PCI Compliance for ISOs: A Guide for 2025

As published in updated documentation in 2022, the PCI Security Standards Council has released new PCI DSS standards for ISO PIN encryption. The requirements and deadlines for ATMs are as follows:

• Phase 1 - Implementation Key Blocks for internal connections and key storage within Service Provider Environments - this would include all applications and databases connected to hardware security modules (HSM) - Effective 1 June 2019
• Phase 2 - Implement Key Blocks for external connections to Associations and Networks - Effective 1 January 2023
• Phase 3 - Implement Key Block to extend to all merchant hosts, point-of-sale (POS) devices and ATMs. (aka EPP hardware, firmware, and software using TR31 "Key Blocks") - Effective 1 January 2025

More information can be found in the PCI document library located at https://www.pcisecuritystandards.org/document_library/.

HYOSUNG | GENMEGA | TRITON

How will your machines be affected? Contact Cash Depot to find out more.

Why Implement?

• Non-compliant ATMs are considered a risk of fraud, brand damage, and loss of revenue
• Implementation could mitigate possible penalties and/or fraud liability. The ISO will ultimately hold the liability for their own ATMs for fraud and data breach; ATM Networks (e.g. Visa, Mastercard) could assess penalties on ISOS and require non-compliant ATMs to be shut down. 
• Failure to implement TR-31 could leave an ATM vulnerable to more attacks and could ultimately result in payment and customer data compromises
• PCI and Networks' (card brands) requirements are intended to improve and enhance security and will change the way encryption keys are protected and managed

Compliance by Manufacturer

In an effort to provide comprehensive information for our partners, Cash Depot has gathered information from top manufacturers as a reference guide.

Hyosung Innovue

Non-Upgradable ATMs