What is PCI PIN Security and who does it apply to? PCI PIN Security Requirements is the PCI SSC standard defining how cardholder PINs must be managed, processed, and transmitted in ATM and point-of-sale transactions. It applies to acquiring institutions and their agents responsible for PIN transaction processing – including processors, ATM operators, key injection facilities, and certification authorities.
Canonical definition: PCI PIN Security Requirements is the PCI SSC standard defining physical, logical, and procedural requirements for protecting cardholder PINs and the cryptographic keys used to secure them in ATM and POS payment transactions.
The current version is v3.1 (Mar 2021). In the US market – where PIN debit routing, regional networks, and independent ATM deployment create one of the world’s most complex PIN ecosystems – the chain of entities responsible for protecting that four-digit number is longer than most executives realize.
PCI PIN Security – key takeaways:
- The standard comprises 7 Control Objectives plus 3 normative annexes: A (remote key distribution and CA/RA operations), B (key injection facilities), and C (minimum key sizes and strengths).
- PINs may only be entered on devices approved under the PCI PTS program, and cryptographic operations may occur only in secure cryptographic devices such as HSMs meeting FIPS 140-2/140-3 Level 3 or PCI HSM.
- Requirement 18-3 (key blocks) is now fully in force: Phase 1 since 1 Jun 2019, Phase 2 since 1 Jan 2023, and Phase 3 – covering all merchant hosts, POS devices, and ATMs – since 1 Jan 2025 (PCI SSC and Visa bulletins).
- Visa sunset its own PIN Security validation program on 1 Oct 2023, but PCI PIN compliance remains mandatory – attested through a Qualified PIN Assessor (QPA) engagement producing a ROC and AOC at least every 2 years (Visa program memo).
- In the US, PCI PIN absorbed the role historically played by ANSI X9 TR-39 audits that regional debit networks required from acquirers, processors, and ESOs.
- Patronusec, an accredited QSA, prepares acquirers, processors, and key management providers for PCI PIN assessments – from role classification and gap analysis through QPA assessment support.
Table of Contents
What is the PCI PIN Security standard and what does it cover?
PCI PIN Security Requirements protects the PIN across the full transaction path: from the moment a cardholder keys it into a device, through transmission and translation between systems, to verification. The standard covers both online PIN (verified by the issuer) and offline PIN (verified by the card’s chip), at ATMs and at attended and unattended POS terminals.
Cryptography sits at the core: a PIN never exists in the clear outside a secure cryptographic device. The encrypted PIN block travels between settlement participants, and every intermediate node performs translation – decrypting the block under the incoming zone key and re-encrypting it under the outgoing zone key – strictly inside an HSM. That is why most of the standard’s requirements govern not the PIN itself but the keys that protect it.
The standard sits alongside other PCI SSC programs: PIN entry devices are approved under PCI PTS POI, HSMs under PCI PTS HSM (or FIPS 140-2/140-3), and key management in P2PE solutions (Domain 5 of the P2PE Standard) draws directly on the PCI PIN Control Objectives. PIN entry on consumer mobile devices (the SPoC and MPoC classes) is governed by separate, dedicated standards.
PCI PIN Security does not evaluate a single product – it evaluates an organization’s operating environment: the people, procedures, cryptographic devices, and key lifecycle used to protect cardholder PINs.
Who is required to comply with PCI PIN Security?
The standard applies to acquiring institutions and every agent performing PIN transaction processing or key management functions on their behalf. In practice that means payment processors, ATM operators and ISOs, key injection facilities, certification authorities supporting remote key distribution, and companies that deploy or service PIN entry devices.
The participant categories that payment networks classify under PIN requirements (per Visa’s program documentation) include:
- acquiring processors connected to payment networks, performing PIN translation between key zones,
- third-party servicers (TPS) that store, process, or transmit account numbers and PINs on behalf of network clients,
- Encryption and Support Organizations (ESOs): key injection facilities (KIFs), remote key distribution providers, and companies that deploy or service ATMs, POS terminals, and kiosks with PIN pads,
- PED manufacturers and third-party certificate authorities managing cryptographic keys for clients.
A quick classification test for your organization:
- Do you translate, encrypt, or decrypt PIN blocks anywhere outside the terminal itself (on a host, in an HSM)?
- YES → Control Objectives 1-7 apply to you.
- Do you generate, transport, inject, or store keys protecting PINs for POI devices or HSMs?
- YES → the standard applies; if you operate a key injection facility, Annex B applies as well.
- Do you operate a certification authority or key distribution host (KDH) for remote key loading?
- YES → Annex A applies.
- NO to all three → you are probably not an assessed entity, but check the merchant section below.
Patronusec Insight: In our project experience, the most frequently missed PIN Security obligations sit inside companies that do not think of themselves as “payment institutions”: ATM ISOs swapping EPP keypads, terminal service firms with access to devices before key injection, and software shops hosting a PIN translation application for a processor. A formal role classification against the standard – who is an ESO, who is a TPS, who is merely a hardware supplier – is the first step worth taking before any assessment conversation; without it, neither scope nor cost can be established.
Does a merchant processing PIN transactions fall under the standard?
A typical merchant is not an assessed entity under PCI PIN Security, provided it uses PTS-approved terminals and key management stays with the acquirer or its agents. The standard targets the acquiring side of the chain, not the checkout lane.
Three exceptions matter, and two of them are especially common in the US:
- Merchants managing their own keys. A large retail chain that injects keys into its own terminals, runs its own PIN translation host, or operates its own ATM fleet takes on participant obligations and becomes assessable in the corresponding scope. In the US, big-box retailers running in-house payment switches are the textbook case.
- Merchant hosts and key blocks. Phase 3 of requirement 18-3 extended key block formats on 1 Jan 2025 to all merchant hosts, POS devices, and ATMs – so key exchange on merchant-side infrastructure is affected even where the acquirer formally owns the compliance obligation.
- PIN and PCI DSS. Regardless of PIN Security, every merchant remains subject to PCI DSS – and requirement 3.3.1 prohibits storing the encrypted PIN block after authorization as sensitive authentication data.
The PIN is the only authentication element whose protection PCI SSC governs through its own dedicated standard – PCI DSS protects card data, PCI PIN Security protects the process of verifying the cardholder.
The fix: know who in your chain owns the keys in your terminals, and require an AOC from those providers instead of assuming the topic “takes care of itself”.
Why does the US market have its own PIN security context?
The US combines three factors that make PIN security a board-level topic: mandatory dual routing of debit transactions, a dense landscape of regional debit networks, and the world’s largest independent ATM deployment industry. Each factor widens the circle of organizations touching PINs and keys.
- Regulation II and debit routing. Under the Durbin Amendment, the Federal Reserve’s Regulation II requires every US debit card to support at least two unaffiliated networks, and merchants may choose the routing path. PIN debit routed over regional networks (such as STAR, NYCE, PULSE, or Accel) is a routine cost lever for US merchants – which means PIN volume, and PIN security obligations, span far beyond the global brands.
- The TR-39 heritage. For years, US debit networks required participants to pass ANSI X9 TR-39 PIN security audits. ASC X9 and PCI SSC subsequently consolidated PIN security under the unified PCI PIN standard, so organizations that historically scheduled biennial TR-39 reviews now map the same obligations to PCI PIN Control Objectives and a QPA assessment.
- Independent ATM deployers and ISOs. A large share of US ATMs is operated by independent deployers under bank sponsorship. Sponsor banks and processors push PIN security obligations down the chain: EPP compliance, TR-31 key blocks (Phase 3, effective 1 Jan 2025), and evidence of secure key loading. Processors ultimately decline transactions from non-compliant machines.
- Network and sponsor enforcement. After Visa sunset its PIN Security Program on 1 Oct 2023, the enforcement model in the US shifted toward networks, sponsor banks, and processors contractually requiring a current PCI PIN AOC – so the demand for QPA assessments now arrives through commercial agreements rather than a single brand program.
The fix: if your organization acquires, switches, or supports PIN debit in the US – even purely as a technical subcontractor – assume a counterparty will ask for your PCI PIN AOC and plan the assessment cycle accordingly.
How is the standard structured – 7 Control Objectives and annexes?
The standard organizes its requirements into 7 Control Objectives spanning the full key and device lifecycle, supplemented by three normative annexes for specialized roles. Every requirement carries test procedures the assessor follows during the review.
| Control Objective | Scope |
|---|---|
| 1 | PINs processed only with secure equipment and methodologies (PTS devices, approved algorithms) |
| 2 | Keys generated so that no key can be predicted (randomness, generation inside SCDs) |
| 3 | Keys conveyed and transmitted securely (components, transport keys, key blocks) |
| 4 | Key loading to HSMs and POI devices handled securely (dual control, key loading devices) |
| 5 | Keys used in ways that prevent or detect unauthorized usage (single purpose per key, zone separation) |
| 6 | Keys administered securely (custodians, inventory, rotation, destruction) |
| 7 | Equipment processing PINs and keys managed securely (HSM and POI lifecycle, tamper protection) |
The normative annexes carry the same weight as the main body:
- Annex A – symmetric key distribution using asymmetric techniques (remote key distribution) and certification/registration authority (CA/RA) operations,
- Annex B – requirements for key injection facilities (KIFs),
- Annex C – minimum and equivalent key sizes and strengths for approved algorithms; rewritten in v3.1 to align with NIST nomenclature (PCI SSC blog).
An assessed entity rarely falls under every part at once – a processor without its own KIF skips Annex B, and an organization without remote key distribution skips Annex A. The PCI SSC AOC template for PIN v3.1 explicitly records each Control Objective as assessed in full, in part, or not at all, with justification.
Which deadlines and changes apply in 2026?
As of 2026, all three key block phases are in force, the ISO PIN block format 4 dates remain suspended, and the relaxed encrypted key loading requirement (32-9) applies to POI v5 and later devices. The ecosystem’s strategic direction remains the migration from TDEA to AES.
The timeline per PCI SSC and Visa bulletins:
| Date | Change |
|---|---|
| 1 Jun 2019 | Key blocks Phase 1: internal connections and key storage within service provider environments (applications and databases connected to HSMs) |
| 1 Jan 2023 | Key blocks Phase 2: external connections to associations and networks |
| 1 Oct 2023 | Visa sunsets the Visa PIN Security Program; PCI PIN compliance remains mandatory, attested via QPA assessment |
| 1 Jan 2025 | Key blocks Phase 3: all merchant hosts, POS devices, and ATMs |
| suspended | ISO PIN block format 4 (AES) support dates – PCI SSC is re-evaluating the TDEA-to-AES migration path (Mar 2021 bulletin) |
| deferred | Requirement 32-9 (encrypted key loading): dates pushed back 3 years and applicability narrowed from POI v3+ to POI v5+ (PCI SSC bulletin, Nov 2020) |
The practical consequence of Phase 3 for the US market: legacy key exchange methods (key variants without cryptographically bound attributes) stopped being compliant at the merchant host and ATM edge. Key block formats – in practice ANSI TR-31 for symmetric exchange and TR-34 for asymmetric distribution – bind a key’s usage attributes to the key itself so that altering the attributes renders the key unusable. US ATM deployers felt this directly: processors reject key exchanges from EPPs that cannot handle TR-31.
How is compliance validated – QPA, ROC, and AOC?
PCI PIN compliance is validated through an assessment by a Qualified PIN Assessor (QPA), documented in a ROC and an AOC using the PCI SSC v3.1 templates. Since Visa’s program sunset (1 Oct 2023), enforcement flows through networks, sponsor banks, and counterparties, with Visa pointing to a cycle of at least once every 2 years.
The building blocks:
- QPA – a company qualified by PCI SSC to perform PIN Security assessments; a separate qualification from QSA (PCI DSS) and P2PE QSA.
- ROC (Report on Compliance) – the onsite assessment report documenting the result for every Control Objective and applicable annex.
- AOC (Attestation of Compliance) – the attestation signed by the assessed entity and the assessor; the PCI SSC template requires marking the coverage (full or partial) per Control Objective with justification for exclusions.
- 24-month cycle – under Visa’s former program, validation ran every 24 months; after the sunset, Visa maintains that the AOC requires a QPA assessment at least every 2 years, with an additional assessment warranted when processing facilities move or the environment changes significantly (for example, a new HSM).
Preparation usually starts with a gap analysis against the 7 Control Objectives and applicable annexes – Patronusec runs that gap analysis together with role classification and a remediation plan before the QPA is engaged.
Myth vs fact: what do people get wrong about PCI PIN Security?
MYTH: PCI DSS already covers PIN protection, so a separate standard is redundant.
FACT: PCI DSS prohibits storing sensitive authentication data (including the PIN block) after authorization, but it does not govern PIN key management, secure cryptographic devices, or key injection – that is the domain of PCI PIN Security.
MYTH: After Visa sunset its program (1 Oct 2023), PIN Security assessments became optional.
FACT: Visa retired its own proactive validation mechanism but explicitly confirmed that participants must keep meeting PCI PIN requirements, with a QPA assessment behind the AOC at least every 2 years.
MYTH: TR-39 audits still satisfy US debit network requirements.
FACT: ASC X9 and PCI SSC consolidated PIN security under the unified PCI PIN standard; the obligations formerly reviewed in TR-39 audits now map to PCI PIN Control Objectives assessed by a QPA.
MYTH: Key blocks are a processor-only problem.
FACT: Phase 3 of requirement 18-3 extended key blocks to all merchant hosts, POS devices, and ATMs on 1 Jan 2025 – devices unable to exchange keys in key block formats drop out of the acceptance chain.
FAQ – PCI PIN Security
How does PCI PIN Security differ from PCI DSS?
PCI DSS protects cardholder data (the PAN and related data) in processing environments. PCI PIN Security protects the PIN and the cryptographic keys securing it in ATM and POS transactions. They complement each other: a PIN processor typically falls under both, each with a different scope.
Who can perform a PCI PIN Security assessment?
A Qualified PIN Assessor (QPA) – a company qualified by PCI SSC for PIN Security assessments. The QPA qualification is separate from QSA (PCI DSS) and P2PE QSA. The result is documented in a ROC and AOC using the PCI SSC templates for standard version 3.1.
How often does a PIN Security assessment need to be repeated?
At least every 2 years – the cycle Visa points to after sunsetting its own program (1 Oct 2023). An additional assessment is warranted when processing facilities relocate or the environment changes materially, such as a new HSM deployment. Networks, sponsor banks, and acquirers may set stricter contractual expectations.
Do ATMs fall under PCI PIN Security?
Yes. The standard covers PIN processing at ATMs and POS terminals, with the operator or agent managing keys and devices as the assessed entity. Since 1 Jan 2025, key block Phase 3 covers key exchange with ATMs, which forced EPP keypad and software upgrades across the US independent deployer market.
What replaced TR-39 audits in the US?
The unified PCI PIN Security standard. ASC X9 and PCI SSC consolidated PIN security requirements, so obligations historically reviewed under ANSI X9 TR-39 for regional debit networks now map to PCI PIN Control Objectives, assessed by a QPA and attested in a PCI PIN AOC.
Does PIN entry on a merchant’s phone fall under this standard?
Not directly. PIN entry on consumer off-the-shelf devices is governed by separate PCI SSC standards for mobile payments (the SPoC and MPoC classes), each with its own validation program. PCI PIN Security covers classic PTS POI devices, translation hosts, and key management infrastructure.
How does Patronusec help prepare for a PIN Security assessment?
We start with a free scope-assessment call: we classify your role (processor, ESO, KIF, CA/RA), determine the applicable Control Objectives and annexes, and estimate the gaps. We then deliver a gap analysis, remediation plan, and documentation readiness ahead of the QPA assessment. After the scope assessment we present a fixed-price quote.
Recommended reading
A reading path for PIN and key security:
- PCI PIN key management – top 5 rules and top 5 mistakes – the operational deep dive into the standard’s Control Objectives.
- P2PE component, solution and application – validation routes for providers – the ecosystem roles whose key management draws on PCI PIN.
- P2PE vs E2EE vs NESA – 3 approaches to payment encryption – the broader context of protecting card data in transit.
- MPoC, SPoC and CPoC: a revolution in secure mobile payments – how PCI SSC governs PIN on consumer devices.
- PCI DSS compliance: navigating the scope without confusion – where PIN Security meets PCI DSS scope.
PCI PIN Security – free consultation
Patronusec, an accredited QSA, supports acquirers, processors, and ESOs in PCI PIN Security projects – from role classification to QPA assessment readiness. Book a free scope-assessment call.
