3 ms·
According to the PCI-DSS website, "[i]t is important to note that the payment brands and acquirers are responsible for enforcing compliance, not the PCI council
by joatmon-snoo 10y ago
According to the PCI-DSS website, "[i]t is important to note that the payment brands and acquirers are responsible for enforcing compliance, not the PCI council." [1] No idea what the state of actual legally-enforceable penalties is.
In the meantime I've tweeted @AmericanExpress about this.
[1] https://www.pcicomplianceguide.org/pci-faqs-2/#1 https://www.pcicomplianceguide.org/pci-faqs-2/#1
- andrewguenther 10y agoWould you mind linking the tweet? I'm curious to see if they respond.
- abrookewood 10y agoI wouldn't think there are any legally enforceable penalties except maybe through contract law. PCI-DSS is not law, it's an agreement between companies.
- brazzledazzle 10y agoI think legally-enforceable penalties in a regulatory sense vary depending on where you and your customer are. But the contracts between you and your credit processing merchants are civilly enforceable and in my experience they don't mess around. They will fine you and raise your transaction costs when out of compliance and will ultimately cut you off if necessary. They also know their competitors will do the same thing because they bear the brunt of the costs incurred by fraud.