PCI DSS and card network assessments
A security standard imposed by payment card networks on anyone handling card data, whose breach triggers contractual penalties that cyber policies cover under a separate item.
PCI DSS is the payment card data security standard, developed by a council founded in 2006 by the major card networks. It binds, by contract rather than by law, any merchant, service provider or institution that stores, processes or transmits card data. Its version 4.0, published in 2022, made several new requirements mandatory from March 31, 2025, including broader multi-factor authentication. When a card data compromise occurs at a non-compliant merchant, the networks impose on its acquiring bank, which passes them on, penalties and reimbursements for fraud and card replacement. These sums are not administrative fines but contractual obligations, which makes them insurable where a fine often is not. Hence a separate cover in cyber policies, for payment card industry fines and assessments, mandated forensic costs and sometimes remediation. For the underwriter, compliance level and transaction volume are direct rating variables.
After the compromise of data from about 40 million cards at the US retailer Target in late 2013, the company reached agreements in 2015 of about 67 million dollars with Visa and 19 million dollars with Mastercard to compensate issuing banks.
PCI DSS, Payment Card Industry Data Security Standard, PCI fines and assessments
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.