Cyber Security and PCI Compliance for Banks and Card Issuers

Banks need PCI DSS whenever they store, process or transmit cardholder data, and PCI compliance for banks rarely stops there. An issuer that personalises cards, an acquirer that drives ATMs and POS terminals, and a processor that injects keys into PIN pads can each fall under a different PCI standard, assessed by a different type of PCI SSC-approved assessor. On top sit the obligations every bank carries: SWIFT’s Customer Security Programme, UK operational resilience rules and, for EU entities, DORA.

This page is a map. Each section below summarises one obligation and links to the page that covers it in full. For lenders, insurers, wealth managers and payment firms as well as banks, see our overview of cyber security for financial services.

Do banks need PCI DSS?

Yes. PCI DSS v4.0.1 applies to every entity that stores, processes or transmits cardholder data or sensitive authentication data, or could affect the security of the cardholder data environment, and the standard names issuers and acquirers among them. How you validate, and how often, is set by the card brands’ compliance programmes and your scheme agreements rather than by PCI DSS itself.

Two points are specific to banks:

• Issuers can keep some sensitive authentication data. Requirement 3.3.3 lets issuers, and companies that support issuing services, store it only where a legitimate issuing business need requires it. Since 31 March 2025, when the future-dated requirements took effect, that data must also be encrypted with strong cryptography.
• Acquirers answer for their merchants. Card brand rules make acquirers responsible for the compliance of the merchants they sign, which is why acquirers collect SAQs, Attestations of Compliance and ASV scan reports from them. Merchants unsure which SAQ applies can start with our free PCI compliance check.

Which security standards apply to banks and card issuers?

How does each card standard apply to a bank?

PCI DSS for issuers and acquirers

Issuers protect cardholder data across card management, authorisation, fraud and statement systems; acquirers protect the transactions they process and oversee their merchants. A QSA tests the environment and signs the Report on Compliance and Attestation of Compliance; our PCI DSS assessments page explains the process.

PCI PIN security and key injection

The PCI PIN Security Requirements v3.1 set 33 requirements under seven control objectives for handling PINs and the keys that protect them, from the ATM or POS terminal to the host. A QPA assesses acquirers, processors and key injection facilities, which are covered by Annex B; US banks on the Star, NYCE and Pulse networks may also face separate TR-39 audits required by those networks. Our PCI PIN security assessments page explains the PIN assessment itself.

Card production and personalisation

The PCI Card Production and Provisioning Logical and Physical Security Requirements apply to anyone who manufactures, personalises, stores or ships cards, generates PINs or PIN mailers, or provisions card credentials into mobile devices. A CPSA validates each site; if your bank runs its own personalisation bureau, confirm with each card brand whether it must be validated, and see our card production audits.

ATM and POS device testing

ATMs, PIN pads and unattended terminals sit in public places, where an attacker can reach the hardware, its ports and its network link. Hands-on device testing, alongside PCI PTS-approved hardware and PCI PIN controls, shows whether a deployed device and its back end resist tampering; see hardware and IoT penetration testing.

What else does cyber security in banking cover?

What cyber threats do banks face?

The attacks banks face aim at money movement, customer accounts and the services customers rely on every day: ransomware and extortion, compromise through software suppliers and managed service providers, account takeover and authorised push payment fraud against customers, DDoS attacks on online banking, and insiders misusing privileged access or cryptographic keys. Our overview of the main cyber threats to financial services firms explains how each one usually happens and what reduces it. The standards below, the card standards above and regular PCI penetration testing are how a bank shows those controls work.

SWIFT Customer Security Programme

Every SWIFT user must attest each year against the Customer Security Controls Framework (CSCF), and the attestation must be supported by an independent assessment, carried out internally or externally. The controls overlap with PCI DSS on segmentation, privileged access and patching but are attested separately; our SWIFT CSP guide explains the cycle.

UK operational resilience and DORA

PRA and FCA rules require banks to set impact tolerances for their important business services and, since 31 March 2025, to stay within them in severe but plausible scenarios. EU subsidiaries also fall under DORA, Regulation (EU) 2022/2554, which has applied since 17 January 2025; our operational resilience guide covers both regimes and where testing evidence fits, and our guide to the DORA regulation sets out each DORA requirement. Banks that want an external benchmark for business continuity can also look at ISO 22301 certification.

Cyber Essentials for suppliers

Banks set minimum security requirements for the vendors they depend on, and Cyber Essentials is the UK government-backed way for a supplier to evidence five basic technical controls. As an IASME-licensed certification body we certify suppliers to Cyber Essentials and Cyber Essentials Plus.

Why plan PCI compliance for banks as one programme?

Because a bank’s card estate shares people and hardware even though the reports do not. The same key custodians, hardware security modules (HSMs) and secure rooms often support card management, PIN processing and personalisation, and PCI DSS, PCI PIN and the card production requirements all examine key management, split knowledge and dual control, HSM protection and physical security. Each standard still needs its own assessment by the right type of assessor, but one plan avoids collecting the same evidence three times.

Why Sovereign Secure

• PCI SSC-approved QSA, QPA and CPSA company, so one team can assess PCI DSS, PCI PIN and card production. We are also a PCI SSC-approved P2PE Assessor and 3DS Assessor, relevant to banks that run Access Control Servers or provide P2PE solutions to merchants. You can check us on the PCI SSC’s list of Qualified PIN Assessors.
• Member of the PCI SSC Global Executive Assessor Roundtable (GEAR) for 2026 to 2028.
• Banking and payments clients shown on our site include Ahli United Bank, Kuwait Finance House, AYA Bank and Bank of Palestine, with a testimonial from First National of Nebraska; see our clients.
• ISO 27001 certified, with penetration testing across web, API, network, cloud, mobile and hardware.

Next step

Tell us which standards, sites and card brands are in scope through the enquiry form on this page, or call +44 161 523 5276. We will propose an assessment plan with a fixed quote.