PCI PIN Security Requirements: What PCI PIN Compliance Means and Who Needs It

The PCI PIN Security Requirements are the PCI Security Standards Council’s standard for protecting PINs, and the cryptographic keys that encrypt them, at ATMs and point-of-sale terminals. The current version is PCI PIN Security Requirements v3.1, published in March 2021. They apply to acquirers, processors, key injection facilities and their agents, not to most merchants. Compliance is validated by a Qualified PIN Assessor (QPA): a company approved by the PCI SSC to assess PIN security, whose assessors are trained and qualified by the Council and which appears on the Council’s Qualified PIN Assessor list. The payment brands decide who must be validated and how often.

A PIN is the one piece of card data that is meant to be secret from everyone except the cardholder. Protecting it depends on cryptography: PIN blocks are encrypted at the terminal and translated between keys as they travel to the issuer, and every one of those keys must itself be protected. This guide explains what the standard covers, who needs it, how it differs from PCI DSS and how to prepare.

Key takeaways

• PCI PIN applies to organisations that process PINs or manage the keys that protect them, not to most merchants.
• The standard has seven control objectives containing 33 requirements, plus annexes for remote key distribution and key injection facilities.
• Dual control and split knowledge run through everything, and assessors test them through records and interviews.
• PCI DSS and PCI PIN protect different things; many acquirers and processors need both.
• Validation is carried out by a PCI SSC-qualified PIN Assessor, at a frequency set by the payment brands.

What do the PCI PIN Security Requirements cover?

The PCI PIN Security Requirements and Testing Procedures (version 3.1 at the time of writing) cover the secure management, processing and transmission of PIN data during online and offline card transactions at ATMs and attended and unattended point-of-sale terminals. It works alongside the PCI PIN Transaction Security (PTS) device standards, which PIN entry devices and hardware security modules (HSMs) are approved against.

It is organised into seven control objectives containing 33 requirements. Normative annexes add requirements for symmetric key distribution using asymmetric techniques (remote key loading and the certification authorities behind it) and for key injection facilities that load keys into PIN entry devices. The current documents are in the PCI SSC document library.

“PCI PIN compliant” therefore means an entity’s PIN processing and key management meet all applicable requirements, confirmed by a QPA and reported to the payment brands as they require.

What are the seven PCI PIN control objectives?

Who needs to be PCI PIN compliant?

The organisations most likely to be in scope are:

• Acquirers and processors that receive, translate or verify PIN blocks.
• Third parties acting for acquirers, such as independent sales organisations and terminal management providers that handle PINs or keys.
• Key injection facilities that load keys into PIN entry devices.
• Certification and registration authorities that support remote key distribution.

The payment brands enforce compliance through their own PIN security programmes, which set who must be validated and how often. PCI SSC writes the standard but does not enforce it. Your acquirer or the relevant brand will confirm what applies to you.

What is the difference between PCI PIN and PCI DSS?

PCI DSS protects account data, principally the primary account number (PAN), wherever it is stored, processed or transmitted. PCI PIN protects PINs and the cryptographic keys around them.

There is overlap in areas such as physical security, logical access and change control, and a combined programme reduces duplicated evidence. But neither assessment replaces the other. A PCI DSS Report on Compliance does not examine key ceremonies, and a PIN assessment does not cover the wider cardholder data environment.

Related standards sit alongside both. Point-to-point encryption solutions rely on similar key management disciplines; our guide to P2PE explains how they reduce PCI DSS scope, and our free PCI compliance check gives a first view of your PCI DSS position. Organisations that personalise cards or manage card production keys fall under PCI card production requirements instead.

What does a PCI PIN assessor check?

Most findings relate to how keys are handled rather than to the algorithms themselves, so a QPA follows the key lifecycle:

• Generation. Keys must be generated inside secure cryptographic devices, normally HSMs approved under the PCI PTS HSM programme or validated to FIPS 140-2 or 140-3 at Level 3 or higher.
• Distribution and loading. Components sent physically travel in tamper-evident packaging to named custodians, with records of every hand-over. Keys loaded into terminals are loaded in a secure room under dual control.
• Use and storage. Each key has one purpose. Keys never exist in clear text outside a secure device, except as components under split knowledge. Symmetric keys stored or exchanged outside an HSM must be protected in key blocks, such as those defined in ANSI TR-31.
• Replacement and destruction. Every key has a defined cryptoperiod, is replaced if compromise is suspected, and is destroyed in a witnessed, recorded process when no longer needed.

Two principles run through the whole lifecycle. Split knowledge means no single person knows or holds a whole cleartext key. Dual control means at least two authorised people must take part in any sensitive operation. Assessors test both through custodian forms, access logs, key ceremony records and interviews.

What are the most common PCI PIN findings?

• Keys stored or exchanged outside key blocks
• A single person able to reconstruct a key, or perform a sensitive HSM function alone
• Custodian lists that are out of date, or missing signed custodian agreements
• Keys, HSMs or terminals missing from inventories, or with no defined cryptoperiod
• Incomplete or unwitnessed destruction records
• Secure room access lists that include people who no longer need access

None of these needs new technology. They need disciplined procedures and records.

How do you prepare for PCI PIN validation?

Start well before your target date, ideally with a gap analysis. Remediation in PIN environments can involve new hardware, re-keying or changes to key exchange with partners, all of which take time to coordinate. A QPA will expect:

• An inventory of every key: type, purpose, algorithm, length, location, cryptoperiod and custodians
• An inventory of HSMs and PIN entry devices, with approval status and firmware versions
• Key management procedures that match what staff actually do
• Custodian agreements and records of every key ceremony, transfer and destruction
• Network diagrams showing where PIN blocks travel and where they are translated

Brief key custodians and security officers before the assessment. They will be interviewed and should be able to explain the procedures they follow, the reasons for them and the records that prove it.

How Sovereign Secure can help

Sovereign Secure is a PCI SSC-approved Qualified PIN Assessor as well as a QSA and Card Production Security Assessor company, so we can plan PIN and PCI DSS work together where that suits you. See how a PCI PIN assessment with us works, or read our guide to PCI PIN assessment in Dubai and the UAE if you operate in the Gulf.