Is ACH a PCI?

Is ACH a PCI?

The most important component of ACH functionality is ensuring that it meets Payment Card Industry Data Security Standards (PCI-DSS) compliance. ACH transactions provide direct access to bank accounts so therefore PCI-compliance in financial information use and storage is critical.

Does PCI apply to bank accounts?

Bank Account Information In short, when storing account details PCI does not apply; it only applies to payment cards. However, the standard still offers one of the most accepted standards for storing secure data; so PCI is a useful point of reference for good practice.

Is the credit card Number stored as a hash?

Card Number (hashed) Only the card number is stored hashed and no digits are stored as plain- text. This pattern is usually in applications that also encrypt the card number. The card number is stored as a hash to allow for efficient searching and matching.

How are routing and account numbers stored in PCI?

The routing and account number could be concatenated, hashed with something like SHA-512, then stored in a table which associates these hashes with donor IDs. Would these one-way hashed routing/account numbers be considered PCI data, and therefore require PCI DSS compliance for our office?

What are the do’s and Don’s of PCI data storage?

AT A GLANCE. PCI DATA STORAGE. PCI Data Storage Do’s and Don’ts. Requirement 3 of the Payment Card Industry’s Data Security Standard (PCI DSS) is to “protect stored cardholder data.” The public assumes merchants and financial institutions will protect data on payment cards to thwart theft and prevent unauthorized use.

Is the PCI of bank payments required by NACHA?

Firstly, with the history of PCI DSS as a guide, we predict that eventually all ACH participants will be required to obfuscate bank account information. Secondly, NACHA intentionally doesn’t mandate any particular data security methods or techniques. We have a few recommendations.