1. What does PCI stand for?
PCI stands for Payment Card Industry, taking this a step further would be to use the term PCI DSS which means Payment Card Industry Data Security Standard.
The Payment Card Industry Data Security Standard (PCI DSS) is a set of requirements designed to ensure that ALL companies that process, store or transmit credit card information maintain a secure environment. Essentially any merchant that has a Merchant ID (MID).
The Payment Card Industry Security Standards Council (PCI SSC) was launched on September 7, 2006 to manage the ongoing evolution of the Payment Card Industry (PCI) security standards with focus on improving payment account security throughout the transaction process. The PCI DSS is administered and managed by the PCI SSC (www.pcisecuritystandards.org), an independent body that was created by the major payment card brands (Visa, MasterCard, American Express, Discover and JCB.).
2. Who created PCI-DSS?
PCI-DSS was created by the five largest credit companies – including Visa, Mastercard, American Express, Discover and JCB International – to help in the fight against credit card fraud. PCI-DSS were rules promulgated by the Payment Card Industry Security Standards Council (PCI-SSC), which is the governing body and open forum responsible for developing, managing, educating and raising awareness of the relevant PCI standards.
3. Is PCI-DSS the law?
No. PCI-DSS is not the law. There’s been no federal or state legislative body that’s stepped in to promulgate PCI rules or regulations. PCI-DSS exists today as a matter of contract. PCI-DSS is a creation of the five major credit card brands. When you, as the merchant, decide to accept payment with credit cards bearing the Visa, Mastercard, American Express, Discover or JCB logo, you have agreed to maintain PCI compliance under the terms of your agreement with each of the card brands or their authorized agents.
4. Why does PCI exist?
PCI-DSS exists to help you, as a merchant, safely and securely store, process and handle sensitive customer data. Again, any business that accepts credit cards are subject to the PCI standards.
5. To whom does PCI apply?
PCI applies to ALL organizations or merchants, regardless of size or number of transactions, that accepts, transmits or stores any cardholder data. Said another way, if any customer of that organization ever pays the merchant directly using a credit card or debit card, then the PCI DSS requirements apply.
6. Why am I charged a “PCI Fee”?
The costs associated with implementing, overseeing and managing a comprehensive security program, including maintaining PCI compliance, are significant. These costs add up to tens of thousands of dollars each year. ClubReady charges our subscribership a “PCI fee” to help cover the administrative costs of maintaining these programs and maintaining PCI compliance at the level of a service provider. ClubReady, as a payment facilitator and holder of the primary merchant account, has a significant interest in seeing that all of our subscribers (as sub-merchants) maintain PCI compliance. A portion of the PCI fee goes toward covering the cost of oversight and providing tools and other resources that support our collective PCI compliance efforts.
7. Do organizations using third-party processors have to be PCI compliant?
Yes. Merely using a third-party company does not exclude a company from PCI compliance. It may cut down on their risk exposure and consequently reduce the effort to validate compliance. However, it does not mean they can ignore PCI.
8. What constitutes a Service Provider?
Any company that stores, processes, or transmits cardholder data on behalf of another entity is defined to be a Service Provider by the Payment Card Industry (PCI) guidelines.
9. My business has multiple locations, is each location required to validate PCI Compliance?
If your business locations process under the same Tax ID, then typically you are only required to validate once annually for all locations. You would also need to submit quarterly passing network scans by a PCI SSC Approved Scanning Vendor (ASV), if applicable. If each business location has it's own Tax ID, then a new PCI compliance form is required per location.
10. What PCI-DSS requirements do I need to follow?
Well, that depends. Depending on a merchant’s annual transaction volumes, it could fall under one of four different levels for compliance purposes, and each level has different requirements and obligations.
11. What is a payment gateway?
Payment Gateways connect a merchant to the bank or processor that is acting as the front-end connection to the Card Brands. They are called gateways because they take many inputs from a variety of different applications and route those inputs to the appropriate bank or processor. Gateways communicate with the bank or processor using dial-up connections, Web-based connections or privately held leased lines.
Processing flow:
Club Entity (Merchant) > ClubReady (Service Provider) > Gateway > Merchant Processor (communicates with end-users bank) > Merchant's Bank.
12. What is the definition of merchant?
For the purposes of the PCI DSS, a merchant is defined as any entity that accepts payment cards bearing the logos of any of the five members of PCI SSC (American Express, Discover, JCB, MasterCard or Visa) as payment for goods and/or services. Note that a merchant that accepts payment cards as payment for goods and/or services can also be a service provider, if the services sold result in storing, processing, or transmitting cardholder data on behalf of other merchants or service providers. For example, an ISP is a merchant that accepts payment cards for monthly billing, but also is a service provider if it hosts merchants as customers.
13. What are the four different merchant levels? How are they determined?
Merchant levels are tied to total Visa transactions run over a 12-month period. Transaction volume is based on the aggregate number of Visa transactions (inclusive of credit, debit and prepaid) from a merchant’s “DBA,” or “doing business as.” Visa defines merchant levels by the following criteria:
| Level | Description |
| 1 | Any merchant, regardless of acceptance channel, processing over 6,000,000 Visa transactions per year. |
| 2 | Any merchant, regardless of acceptance channel, processing 1,000,000 to 6,000,000 Visa transactions per year. |
| 3 | Any merchant processing 20,000 to 1,000,000 Visa e-commerce transactions per year. |
| 4 | Any merchant processing fewer than 20,000 Visa e-commerce transactions per year, and all other merchants – regardless of acceptance channel – processing up to 1,000,000 Visa transactions per year. |
Most ClubReady subscribers will be considered Level 4 merchants.
14. What does a small-to-medium sized business (Level 4 merchant) need to do in order to satisfy the PCIDSS requirements?
Complete the following steps:
- Determine which Self-Assessment Questionnaire (SAQ) your business should use to validate compliance.
- Complete the SAQ according to its instructions.
- If applicable, complete and obtain evidence of a vulnerability scan with a PCI-SSC Approved Scanning Vendor (ASV). Note: scanning does not apply to all merchants – it’s only required for SAQ-A-EP; SAQB-IP; SAQ C; SAQ D-Merchant; and SAQ D-Service Provider.
- Complete the relevant Attestation of Compliance (AOC) in its entirety (found in the SAQ tool).
- Submit the SAQ, evidence of a passing scan (if applicable), and the AOC, along with any other requested documentation, to your acquirer.
15. What is the PCI Self-Assessment Questionnaire (SAQ)?
A: The SAQ is a set of data security requirements (technical and non-technical) in the form of a questionnaire designed to ensure you are handling payment transactions in a secure manner relevant to your business profile. Here are helpful tips that may help answer your questions, or the questions they may ask:
1. The ClubReady system is a Virtual Terminal
2. ClubReady is PCI compliant and is certified with the card brands specifically for PCI
3. You do not store card or cardholder data in your system for POS or recurring payments. The ClubReady system gathers and stores all card and cardholder data electronically on your behalf
4. ClubReady truncates the card number so only the last 4-digits are displayed in the member profile and POS screen
16. How do I know which SAQ to use?
If you have questions about the correct SAQ, the SaferPayments™ tool can be used to guide you to the right form. Please note that ClubReady cannot provide you with legal advice or the correct SAQ to use.
17. Where can I find more in-depth information on the SAQ process and PCI-DSS in general?
The Payment Card Industry Security Standards Council website includes some great resources, including SAQ instructions and guidelines (available here).
18. Where does ClubReady fall in the spectrum of parties providing a payment service.
ClubReady is a “payment facilitator,” or “PayFac.”
One common misconception is ClubReady is a payment processor: we’re not. ClubReady has partnered with Worldpay, Inc. (“Worldpay”), a third party, for its payment processing services. Think of Worldpay as the rail network — it provides the infrastructure and tracks that payments travel on. ClubReady is the payments engine — we power and manage the movement of those payments, but we run on the tracks provided by Worldpay.
As a payments facilitator, ClubReady has its own proprietary technology, CR Payments™, which enables seamless credit card processing through the ClubReady System. ClubReady is set up as the primary merchant account holder and you, our subscriber, are set up as our sub-merchant.
ClubReady carries enhanced PCI-DSS responsibilities, as we function at the merchant level rather than as a sub-merchant.
19. If I’m a fully-managed subscriber to the ClubReady System and ClubReady has met its PCI obligations, can’t I just piggy-back on that and say I’m compliant too?
Unfortunately, no. Even as a sub-merchant, because you accept credit card payments at the club or studio level, you will be required to maintain PCI compliance. Again, cardholder theft can occur at any point of weakness in the chain of making credit card payment. This includes any point of weakness originating at the club or studio level (for example, at the sales desk or point-of-sale kiosk). While ClubReady’s PCI compliance efforts do benefit our entire subscribership, including you, individual sub-merchants/subscribers must take appropriate steps of their own to do their part and validate their own PCI compliance efforts.
20. But what if I don’t actually store any credit card data at my club or studio? Does PCI still apply?
Yes. If you accept credit or debit cards as a form of payment, and those credit or debit cards bear the logo of Visa, Mastercard, American Express, Discover or JCB, then the PCI standards will apply to you.
21. What happens if I don’t comply? What are the consequences?
Failing to comply with PCI requirements can result in serious consequences, including:
- Data breach risk: Non-compliance increases the risk of a data breach where cardholder data is lost or stolen.
- Financial loss: Costs may include legal fees, settlements, and incident response expenses.
- Reputation damage: A breach can severely harm your brand and deter new customers or business opportunities.
- Impact on third parties: Your non-compliance could expose other entities in the payment chain (e.g., banks, processors) to risk.
- Card brand fines: Card networks (like Visa or Mastercard) may fine the acquiring bank between $5,000 and $1,000,000 per month for PCI violations.
- Fines passed down: Acquiring banks typically pass these fines down the chain — eventually to you, the merchant.
- Termination of banking relationships: Your acquiring bank may choose to end its partnership with you or with ClubReady.
- Increased fees: To recover losses, the bank may raise transaction fees across the board.
22. What is ClubReady required to do to maintain PCI compliance?
As a payment facilitator, ClubReady is required to maintain heightened PCI compliance standards from typical merchants. Our ongoing annual investments in technology security reflect our commitment to continuous improvement and protection. Each year, to maintain PCI compliance, ClubReady is required to undergoes a rigorous audit by an independent third-party security firm.
It’s important to note that PCI compliance is one facet of a broader data security plan. Although ClubReady has made an intentional choice not to broadcast our security measures to potential bad actors, ClubReady employs both on-line and off-line measures to protecting Subscriber and End User Data. Those interested in learning more can review ClubReady’s Privacy Policy or request a copy of our Data Security Whitepaper.
23. Can the full credit card number be printed on the consumers copy of the receipt?
PCI DSS requirement 3.3 states Mask PAN when displayed (the first six and last four digits are the maximum number of digits to be displayed). While the requirement does not prohibit printing of the full card number or expiry date on receipts (either the merchant copy or the consumer copy), please note that PCI DSS does not override any other laws that legislate what can be printed on receipts (such as the U.S. Fair and Accurate Credit Transactions Act (FACTA) or any other applicable laws).
24. Does ClubReady provide any specific tools that will help me comply? What is SaferPayments™?
You, like ClubReady, have your own PCI compliance obligations as a merchant. You are not responsible for ClubReady’s compliance efforts, nor are we responsible for yours. We both have an affirmative obligation to do our part.
That said, ClubReady provides our subscribership with access to tools and other resources that can be used to aid in meeting one’s PCI compliance obligations. One of these tools is called SaferPayments™. Although SaferPayments™ can’t guarantee compliance, or “do the work for you,” this tool can help pin-point trouble areas, provide more in-depth answers on PCI-related questions, and guide the SAQ submission process.
It's important to note that ClubReady has partnered with a third-party PCI Compliance provider called SaferPayments, to ensure our merchants follow payment-industry standards, but ClubReady is not involved with the completion of the SAQ. Questions about SaferPayments™ can be directed to SaferPayments at (866)-493-8756 , or at www.yoursecurejourney.com.
25. How should I go about filling out my PCI compliance survey?
If the studio has already been registered but not completed the survey, reach out to SaferPayments. SaferPayments has an online platform to manage your account, services, and initiate online chat www.yoursecurejourney.com. They also will provide email and phone support if you prefer, support@yoursecurejourney.com and 1-866-493-8756. Phone support is Monday-Friday 8a.m. to 10 p.m. EST.
26. How does ClubReady ensure the security of club, member, and credit card data?
ClubReady takes the security of club, member, and CC information very seriously. ClubReady follows industry standard security process and protocols, including multiple layers of encryption, role based access control, and web application firewalls.
These process are fully externally audited as part of our SOC and PCI audits which include multiple penetration tests, monthly automated vulnerability scans, and manual internal and external vulnerability assessments. Additionally, we have outside providers who attempt to manually hack the product.
Specific to credit card data, ClubReady is fully PCI Level 1 audited and registered with the payment card brands. This is the highest level of payment card security audit. On the business and engineering process side of things, we are fully SOC1 Type 2 audited.
ClubReady’s PCI Attestation of Compliance, and SOC1 reports are available upon request.
27. Do I need to implement a Content Security Policy (CSP)?
Yes. Clients must implement a Content Security Policy (CSP) if their website interacts with the ClubReady website. This is required to maintain secure communication and align with PCI compliance expectations.
28. Can I request ClubReady’s PCI Attestation of Compliance (AoC)?
Yes. Clients have the right to request ClubReady’s PCI Attestation of Compliance (AoC) as well as redacted penetration testing reports for their compliance documentation.