The short answer
PCI PTS (PIN Transaction Security) is the PCI Security Standards Council's programme for payment devices. Vendors have terminals, PIN pads and card readers evaluated under PTS POI, and hardware security modules under PTS HSM, by a PCI-recognised laboratory. PCI SSC then approves and lists each device, so buyers can check it before deployment.
On this page
- What is PCI PTS and who is it for?
- What do PTS POI and PTS HSM approvals cover?
- How do you check whether a device is PTS approved?
- What happens when a PTS approval expires?
- How does PTS relate to PCI PIN, P2PE and PCI DSS?
- What does PCI DSS Requirement 9.5 ask of terminal owners?
- Where does Sovereign Secure fit?
PCI PTS (PIN Transaction Security) is the PCI Security Standards Council’s family of device security standards, and the approval programme behind them, for the hardware that protects PINs and card data: payment terminals, PIN pads and card readers under PTS POI, and hardware security modules (HSMs) under PTS HSM. Vendors have each device evaluated by an independent PCI-recognised laboratory, PCI SSC reviews the report and lists the approved device, and merchants, acquirers and processors use that list to choose what they deploy.
PTS is the link between the devices in your estate and the assessments that rely on them, including the PCI PIN security assessments we carry out as a Qualified PIN Assessor.
What is PCI PTS and who is it for?
PCI PTS is written for vendors. Its requirements cover the physical and logical security of payment devices, so that a terminal resists tampering, keeps PINs encrypted and does not leak card data. A merchant never becomes “PTS compliant”. It buys devices that have been approved, and its own obligations come from PCI DSS and, for organisations that process PINs, the PCI PIN Security Requirements.
What do PTS POI and PTS HSM approvals cover?
| Standard | Device types | Who relies on the approval |
|---|---|---|
| PTS POI (point of interaction) | PIN entry devices (countertop and mobile terminals), unattended payment terminals, encrypting PIN pads built into ATMs and kiosks, non-PIN acceptance devices, secure card readers (SCRs) and the SCRPs that work with phones and tablets | Merchants, acquirers, ATM operators, P2PE solution providers |
| PTS HSM (hardware security module) | HSMs used for key generation, PIN translation and card personalisation, plus remote administration platforms, key loading devices and multi-tenant HSMs at cloud providers | Acquirers, processors, issuers, key injection facilities, card personalisers |
A POI listing also records which security functions were evaluated. For encryption-based solutions such as P2PE, the one that matters is SRED (Secure Reading and Exchange of Data), which shows the device can encrypt account data as soon as it reads the card.
The current POI standard is the PTS POI Modular Security Requirements version 7.0, which PCI SSC published on 29 May 2025 to replace version 6.2. Among its changes, v7.0 adds a requirement for the security of biometric interfaces, adds a requirement allowing the use of third-party applications such as app stores, requires cryptography with an effective key strength of 128 bits or more, and adds an option for PIN entry designed for accessibility. Devices approved under earlier versions stay on the list until their own expiry dates.
How do you check whether a device is PTS approved?
Search the PCI SSC list of approved PTS devices by vendor and model, then compare four things with the unit in front of you:
- Approval number and class, for example PED (PIN entry device), UPT (unattended payment terminal) or SCR.
- Hardware and firmware versions. An approval covers specific versions, so a terminal running unlisted firmware is not the approved device.
- Functions evaluated, such as SRED, if your payment solution depends on them.
- Approval expiry date. Whether a device can still be bought or kept in use after that date is for the payment brands to decide, not PCI SSC, so ask your acquirer, and plan replacements well before it.
What happens when a PTS approval expires?
The approval lapses, but PCI SSC does not decide whether you must stop using the device. Its FAQ on PTS expiry dates says that whether buying and using devices beyond their approval expiry date is acceptable is determined by the individual payment brands, and that you should contact your acquirer or the payment brand. A related PCI SSC FAQ warns that devices with expired approvals may not withstand the latest generations of attacks.
| Situation | What to do |
|---|---|
| Buying new terminals | Check the approval status and expiry date on the PCI SSC list before you order, and avoid models close to expiry |
| Terminals already in the field past expiry | Ask your acquirer whether you may keep using them and until when, and plan replacement |
| SAQ B-IP or another route that relies on approved devices | Confirm with your acquirer that expired devices do not change your eligibility |
| Devices inside a validated P2PE solution | Ask the solution provider; P2PE has its own rules on expired devices, set out in PCI SSC’s P2PE FAQs |
Whatever the brand rules allow, an expired approval reflects an older version of the requirements, so treat the expiry date as a replacement deadline.
How does PTS relate to PCI PIN, P2PE and PCI DSS?
| Standard | Where PTS fits |
|---|---|
| PCI PIN Security Requirements (v3.1) | PINs may only be processed inside secure cryptographic devices and must never appear in the clear outside one. That normally means PTS-approved POI devices at the point of sale, and at the host HSMs approved under PTS HSM or validated to FIPS 140-2 or 140-3 Level 3 or higher. A key injection facility loads keys into POI devices before they go into service |
| P2PE | A validated P2PE solution uses PTS-approved POI devices with SRED to encrypt card data in the terminal, and its P2PE assessment checks the solution’s devices against their PTS approvals |
| PCI DSS | PCI DSS does not itself require PTS-approved devices, but SAQ B-IP is only open to merchants using standalone PTS-approved terminals (secure card readers excluded), and some payment brands require approved devices |
Phones and tablets that accept payments without a dedicated terminal are covered by a different standard, explained in our entry on PCI MPoC.
What does PCI DSS Requirement 9.5 ask of terminal owners?
Approval makes a device harder to attack, but it does not stop someone swapping it for a doctored copy. Requirement 9.5 of PCI DSS v4.0.1 asks you to protect POI devices that read cards directly from tampering and substitution:
- 9.5.1.1: keep an up-to-date list of devices showing make, model, location and serial number or other unique identifier.
- 9.5.1.2: inspect devices periodically for tampering or substitution.
- 9.5.1.2.1: set the inspection frequency with a targeted risk analysis, one of the future-dated requirements that became mandatory on 31 March 2025.
- 9.5.1.3: train staff to spot tampering, verify the identity of anyone who arrives to repair or replace a device, and report anything suspicious.
Where does Sovereign Secure fit?
Sovereign Secure is not a PTS laboratory and cannot evaluate or approve devices. We are a PCI SSC-approved Qualified PIN Assessor (QPA), Qualified Security Assessor (QSA) and Card Production Security Assessor (CPSA) company, a P2PE Assessor for Europe and the USA, and a member of the Global Executive Assessor Roundtable (GEAR) for 2026 to 2028.
That means we assess the organisations that buy, key and run PTS devices: PIN processors and key injection facilities under PCI PIN, P2PE solution and component providers under PCI P2PE, and merchants and service providers under PCI DSS, including Requirement 9.5 and SAQ eligibility. Our hardware penetration testing covers POS and PIN devices in your deployment, which is useful evidence but is not a PTS evaluation.
Not sure whether your terminals keep you eligible for a shorter SAQ? Our free PCI compliance check suggests your likely SAQ. For a PIN, key injection or PCI DSS assessment, contact our team for a fixed quote.
Your next step
- PCI compliance checkAnswer 22 questions for a readiness score, your likely SAQ and a fix list.Start the free check
- PCI DSS document indexThe policies, procedures and records each PCI DSS requirement needs, as a free spreadsheet.Get the document index
- Get a PCI quoteTell us how you take card payments and we will confirm your validation route and scope.Get a PCI quote
Last reviewed October 2026 by the Sovereign Secure assessment team.
