Banks Miss Deadline on PCI DSS Certification

Seven money deposit banks in the country may have missed the November 30 deadline set by the Central Bank of Nigeria (CBN) deadline to acquire Payment Card Industry Data Security Standards (PCIDSS) certification.

PCIDSS is a framework for ensuring that critical information assets are protected from unauthorized access, use, disclosure, disruption, modification, perusal, inspection, recording or destruction.

The PCI DSS was created jointly in 2004 by four major credit-card companies: Visa, MasterCard, Discover and American Express.

The major global payment brands require that every entity including financial institutions as well as merchants and service providers stores, processes, or transmits payment card data, in every channel including catalog and online retailers as well as brick-and-mortar businesses — must be in compliance with the PCI Data Security Standard .

Nigeria CommunicationsWeek investigations revealed that 14 out of 21 banks have complied with PCI DSS and so certified as at last Friday, which means seven banks will miss the deadline.

It was gathered that the banks that missed the deadline are at different stages of implementation of the standard required to secure electronic transaction of customers of the banks.

Oluseyi Akindeinde, chief technical officer, Digital Encode, a company that assist banks and other organisations to achieve PCI DSS, said, PCI DSS is the right security measure that banks need to put in place in order to secure their network against fraud done in internet banking, ATM and Point of Sale terminal (PoS).

Nigeria CommunicationsWeek gathered that the PCI DSS standard specifies twelve requirements for compliance across six control objectives such as- build and maintain a secure network, Install and maintain a firewall configuration to protect cardholder data, prohibition of vendor-supplied defaults for system passwords and other security parameters among others.

Banks that have met the deadline are: Access, Mainstreet, Diamond, FCMB, First Bank, GTB, Keystone, Unity, Stanbic IBTC, Standard Chartered, Sterling, Fidelity, Union, and Wema Bank/

Ahmed Adesanya, IT Security and Connectivity consultant, said that compliance to PCI DSS is must requirement for all involved in e-payment transaction ecosystem.

He noted that achieving PCI DSS guarantee security of all electronic transactions as well as gives the customer the confidence that who he is dealing with is secured.

“PCI DSS compliance is mandatory for banks, merchants and providers that process, transmit or store cardholder data. The risk of noncompliance is substantial, including fines, potential security breaches and loss of business,” he said.