Whenever it deals with financial transactions, risks always run high. Insufficient business practices or negligence in dealing with banking details, credit cards, or any confidential customer information create avenues for fraud, theft, and unauthorized data exposure.
As a consequence, Payment Processing is an industry that is heavily regulated due to the need to ensure maximum data security and promote risk avoidance. The standard regulations that are currently in force span all the aspects of ensuring data integrity and security. Simultaneously, they may also be excessively costly for businesses to violate – both as a result of the direct consequences of non-compliance and the fines that are due to be imposed by Law.
In this article, we’ll take a look at the relevant standard regulations, the challenges your payment processing business is likely to encounter while implementing compliance with them, and the best practices that can help you cope with these challenges.
Payment Card Data Security Standards (PCI DSS)
Payment Card Data Securities Standards date back to 2004. They came into being as an initiative by 5 major credit card issuers – Mastercard, Visa, JCB, Discover, and American Express.
These standards are binding upon any business entities that collect, store, transmit, or process cardholder data, which stands for a broad range of business entities, including financial institutions, various merchants, brick-and-mortar retailers, online stores, payment processors, and payment facilitators.
The data that is to be protected in accordance with the PCI DSS compliance requirements is associated with credit, debit, and cash cards and includes credit card numbers, security codes, and card expiration dates.
In addition to precluding cardholder data from being used for fraudulent purposes, PCI DSS compliance is intended to protect payment processing companies against getting exposed to high-risk, money laundering-related transactions. It helps prevent data breaches, identity theft, and fraud during the processing and transmitting of card data.
The PCI DSS compliance standards are pillared upon 6 main principles:
- Build and maintain a secure network and systems – any credit card transactions are to be handled in a secure network that uses robust but user-friendly firewalls. Any vendor-provided authentication data, like passwords and personal identification numbers are not to be used ongoingly.
- Protect cardholder data – any cardholder data, including SSN, birthdays, email addresses, and mothers’ maiden names must be secured during both storage and transmission.
- Maintain a vulnerability management program – one must implement a Vulnerability Management program that protects the systems that hold cardholder data against hacking attempts (like, for example, those associated with the use of malware and spyware), as well as eradicate any vulnerabilities that malicious actors can potentially exploit to alter or steal cardholder data. The systems that hold cardholder data must also be free of bugs. These systems are to be updated and patched on a regular basis.
- Implement strong access control measures – access to the computer systems that hold cardholder data is to be restricted, while all the users of such systems are to be assigned a unique ID name or number that must be kept confidential at all times. It is prohibited to use vendor-supplied security parameters, and, in particular, vendor-supplied passwords. In addition to the safeguards that protect cardholder data electronically, a compliant business is also to protect this kind of data physically, including at Points-of-Sale, and treat such data with precaution. The latter can involve data shredding, imposing restrictions on duplicating cardholder data, and other measures.
- Regularly monitor and test networks – businesses that work with cardholder data are to monitor and test their networks to make sure that the means that ensure the security of the cardholder data they hold function optimally. For example, all the antimalware and antispyware programs that a business has installed must always be updated to their latest versions.
- Maintain an information security policy – it is necessary to introduce a detailed information security policy that explains the responsibilities of all the process actors involved.
Based on the annual volume of transactions, the PCI DSS standards have 4 validation levels.
In the event a business fails to ensure compliance with PCI DSS, a card issuer or acquiring bank is entitled to impose penalties on it. For severe non-compliance with the PCI compliance regulations, such penalties can reach millions of dollars. Besides, they can include recurrent monthly fines to be paid by the business entity in breach of the PCI DSS compliance requirements until this business entity becomes fully PCI DSS-compliant.
Quite often, compliance with PCI DSS becomes part of companies’ contractual obligations. In one of our recent articles, we shared a PCI DSS compliance checklist so you are welcome to make sure your company meets the necessary requirements accurately.
Know Your Customer (KYC) and Anti-Money Laundering (AML) Regulations
Often used in conjunction with one another, the terms KYC and AML do not mean exactly the same. In fact, KYC is an important and integral part of AML, and any AML activities start with the KYC procedure.
KYC
Implementing KYC standards in Finance is one of the key and most demanding processes banks and Fintechs must complete to achieve the required regulatory compliance. The Know Your Customer regulations outline and mandate the steps and procedures that are to be taken by banks and companies to establish the identity of a customer, gain insights into the nature of the customer’s business activities, make sure their funds come from a legit origin, and assess the money-laundering risk the customer brings based on these insights.
The KYC regulations consist of several components:
Implementing a Customer Identification Program (CIP)
As part of KYC, the Customer Identification Program is pivotal in assessing the risks posed by a customer. It focuses on reliably verifying the customer’s identity by cross-checking customer information against various trustworthy sources. In the U.S, the C.I.P is part of the Patriot Act that is intended to counter not only Money laundering, but also Corruption and Terrorism Funding.
The minimum requirement the C.I.P puts forward is to check the following details of the customer:
- Name
- Date of Birth
- Address
- ID Number
The types of checks performed can include both document checks and checks against public and other databases. The C.I.P or procedure for businesses uses a list of parameters other than that used for individuals.
Performing Customer Due Diligence
In accordance with the Money-Laundering or Fraud risks a customer can potentially pose, there are 3 levels or types of Due Diligence performed as part of the C.I.P:
- Simplified Due Diligence (SDD)
- Customer Due Diligence (CDD)
- Enhanced Due Diligence (EDD)
Any of these 3 types consists of the following 4 procedures, performed with varying levels of intensity:
- Customer identification and verification.
- Beneficial owner identification and verification.
- Understanding the purpose and nature of the relationship.
- Ongoing monitoring.
Let’s now look at the types of Due Diligence that make up the C.I.P in more detail:
- Simplified Due Diligence (SDD) – the most simple type of Due Diligence that is applicable in those cases, when the risks a customer poses are considered to be low. Correspondingly, while having all the basic features of the standard Customer Due Diligence, SDD has a lower verification threshold. Because of this, while performing SDD, business organizations are entitled to adjust such parameters as the quantity of the information used for verification purposes, the types of such information, the frequency of transaction monitoring, and others.
- Customer Due Diligence (CDD) – the baseline or standard Due Diligence procedure that financial institutions and other relevant business organizations are obliged to complete. The business organization must collect some basic data about the customer and check it against criminal and other databases.
- Extended Due Diligence (EDD) – the type of Due Diligence that is applied in the case of high-risk customers. To achieve a more thorough and comprehensive customer verification for risky customers, EDD can include various additional checks, like, for example, checks against sanction lists and watchlists, real-time asset tracking, and adverse media screening.
Ongoing Monitoring
Ongoing Monitoring aims to detect signs of customers’ suspicious financial activity. The objects of such monitoring can include both customers’ transactions and their account balances.
Examples of the signs of unusual or suspicious activity that financial institutions can be on the lookout for during Ongoing Monitoring include tangible spikes in customer activities, untypical cross-border transactions, and newly appeared adverse media mentions.
The set of the control parameter values for Ongoing Monitoring is determined in accordance with the customer’s risk profile.
AML
Anti-Money Laundering (AML) is a set of laws, regulations, and procedures, intended to prevent criminals from disguising illegally obtained funds as legitimate. In the Financial Services industry, all market players are obliged to stringently uphold all the existing AML regulations.
The backbone of AML Compliance is the AML program that relevant businesses must introduce. This program must include:
- Designating the Compliance officer who will tend to the regulatory procedures, improve existing compliance policies, and define new compliance policies.
- Developing the Internal compliance policies and actionable protocols that state how the various suspicious activities are to be responded to.
- Implementing a Risk Assessment algorithm that can include clients, business relationships, services, products, geographies, and other factors.
- Training the company’s employees and personnel.
- Arranging for an Independent Review by an Accredited Party.
Andrii Semitkin
Delivery Director at SPD Tech
“It’s best to put compliance – the part and parcel of what’s required in the Fintech niche – high on your list of priorities yet well prior to the kick-off of your software development effort. There are too many important details to be taken into account and you should discuss them with your IT provider early enough in the project development cycle.”
PSD2
The Revised Payment Services Directive (PSD2) is a regulatory framework that is aimed to ensure the security of payments within the E.U. For this purpose, the framework focuses on such aspects as consumer rights, access of 3d-parties to consumers’ accounts, and the security of eCommerce.
For example, with regards to consumer rights, PSD2 makes it mandatory to accept and resolve consumer complaints in any of the several ways the framework specifies.
Security-wise, in accordance with PSD2, consumers are obliged to perform Multi-Factor Authentication (at least, F2A) when logging in to make any payment. Payment processors can access customer account data only via bank APIs that authenticate them with the help of PSD2-compliant certificates (such certificates contain several PSD2-specific fields).
In some cases, and, more specifically, when it deals with Travel, Delivery, Ticketing, and Food websites, merchants are banned from applying surcharges.
SOC2
The System and Organization Controls (SOC2) framework was introduced by the American Institute of Certified Public Accountants (AICPA) with a view to regulating the way Technology and Cloud providers handle customer data.
To minimize risks and reduce the odds of data exposure, the framework provides a set of criteria, as well as some auditing practices that help ensure that both the internal controls of a company and the way they utilize their various compliant systems are up to par.
SOC2 focuses on the following 5 criteria:
- Security
- Availability
- Processing Integrity
- Confidentiality
- Privacy
In evaluating the internal controls of a company, the SOC 2 framework uses two types of reports:
- SOC 2 Type 1 – a snapshot of the target controls and the extent to which they correspond with the outlined criteria at a given point in time. The report considers the design of the controls the company has in place.
- SOC2 Type 2 – a snapshot of the target controls over a specified span of time.
The minimum time period the SOC2 Type 2 report can cover constitutes 6 months.
The Best Practices in Ensuring Payment Processing Compliance
Although the different payment compliance regulations vary in their specific purpose and tool set, there are several universal best practices that can help achieve their goals.
End-to-End Encryption
Presently, ensuring data security in Fintech is unthinkable without data encryption. Correspondingly, end-to-end data encryption is an absolute must-have for achieving the necessary regulatory compliance in this realm.
When it comes to protecting customer data, It is imperative that such data be protected when both at rest and in transit. To protect data at rest, one must use one of the several strong encryption algorithms. The more widespread of such algorithms include AES256, Blowfish, Twofish, and RSA. Please note that it is always advisable to use longer encryption keys, and you should consult your IT partner about which key length can be considered sufficiently secure for the strong encryption algorithm of your choice – this length can vary from algorithm to algorithm.
As far as data in transit is concerned, it must be protected using either the Secure Socket Layer (SSL) certificate or Transport Level Security (TLS) encryption. Although SSL is still widely used, TLS is a more secure, and, correspondingly, more preferable option. It uses enhanced encryption algorithms, encrypted alert messages (in SSL, the alert messages are unencrypted), and a more advanced message authentication algorithm. The latter allows protecting the data being transported from tampering by malicious actors.
Security Audits and Vulnerabilities Assessments
To ensure compliance, it is essential that one conducts regular PCI DSS and other compliance audits. These audits must be both internal and external, i.e. involve an accredited 3-d party.
Discovering and assessing vulnerabilities in a company ecosystem is an effort-intensive process that one must conduct on an ongoing basis. For better results, it makes sense to employ several approaches.
One of such approaches is using well-scoped Penetration Testing (black-box, white-box, or gray-box) applied to both the systems and networks used. Under this approach, your in-house experts or those of your IT partner simulate real-world hacking attacks on your IT infrastructure with the goal to detect any possible vulnerabilities.
Another approach that can prove very effective is implementing a company-wide policy that would encourage both your IT and non-IT employees to practice a proactive attitude and raise a flag whenever something within their area of responsibility seems to be not up to par in terms of security.
Vendor and 3d-Party Risk Management
Vendor other 3d-party relationships may pose significant risks too. These include cybersecurity, operational, and other risks.
To deal with such risks, you should first clearly describe the nature of your future relationship with a vendor or some other 3-d party. Once this is done, you should apply due diligence in accordance with their profile. Finally, you should request your partner-to-be to fill in any gaps that you have found.
Also, it’s advisable to manage and mitigate 3-d party risks with the help of SLA agreements. In these agreements, you should clearly indicate the ways in which any possible Security and Data Privacy risks are to be taken care of by the 3d party you are dealing with.
Payment Processing Compliance Challenges
In addition to the need to fully encompass the various demands of the compliance regulatory frameworks and deal with the various numerous risks, payment processing companies also have to cope with several other significant challenges.
Being aware of these challenges not only helps tackle them in time, but also allows you to do so with a systematic approach, beforehand, and in a comprehensive manner.
So, what are these challenges?
Evolving Regulatory Landscape
Over recent years, the regulatory landscape around payment processing seems to have been constantly undergoing a massive amount of change. Such changes are virtually guaranteed to continue far into the future, as regulators are trying to keep pace with the fallout of several factors that are constantly evolving at a fast speed.
Such factors include the emergence of new payment methods, the growing role of payment facilitators on the payments market, the ever-evolving cyber threats that are also growing in number, the ever increasing amount of fraud, and others. Examples of the regulations that have come into being in response to these developments include GDPR that took effect in on May 25, 2018, the Strong Customer Authentication (SCA) requirement of PSD2 that came into force on September 14, 2019, and the AMLD 5 directive that was released on June 19, 2018.
The significance of regulatory frameworks for payment processors makes it necessary for these companies to keep tabs on the nascent regulatory initiatives and prepare for the advent of such initiatives in advance.
Talking of examples, in Europe, one should currently be anticipating the arrival of such regulatory initiatives as the EU Digital Wallet and Instant Payment Regulation.
Juggling Security and User Experience
The security safeguards payment processing companies need to put in place often tend to come into conflict with the need to provide seamless UX customer experiences. Because of this, it is essential for payment processors to carefully consider the different existing security-related options and choose those of them that allow sufficient user-friendliness without compromise on security.
Wonder how to start a payment processing company? Follow our getting-started guide!
For example, using PSD2-compliant security tokens as a security factor in MFA can ensure a sufficient level of security. At the same time, security tokens cannot be considered as a user-friendly means of ensuring security, and it might be better to use a more “seamless” security factor, like, for instance, Iris Recognition or Advanced Face Recognition.
Using Blockchain and Artificial Intelligence
Immune to fraud, tampering, hacking, and data breaches, Blockchain enables real-time payments and makes the KYC and AML compliance a great deal easier to achieve. Some of the Blockchain-powered payment systems have proven their ability to dramatically improve payment infrastructures on a nationwide scale. What’s more, leveraging blockchain technology is one of the major payment processing trends for 2024.
However, there are also some noteworthy challenges related to the use of the Blockchain Technology in payment processing.
Blockchains tend to frequently become congested due to large transaction volumes. In turn, this results in low transaction-per-second rates and higher costs for users. To solve this problem, one can employ several approaches, like, for instance:
- Creating state channels to enable users to interact directly and make off-chain transactions that are not reflected on the main blockchain.
- Implementing the variation of state channels called payment channels.
- Creating side chains that represent offshoots of the main blockchain that users can transfer funds to for faster transaction processing when this is required.
Another major problem of payment Blockchains is the issue of interoperability. To solve this problem, Blockchain payment providers must seek cooperation with one another.
Similar to Blockchain, Artificial Intelligence is a great boon for businesses that are engaged in payment processing, in particular, when it comes to enhancing their KYC and AML procedures. Alas, the downside is there too.
Using AI in payment processing involves processing (collecting and analyzing) massive amounts of data, and this can raise concerns among both customers and regulators. Payment service providers can dispel such concerns only by emphasizing that they meticulously follow the compliance regulations under review and have all the technical means to counter all the cyber threats these regulations cover.
In Conclusion
We’ve made a brief overview of the requirements Fintechs and other businesses must meet for ensuring credit card payment processing compliance and other standard compliance for payment processing.
Prior to embarking on this complex process, you should become well-acquainted with the corresponding regulatory documentation and be prepared to discuss your current business situation and needs with your IT provider and any other parties that may need to be involved.
As to the best practices we’ve touched upon, our Fintech development team has nearly two decades of experience in dealing with various Fintech development challenges and would be delighted to tell you more about this topic – just feel free to ask.
FAQ
- What is PCI compliance?
PCI DSS compliance is a mandatory compliance framework that regulates the handling (collection, storage, transmission, or processing) of cardholder data by such businesses as financial institutions, various merchants, brick-and-mortar retailers, online stores, payment processors, and payment facilitators.
- How to implement PCI DSS compliance?
You should gain an overall understanding of the PCI DSS compliance requirements, become aware of the best practices that can be helpful, find a knowledgeable IT provider with sufficient Fintech development experience, compose a PCI DSS compliance checklist jointly with them, and discuss with them the development options they can offer.