp gh sq dr">The penalties of non-compliance</h2>
As cardholder data is considered personal data, a PCI DSS breach can also be regarded as equal to a <a href="https://m2pfintech.com/blog/gdpr-in-a-nutshell/">GDPR</a> breach. If PCI regulations are not adhered to, organizations will face severe financial penalties or even lose their facility to accept card payments.
In short, PCI-DSS is a standard that ensures trust, business continuity, and safety of the cardholder data.
<a href="https://m2pfintech.com/newsletter/">Subscribe</a>&nbsp;to our newsletter and get the latest fintech news, views, and insights, directly to your inbox.

Follow us on&nbsp;<a href="https://www.linkedin.com/company/m2pfintech/mycompany/">LinkedIn</a>&nbsp;and&nbsp;<a href="https://twitter.com/m2pfintech">Twitter</a>&nbsp;for insightful fintech tales curated for curious minds like you.</body></html>

PCI DSS- A quick guide to its levels

<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/06/Artboard-1-2.webp" alt="M2P Fintech" title="" id="jc4mjh9mq" width="100%" height="479">Henry, an accountant, always takes the train on his way to the office. That particular day, he missed his usual cut-off time of leaving home and had to rush to the train station. He was terribly late for work and didn’t have a minute to swipe the card or scan the code to pay for his ticket. Then, Henry reaches the terminal and just places his index finger to purchase the ticket and proceeds to catch the train.<blockquote class="block-node" id="8ek6i7u3q">Sounds like a scene of a sci-fi movie, right? What if I tell you this is happening right now?</blockquote>Well, that is biometric authentication, where an individual’s unique physical traits are captured and stored by electronic devices. The captured information will be used to authenticate the individual’s identity when making a purchase.It is no secret that we often struggle to remember our passwords or PIN numbers. So, we resort to having our birthdays or our name as our password or PIN. Ironically, this also means we leave our sensitive data out in the open.With the global adaptation of <a class="link" href="https://m2pfintech.com/blog/the-rise-of-digital-payments/" target="">mobile payments</a>, the pressing need for a more secure system, as opposed to the existing authentication systems, is on the rise. Fingerprint scanning, iris recognition, and facial recognition are some of the biometric systems now in place.It does come with a slew of advantages like higher security, improved customer experience, and customer retention. But, on the flip side, the concern of personal information, especially one’s unique traits being out in the open, is a problem. Also, installing biometric systems requires a considerable investment that often retailers shy away from.<h2 class="heading-node" id="5a9a" style="text-align: justify">What does the future hold?</h2>Biometric adoption will be the future of the payment industry. And it is an innovation-driven by institutions and individuals wanting an upgrade from password/PIN input. Right from wearables to injectable chips, the idea of biometric authentication seems to have taken root.The world of payments keeps evolving with many futuristic trends in payment processing every day. <a class="link" href="https://m2pfintech.com/blog/future-of-payments-processing-matched-with-industry-needs/">Explore more.&nbsp;</a>It looks as if the future is just a step away………. Or rather a scan away.<a class="link" href="https://m2pfintech.com/newsletter/">Subscribe</a>&nbsp;to our newsletter and get the latest fintech news, views, and insights, directly to your inbox.Follow us on&nbsp;<a class="link" href="https://www.linkedin.com/company/m2pfintech/mycompany/">LinkedIn</a>&nbsp;and&nbsp;<a class="link" href="https://twitter.com/m2pfintech">Twitter</a>&nbsp;for insightful fintech tales curated for curious minds like you.

Tag: "Compliance (15)"

Product

About

Compliance

Resources