Complying With Visa’s July 1 PA-DSS Mandate
Written by Walter ConwayA 403 Labs QSA, PCI Columnist Walt Conway has worked in payments and technology for more than 30 years, 10 of them with Visa.
In the same way you wouldn’t buy your gold Rolex from a street vendor, you shouldn’t buy a software payment application that is not on the PCI Council’s list of PA-DSS validated applications. My advice to retailers: If an application is not on the list, don’t even include it in an RFP. (For a look at the apps that were found to actually retain prohibited data, see our story about the Visa Bad Apps list.)
In October 2007, Visa issued a series of mandates to acquirers addressing merchant PCI compliance. The last of these mandates says acquirers have to ensure that their merchants who use third-party payment applications are using only PA-DSS-compliant versions by July 1, 2010. (Note: This date refers to Visa USA; other regions may have different timelines.)
Although originally aimed at smaller Level 3 and Level 4 merchants, a few nuances to this mandate have a number of Level 1 CIOs scratching their heads. Unfortunately, the mandate may also cause some CIOs to look for PA-DSS validated applications when they may not necessarily need to. In a few cases, it may even cause CIOs to reject a potential software application unnecessarily. To avoid either mistake, we should understand what Visa’s mandate does and does not cover, in addition to some nuances in the PA-DSS program.
The PA-DSS evolved from Visa’s Payment Application Best Practices (PABP) program, the goal of which was eliminating “vulnerable payment applications.” These apps are defined as those that store the magnetic stripe (or chip) information or other sensitive authentication data such as the three-digit security codes or PINs. Visa maintains a list of vulnerable payment applications and updates it quarterly. Although the brand does not release this list publicly, you can check the status of any application you have by contacting your acquirer.
The applications on the PA-DSS list are version-specific, so make sure your vendor delivers a compliant version. You want to avoid the pleasure of paying again for an upgrade to the PA-DSS validated one. Validated applications have an expiry date, so check that, too, when you are evaluating your purchase.
-Marc
June 10th, 2010 at 9:51 am
This deadline date is interesting, guidance in Europe from VISA Europe is as follows (of course VISA Inc will have their own opinion) :
Effective 1 July 2010, acquirers must ensure that all merchants using payment applications that store (or cause to be stored) sensitive authentication data post-authorisation, or applications that are listed as ‘‘vulnerable’’ by either Visa Europe or Visa Inc. must move to applications that do not store sensitive authentication data.
Effective 1 July 2010, acquirers must ensure that all new merchants only use PA-DSS compliant applications
————————————————-
But when you ask for further clarification they state reply with the following:
New merchants applies to brand new merchants only, not merchants moving from one acquirer to another.
Note the use of compliant, at this stage we are not mandating the certification of applications.
————————————————-
So breaking it down further, Acquirers must ensure merchants dont use a listed ‘vulnerable’ paymwent app from July 1st. Then, new merchants, who have never had a bank acocunt or business before must use a compliant app but not one that has been certified from July 1st..
June 10th, 2010 at 10:12 am
This deadline date is interesting, guidance in Europe from VISA Europe is as follows (of course VISA Inc will have their own opinion) :
Effective 1 July 2010, acquirers must ensure that all merchants using payment applications that store (or cause to be stored) sensitive authentication data post-authorisation, or applications that are listed as ‘‘vulnerable’’ by either Visa Europe or Visa Inc. must move to applications that do not store sensitive authentication data.
Effective 1 July 2010, acquirers must ensure that all new merchants only use PA-DSS compliant applications
————————————————-
But when you ask for further clarification they state reply with the following:
New merchants applies to brand new merchants only, not merchants moving from one acquirer to another.
Note the use of compliant, at this stage we are not mandating the certification of applications.
————————————————-
So breaking it down further, Acquirers must ensure merchants dont use a listed ‘vulnerable’ payment app from July 1st. Then, new merchants, who have never had a bank account or business before must use a compliant app but not one that has been certified from July 1st..
June 11th, 2010 at 5:00 pm
@Chalky,
I find it very surprising that Visa or any brand or acquirer would draw a distinction between a new vs. existing merchant, especially when it comes to PCI. To me it makes no sense. In fact, with merchant IDs and retail locations coming and going, I’m not even sure I know what a “new merchant” would be in this context.
In case you can’t tell, I’m really hoping that the person to whom you spoke misunderstood the question. Did you speak to a compliance/risk person? The answer you got is particularly confusing since several of the earlier mandates (that were part of the same release) dealt explicitly with “newly boarded merchants” as opposed to new merchants.
Merchant risk and PCI compliance is too important to have all kinds of conditions attached. Let’s hope Visa Europe clarifies.
June 13th, 2010 at 9:58 am
The repsonse came back via email from the compliance team for PA-DSS / Payment applications at VISA Europe……..I also asked to see the list of vulnerable ‘third-party apps’ mentioned in your article and they told me it doesnt get put on general release and only goes to the acquirers…….
June 13th, 2010 at 8:31 pm
Well, I guess Visa Europe did clarify their position as you say. I’m a little surprised, but it is their brand and their region, so I guess they get to make the rules. As for the list of known compromised apps, you got the standard response. Visa does not release that list, but as you say your acquirer has direct access to it and can advise you if any app (or version!) you have is known to have been compromised.
Thanks for the update from Visa.