The Visa PIN Security Program Guide is a guide that describes the security and procedural requirements of acquirers or their agents, covering the processing of PIN data or key management for PINs associated with Visa transactions.
This program guide applies to the following Visa Inc. operating regions: Asia Pacific (AP), Canada, Central and Eastern Europe, Middle East and Africa (CEMEA), Europe, Latin America and the Caribbean (LAC), and the United States (US).
You can access the document at the link below.
Key controls in the guide
The basic principles of PIN security are clear: a PIN must never be transmitted in clear text, keys must be managed under the principles of dual control and split knowledge, and devices that process PINs must consist of approved hardware.
The guide also covers the processes of key generation, distribution and destruction, the protection of PIN entry on ATM and POS devices, and audit logs. Compliance is usually carried out together with certifications such as PCI PIN.
Acquirers and service providers may face additional audits or sanctions in case of non-compliance.
