• Merchant Services
• Internet Merchant Account
• Mail Order / Telephone Order
• New & Startup Businesses
• European Merchant Accounts
• US Merchant Accounts
• International Merchant Accounts
• Our Charges
• Partner Program
• Virtual Terminal
• VoicePay
• Reduce Chargebacks
• Stop Fraud
• Glossary
• Certified Shopping Carts
• FAQ
• About Us
• Apply Online

Security & PCI

CISP compliance (Credit Card Scheme Compliance) is required of all service providers that store, process, or transmit cardholder data. The program applies to all payment channels, including retail (brick-and-mortar), mail/telephone order, and e-commerce. Compliance with CISP means compliance with the PCI Data Security Standard with the required program validation. The Payment Card Industry (PCI) Data Security Standard offers a single approach to safeguarding sensitive data for all card brands. Other card companies operating in the U.S. have also endorsed the PCI Data Security Standard within their respective programs.

Using the PCI Data Security Standard as its framework, CISP provides the tools and measurements needed to protect against cardholder data exposure and compromise. The PCI Data Security Standard consists of twelve basic requirements and corresponding sub-requirements but these can be summarised as follows:

• Building and Maintaining Secure networks
• Protecting sensitive data,
• Maintaining a vulnerability program by developing and maintaining secure systems and applications,
• Implementing and managing strong access controls,
• Regular monitoring and testing, and;
• maintaining information security policies.

Perpetual Payments (via Voice Commerce Group) is PCI Level 1 certified and its payment services are available globally in multiple currencies to support multiple payment types. Businesses are normally enabled to start accepting payment from their customers via Perpetual Payments on the day they apply. Due to the way our system works Merchants are saved the time and effort of complying with PCI in their own right without breaching Visa and MasterCard's mandatory enforcement of the Payment Card Industry Data Security. For completeness however we have outlined the full requirements below:

Why must businesses meet the PCI standards?

PCI Standards must be met by all businesses that take credit/debit or paycards from the top four major card industry providers: American Express, Discover, MasterCard and Visa. PCI Compliance Standards are not laws - they are contractual obligations with the credit card companies. Credit card companies may enforce the terms of their contracts by imposing Card Scheme Fee Assessments and/or sanctions against companies who do no comply with the standards for each credit card company.

What happens if my business does not become PCI compliant?

PCI Compliance is a requirement of your contract with the credit card companies. If you do not make your business PCI compliant, you are in violation of your contract. The credit card companies can take the following actions if your business does not abide by the security standards.

• Visa may charge your business up to $500,000 per incident if your network and the information of consumers is compromised.
• You may be banned from allowing your customers to use credit cards issued by the company that finds your business non-compliant.
• If you do not notify the companies of probable or actual violations or thefts of our customers' information, you will also be assessed a Card Scheme Fee Assessment. Again, Visa can charge you as much as $100,000 per incident.
• Other Card Scheme Fee Assessments may be charged if the credit card company feels that your company's violations pose a risk to the credit card company and/or its members.

Why is PCI compliance important to businesses?

The PCI Compliance regulations were created to protect businesses and individuals. All parties benefit from abiding by the regulations, and companies not complying will face stiff penalties, which will include Card Scheme Fee Assessments and loss of business.

Businesses accepting credit or debit cards or issuing payroll cards to employees owe it to themselves and their customers to protect the sensitive data contained in credit/debit card and payroll data

PCI Compliance is important to businesses issuing paycards because a business' employees are the lifeblood of every organization. If employees' paycards are not protected through PCI Compliance standards, the employees stand to lose the money they have earned. If this happens, they open themselves up to many lawsuits by disgruntled employees.

PCI Compliance is critical for businesses because companies need to protect their Bank accounts, the most liquid assets in any organization. Building and maintaining a safe and secure network provides protection against identity theft, one of the fastest growing crimes. These measures protect a companies' most valuable resource, the employees.

Here are some other reasons why PCI compliance is important for businesses

• Consumers have increased confidence in the paycard industry.
• Abiding by the regulations minimizes risk and maximizes protection.
• Merchants' reputations are protected.
• Businesses gain a competitive edge.
• Companies enjoy increased revenue and improved bottom lines.
• Organizations maintain a positive image.
• Customers are protected.
• Information is shielded from intrusions by unwanted hackers and other industry thieves.

Merchant PCI Levels

Compliance validation basics

In addition to adhering to the PCI Data Security Standard, compliance validation is required for Level 1, Level 2, and Level 3 Merchants, and may be required for Level 4 Merchants.

The PCI Self-Assessment Questionnaire is available for download on the Visa CISP Website or MasterCard SDP Website. If a Merchant chooses to enrol with one of the association approved security assessors to perform the system perimeter scan, they may complete the approved assessor's Compliance Questionnaire in lieu of the version posted on Visa's CISP Web site.