Frequently Asked Question
![](https://www.pcisecuritystandards.org/wp-content/uploads/2022/03/FAQs-alt.jpg)
Is there an exception to P2PE Requirement 3B-3.1 that a merchant cannot view full PAN, for those areas where there is a legal or regulatory obligation to print the full PAN on merchant receipts?
This is a Technical FAQ for P2PE versions 1.x. This is a "normative" FAQ that is considered to be part of the P2PE requirements and shall be considered during a P2PE assessment in the same light as the published P2PE standard. These technical FAQs are also published together in "Technical FAQs for use with P2PE Versions 1.x" available in the Documents Library of this website.
This topic is addressed in P2PE v2.0. First, to clarify, it is not the intention for PCI SSC's standards to supersede local or regional laws, government regulations, or other legal requirements. Our answer is for P2PE versions 1.x and provides an exception ONLY where there is a legal or regulatory obligation in place to print the full PAN on merchant receipts. Where such a legal or regulatory obligation exists, P2PE requirements may still be met as follows (note that this exception applies only to PAN and never applies to SAD):
This topic is addressed in P2PE v2.0. First, to clarify, it is not the intention for PCI SSC's standards to supersede local or regional laws, government regulations, or other legal requirements. Our answer is for P2PE versions 1.x and provides an exception ONLY where there is a legal or regulatory obligation in place to print the full PAN on merchant receipts. Where such a legal or regulatory obligation exists, P2PE requirements may still be met as follows (note that this exception applies only to PAN and never applies to SAD):
- SRED passes the clear-text PAN to an application that transmits the PAN internally within the device for printing. Since this application sees clear-text PAN, it must be assessed to Domain 2 and listed on the PCI SSC website.
- The application can only transmit clear-text PAN to an integrated printer—this printer is part of the PCI-approved POI device itself and is not attached via cabling or other networking mechanisms. This application cannot transmit PAN to any other device, process, or system.
- After completion of printing, the application securely deletes the clear-text PAN, and the device completes the SRED encryption of the account data for transmission to the processor.
- The merchant needs to protect paper receipts in accordance with PCI DSS Requirements 9.5—9.8.
- Merchants are allowed to view PANs printed on receipts in these markets.
September 2015
Article Number: 1350
Related
-
What is the completion date for PCI DSS assessments documented in a Report on Compliance and its related Attestations of Compliance?
-
What is the completion date for PCI DSS assessments documented in a Self-Assessment Questionnaire and its related Attestations of Compliance?
-
How does PCI DSS Requirement 6.4.3 apply to 3DS scripts called from a merchant check-out page as part of 3DS processing?
Featured FAQ Articles
Featured
-
Do PCI DSS requirements for keyed cryptographic hashing apply to previously hashed PANs?
-
Is the PCI DSS Attestation of Compliance intended to be shared?
-
How does an entity report the results of a PCI DSS assessment for new requirements that are noted in PCI DSS as best practices until a future date?
-
Where do I direct questions about complying with PCI standards?
-
Can SAQ eligibility criteria be used for determining applicability of PCI DSS requirements for assessments documented in a Report on Compliance?
Most Popular
-
What is the completion date for PCI DSS assessments documented in a Report on Compliance and its related Attestations of Compliance?
-
What is the completion date for PCI DSS assessments documented in a Self-Assessment Questionnaire and its related Attestations of Compliance?
-
How does PCI DSS Requirement 6.4.3 apply to 3DS scripts called from a merchant check-out page as part of 3DS processing?
-
What is the scope of a PCI DSS assessment for service providers that can impact the security of payment account data, if the service provider does not directly store, process, or transmit payment account data?
-
Does PCI DSS apply to service providers that can impact the security of payment account data, if the service provider does not directly store, process, or transmit payment account data?
Most Recently Updated
-
What is the completion date for PCI DSS assessments documented in a Report on Compliance and its related Attestations of Compliance?
-
What is the completion date for PCI DSS assessments documented in a Self-Assessment Questionnaire and its related Attestations of Compliance?
-
How does PCI DSS Requirement 6.4.3 apply to 3DS scripts called from a merchant check-out page as part of 3DS processing?
-
Is the expectation that any PFI investigation initiated must result in a PFI Final Report?
-
Can a PFI Company perform subsequent PFI investigations for the same entity?