A vendor wants to know if they will be penalized if their vault is not compliant. Who should they ask?

The Payment Brands (e.g., Visa, Mastercard, American Express) and their partners, the acquiring banks, are responsible for establishing and enforcing compliance programs. They hold the contractual authority to impose penalties, such as fines, increased transaction fees, or termination of card processing privileges, on vendors who are not compliant. The vendor's agreement with their acquirer dictates the specific consequences, which are driven by the rules set forth by the Payment Brands. Therefore, the Payment Brands are the ultimate authority on penalties for non-compliance.

A. PCI SSC: The PCI Security Standards Council (SSC) is a global body that develops and manages security standards; it does not enforce compliance or issue penalties.

B. Assessor: An assessor (QSA/ISA) is responsible for evaluating and validating an entity's compliance status, but they have no authority to determine or levy penalties.

C. Issuing banks: Issuing banks are financial institutions that provide payment cards to consumers and are not responsible for enforcing compliance penalties on vendors or merchants.

1. PCI Security Standards Council, "Frequently Asked Questions": On the topic of enforcement, the official FAQ states, "The payment brands are responsible for compliance enforcement; they may fine an acquiring bank for compliance violations. It is then at the bank’s discretion whether to pass the fine on to the merchant." This clarifies that the authority for penalties resides with the payment brands and their acquiring partners. (Source: PCI SSC Website, FAQ section).

2. PCI DSS Requirements and Security Assessment Procedures, Version 4.0, "PCI DSS Applicability Information," Page 8: The standard's introductory section clarifies the ecosystem roles: "The payment brands may, at their discretion, fine acquiring banks for PCI DSS compliance violations. Acquirers may in turn pass these fines down to the merchant. Further details on the specific payment brand compliance programs can be found on their respective websites." This directly attributes the penalty framework to the payment brands.

3. PCI Security Standards Council, "About Us": The Council's official role description states: "It's important to note that the PCI Security Standards Council does not manage compliance programs. The payment card brands and acquirers are responsible for enforcing compliance, not the Council." (Source: PCI SSC Website, About Us page).