Government agency credit card programs and PCI compliance

August 20, 2019

What’s PCI? All organizations that accept and process card payments must comply with the Payment Card Industry (PCI) Data Security Standard (DSS). This includes government agencies that take credit card payments for constituent services. The cost of noncompliance can be high, so it pays to comply with the PCI DSS.

 

“PCI DSS applies to all entities that process, transmit and/or store cardholder data,” explains Michael Hodge, regional director of payment solutions at U.S. Bank. “If a government agency is processing card payments, then it’s clearly in scope for PCI compliance.”

The Payment Card Industry (PCI) Data Security Standard (DSS) Council is responsible for the global requirements governing the security of cardholder data. Card brands are responsible for enforcement. All merchant services providers, also known as “acquirers,” have the responsibility to report PCI DSS compliance to the data security programs of the card brands.

Major card associations worked together to develop the PCI DSS because of escalating risks related to credit card fraud.

 

PCI DSS includes requirements that address:

  • Security management
  • Policies
  • Procedures
  • Network architecture
  • Software design
  • Other critical protective measures

 

Noncompliance can mean big consequences

PCI DSS compliance requirements and validation apply to government agencies the same as they do for other businesses.

“If an organization, such as a government agency, fails to adhere to PCI DSS, they may be assessed fines for noncompliance, and/or may no longer be able to process cards for payment,” Hodge says. Fines vary by card brand and an agency’s assigned PCI level, but they can be as high as hundreds of thousands of dollars.

“Beyond fines, government agencies also need to comply with the standard to maintain constituent trust,” Hodge says. “They should consider it a best practice to protect cardholder data and information.”

“At U.S. Bank, our government agency clients consistently adhere to their PCI DSS compliance, and validate it annually,” Hodge says.

However, Hodge notes the configuration of card processing networks for government agencies — and how these networks speak to one another — can affect how agencies manage and conduct their PCI DSS audit duties. They may be subject to multiple audits and validations, or just one.

“Given that we’re reminded of security breaches daily, it’s imperative that agencies accepting cards recognize and address annual compliance,” Hodge says.

“As long as an agency is the merchant of record, it has compliance responsibility. Once it begins accepting card payments, its compliance duties begin. The agency should be diligent to discuss with its payment acquirer the steps necessary to reach compliance responsibility.”

 

Some government entities may find they have bureaucratic challenges with PCI DSS compliance

Government entities work across agencies and with management to understand their responsibilities, which include the need to examine, establish and maintain a strong data security posture. They also need to understand the costs of annual validation. “As a result, it’s important that they develop a best practices policy for card payment acceptance,” Hodge says.

The PCI DSS Council provides a list of approved companies that can assist you with an audit. Acquirers often recommend a PCI Approved Qualified Security Assessor, but government agencies aren’t required to follow this recommendation.

For more information about PCI DSS compliance, talk to your merchant services provider and visit www.pcisecuritystandards.org. Card brands also offer data security program help:

Related content

Best practices on securing cardholder data

Cybercrisis management: Are you ready to respond?

Dear Money Mentor: How do I set and track financial goals?

Turn risk into opportunity with supply chain finance

Webinar: What’s new in international payments?

Webinar: Managing foreign exchange risk in unpredictable markets

Tailor Ridge eBill case study

Want AP automation to pay both businesses and consumers?

Automate accounts payable to optimize revenue and payments

Overcoming the 3 key challenges of a lump sum relocation program

Real-time payments: the next major treasury disruptor

Colleges respond to student needs by offering digital payments

Risk management strategies for foreign exchange hedging

3 ways to adapt to the new payments landscape

Allowance basics for parents and kids

Higher education and the cashless society: Latest trends

Managing the rising costs of payment acceptance with service fees

IRC Section 305(c): Deemed distributions and related regulations

Tap-to-pay: Modernizing fare payments pays off for transit agencies and riders

Complying with changes in fund regulations

Streamline operations with all-in-one small business financial support

6 timely reasons to integrate your receivables

Navigate changing consumer behavior with service fees

Liquidity management: A renewed focus for European funds

Administrator accountability: 5 questions to evaluate outsourcing risks

Enhancing the patient experience through people-centered payments

How COVID-19 is transforming healthcare payments

Ways prepaid cards disburse government funds to the unbanked

Restaurant survey shows changing customer payment preferences

Luxury jeweler enhances the digital billing and payment customer experience

4 ways to make practical use of real-time payments

Evaluating interest rate risk creating risk management strategy

How Everyday Funding can improve cash flow

Payment industry trends that are the future of POS

Modernizing fare payment without leaving any riders behind

Access, flexibility and simplicity: How governments can modernize payments to help their citizens

What government officials should know about real-time payments

Digital Onboarding helps finance firm’s clients build communities

Unexpected cost savings may be hiding in your payment strategy

Webinar: Digitizing receivables to transform B2B rent payments

Checklist: What you’ll need for your first retail pop-up shop

Authenticating cardholder data reduce e-commerce fraud

Benefits of billing foreign customers in their own currency

How AR technology is helping advance payment processing at Avera Health

Increase working capital with Commercial Card Optimization

Top tips for card payments optimization

Fraud prevention checklist

How mobile point of sale (mPOS) can benefit your side gig

P2P payments make it easier to split the tab

3 awkward situations Zelle can help avoid

Tips for navigating a medical hardship when you’re unable to work

When your spouse has passed away: A three-month financial checklist

How to save money in college: easy ways to spend less

Checklist: How to gain financial independence from your parents

Dear Money Mentor: How do I begin paying off credit card debt?

Myth vs. truth: What affects your credit score?

4 benefits to paying foreign suppliers in their own currency

Improve government payments with electronic billing platforms

Emerging A/R solutions use artificial intelligence to target efficiency

ABCs of APIs: Drive treasury efficiency with real-time connectivity

Hospitals face cybersecurity risks in surprising new ways

How jumbo loans can help home buyers and your builder business

Higher education strategies for e-payment migration, fighting fraud

Rule 2a-5 overview: Good faith determinations of fair value

How real-time inventory visibility can boost retail margins

Flexibility remains essential for public sector workforces

Escheatment resources: Reporting deadlines for all 50 states

5 steps you should take after a major data breach

Cybersecurity – Protecting client data through industry best practices

Why KYC — for organizations

The cyber insurance question: Additional protection beyond prevention

What is CSDR, and how will you be affected?

Rule 18f-4: An in-depth look at the derivative risk management program and value-at-risk

Rule 18f-4: The limited use exception

Rule 18f-4 overview: Regulatory framework changes for derivatives

Post-pandemic fraud prevention lessons for local governments

How electronic billing platforms improve government payments

Rethinking common time management tips

How to apply for a business credit card

How a small business is moving forward during COVID-19

How to accept credit cards online

BEC: Recognize a scam

Fight the battle against payments fraud

The latest on cybersecurity: Vulnerability testing and third-party software

The password: Enhancing security and usability

Tactical Treasury: Fraud prevention is a never-ending task

Digital trends poised to reshape hotel payments

Three healthcare payment trends that will continue to matter in 2022

Safeguarding the payment experience through contactless

Automate escheatment for accounts payable to save time and money

Understanding and preparing for the new payment experience

White Castle optimizes payment transactions

Collect utility and telecom bill payments faster

Maximizing your deductions: Section 179 and Bonus Depreciation

3 reasons governments and educational institutions should implement service fees

Avoiding the pitfalls of warehouse lending

ABCs of ARP: Answers to American Rescue Plan questions for counties

4 tips for protecting your business against Coronavirus-related scams

5 Ways to protect your government agency from payment fraud

Proactive ways to fight vendor fraud

The latest on cybersecurity: Mobile fraud and privacy concerns

How to improve your business network security

Government agency credit card programs and PCI compliance

Business risk management for owners of small companies

Depositary services: A brief overview

A first look at the new fund of funds rule

3 benefits of integrated payments in healthcare

Webinar: AP automation for commercial real estate

Webinar: CSM corporation re-thinks AP

COVID-19 safety recommendations: Are you ready to reopen?

How to improve digital payments security for your health system

Government billing survey: The digital transformation of the payment experience

Top 3 ways digital payments can transform the patient experience

How to accept credit card payments without transaction fees

Webinar: Fraud prevention and mitigation for government agencies

Webinar: Recording of the Central Securities Depository Regulation and Pivot

Webinar: CRE technology trends

Webinar: Robotic process automation

Webinar: CRE treasury leader roundtable

Start of disclosure content

Loan approval is subject to credit approval and program guidelines. Not all loan programs are available in all states for all loan amounts. Interest rate and program terms are subject to change without notice. Mortgage, home equity and credit products are offered by U.S. Bank National Association. Deposit products are offered by U.S. Bank National Association. Member FDIC.