Also called: PCI PTS, PTS
What PIN Transaction Security is
PIN Transaction Security (PTS) is a set of security requirements for devices and components used in payment transactions. The PTS Point of Interaction (POI) Standard covers the characteristics and management of devices that protect PINs, account data and other sensitive payment-card data where a customer pays. Examples include checkout terminals, PIN pads and ATMs.
PTS requirements address a device’s physical and logical security, as well as how the device is managed. PCI SSC maintains the standards. PTS was formerly called PCI PED. PTS also includes a separate Hardware Security Module (HSM) standard, which addresses the security and lifecycle management of HSMs used in payment activities.
PTS evaluates payment-device security. It does not certify your entire business as PCI compliant.
Who PTS applies to
Manufacturers use PTS requirements when designing, making and transporting devices or components that accept or process PINs. Recognized PTS laboratories evaluate devices against the requirements, and PCI SSC publishes listings of approved devices. That testing applies to the device, not to your whole business or payment environment.
As a merchant, your practical concern is the terminal or PIN pad you deploy. PCI guidance says merchants and service providers should use tested and approved PTS devices or components. The applicable requirements and compliance timeframes can depend on your acquiring financial institution, so confirm those details for your specific equipment.
What it means for your business
A listed PTS device has been evaluated against security requirements for payment equipment. Using approved equipment helps protect PINs and payment data at the point of interaction. It does not, by itself, establish that your business meets PCI DSS requirements. PTS addresses device security; PCI DSS covers broader safeguards for businesses that accept or process payment cards.
PTS is not a transaction fee or interchange category. The PCI SSC materials reviewed do not specify a PTS charge or a standard statement descriptor. If a bill contains a terminal, security or compliance charge, do not assume PTS created it. Look for the exact fee name, amount and billing frequency, then compare it with your equipment or service terms.
What you can actually change
- Check the device listing. Match the make and model of each checkout terminal or PIN pad to PCI SSC’s approved PTS device listings before deploying replacement equipment.
- Confirm your requirements. Ask your acquiring financial institution which device requirements and compliance timeframes apply to your payment setup.
- Separate fees from standards. On an invoice or statement, identify the exact name and frequency of any terminal or security charge. PTS itself does not specify a merchant fee.
Frequently asked questions
Does PTS apply to my business or to terminal manufacturers?
PTS requirements are written for payment devices and their manufacturers. As a merchant, use tested and approved devices, then confirm applicable requirements and timeframes with your acquiring financial institution.
Does a PTS-approved terminal make my business PCI compliant?
No. PTS addresses payment-device security. PCI DSS covers broader requirements for businesses that accept or process payment cards, so an approved terminal alone does not establish PCI DSS compliance.
Is there a PTS fee on my processing statement?
PTS is a device-security standard, not a fee schedule. The PCI SSC materials reviewed do not specify a PTS charge or statement descriptor. Identify the exact line name and billing frequency before treating a charge as a PTS fee.