Visa PCI Non-Compliance Fines
If a member Bank, merchant or credit card service provider does not comply with the Payment Card Industry security requirements or fails to rectify a security issue, Visa may fine the responsible member. Visa may waive fines in the event of a data compromise if there is no evidence of non-compliance with
PCI DSS and Visa rules.
To prevent fines a member, merchant, or service provider must maintain full compliance at all times, including at the time of breach as demonstrated during a forensic investigation. Additionally, a member must demonstrate that prior to the compromise
the compromised entity had already met the compliance validation requirements, demonstrating full compliance.
MasterCard Non-Compliance Fines
MasterCard has become the first card brand to publish its PCI fines and related requirements. The noncompliance assessment structure now contains escalating assessments per violation within a calendar year.(See Chart to right)
Maximum
assessments for initial noncompliance for Level 2 and Level 3 merchants have increased to $25,000 and $10,000, respectively.
MasterCard has
grouped Levels 1 and 2 together. The first violation for those groups is $25K,
jumps to $50K for the second violation, $100K for the third violation and $200K
for the fourth. Level 3 retailers face first through fourth violation fines of
$10K, $20K, $40K and $80K. Service providers that are ranked either Level 1 or
Level 2 will see first through fourth violation fines of $25K, $50K, $100K and
$200K.
PCI Compliance Solutions
The Payment Card Industry (PCI) Data Security Standard (PCIDSS) and PCI Fines is a worldwide information security standard assembled by the Payment Card Industry Security Standards Council (PCI SSC).
The standards are created to provide organizations that process card payments ways and methods to prevent credit card fraud through increased internal controls around data and its exposure to compromise and theft.
We have the PCI Fines you need.
The standards apply to all organizations which hold, process, or pass cardholder information from any card branded with the logo of one of the four major card brands, VISA, MasterCard, American Express and Discover Card.
Become PCI Compliant
Validation and certification of compliance can be performed either internally or externally, with the assistance of our PCI Fines, depending on the volume of card transactions the merchant organization is handling, but regardless of the size of the organization, compliance must be assessed annually.
Organizations handling large volumes of transactions, see chart above, must have their compliance assessed by an independent assessor known as a Qualified Security Assessor (QSA), while companies handling smaller volumes have the option of self-certification via a Self-Assessment Questionnaire (SAQ).
In some regions these SAQs still require signoff by a QSA for submission.
Requirements of PCI Fines
The current version of the PCI DSS specifies 12 requirements for compliance, organized into six logically related groups, which are called "control objectives."
