PCI PIN v3.1 · Qualified PIN Assessor (QPA)
PCI PIN Security Assessments by a Qualified PIN Assessor
A PCI PIN security assessment checks that PINs, and the cryptographic keys that protect them, are handled securely from the ATM or POS terminal to the host. As a PCI SSC-approved Qualified PIN Assessor (QPA), we assess acquirers, processors and key-injection facilities against the PCI PIN Security Requirements v3.1, and carry out TR-39 audits for US debit networks.
Prefer to talk? Call +44 161 523 5276
- PCI SSC-approved QPA
- Annex A & B (KIF) assessments
- TR-39 audits for EFT networks
Trusted by banks, payment providers and global brands
On this page
Overview
What is a PCI PIN security assessment?
The short answer
A PCI PIN security assessment is an independent review, by a PCI SSC-approved Qualified PIN Assessor (QPA), of how an acquirer, processor or key injection facility protects PINs and the cryptographic keys behind them, tested against the PCI PIN Security Requirements v3.1. The card brands and EFT networks decide who needs one and how often.
We are a Qualified PIN Assessor (QPA) approved by the PCI Security Standards Council, and you can find us on the PCI SSC list of Qualified PIN Assessors. We audit and advise PIN programme participants on the secure management, processing and transmission of PIN data. Sovereign Secure is also a member of the PCI SSC Global Executive Assessor Roundtable (GEAR) for 2026 to 2028.
The PCI PIN Security Requirements are a standalone PCI SSC standard, separate from the PCI PTS device standards (PTS POI and PTS HSM). They apply to acquirers and their agents that process PINs for payment card transactions, and to entities that operate key-injection facilities (KIFs) loading keys into PIN acceptance devices.
Who needs PCI PIN compliance? Acquiring banks and their agents, third-party processors that handle PIN transactions, key-injection facilities, ATM deployers and independent sales organisations (ISOs), and organisations that deploy and manage PIN-accepting POS terminals. The card brands and EFT networks decide who must be assessed and how often. Our page on PCI compliance for banks covers the wider picture for acquiring banks.
The current standard is the PCI PIN Security Requirements and Testing Procedures v3.1, published in March 2021. It supersedes v3.0 and the older v2.0, so if a search turns up the v2.0 PDF, take the current version from the PCI SSC document library before you plan against it. Alongside its core requirements it has normative annexes: Annex A covers symmetric key distribution using asymmetric techniques (remote key loading), and Annex B covers key-injection facilities. Our key injection facility (KIF) audits are built around Annex B.
What the standard asks for. PCI PIN v3.1 groups its 33 requirements under seven PCI PIN control objectives, which our guide explains one by one, and our QPAs test every objective that applies during fieldwork.
We assess every aspect of PIN security during online and offline transactions, at ATMs and at attended and unattended point-of-sale terminals: key generation, key loading, key distribution, hardware security modules (HSMs), device management and the procedures around them.
PTS POI and HSM devices. The PIN standard relies on PCI PTS approved devices. PTS POI devices are the PIN entry devices, such as POS terminals and PIN pads, evaluated under the PCI PIN Transaction Security (PTS) Point of Interaction requirements; PTS HSM covers the hardware security modules that encrypt, translate and verify PINs at the host.
Remote or on-site? Document review, key inventories and many interviews can be done remotely. Key ceremonies, secure rooms and HSM handling are normally observed in person. We have completed PIN audits remotely when circumstances required it, and we agree the right mix with you and, where needed, the brand or network. For acquirers and processors in the Middle East, our guide to PCI PIN assessments in Dubai and the UAE explains how the work runs there.
Cost and frequency. The cost of a PCI PIN assessment depends on the number of sites and secure rooms, the number of key hierarchies and HSMs, whether Annex A or Annex B applies, whether TR-39 work is added, and travel for on-site fieldwork. How often you are assessed is set by each card brand or EFT network, not by the PCI SSC. We give you a fixed quote after scoping: tell us your entity type, sites and HSMs through the enquiry form to start.
PIN assessment is a niche discipline. Our assessors have long experience in cryptographic key management and have trained PIN security practitioners, which is reflected in the feedback from our clients.
What's included
What our PCI PIN assessments cover
- 01
PCI PIN Security assessments
Assessments covering the core technical requirements, Normative Annex A (symmetric key distribution using asymmetric techniques) and Normative Annex B (key-injection facilities).
- 02
Card brand programme assessments
Assessments required by card brands of their direct-connect processing members and their Third Party Agents (TPAs).
- 03
TR-39 audits of ATM operations
ASC X9 TR-39 (formerly TG-3) audits of ATM operations in banks and credit unions, as required by the Star, NYCE and Pulse EFT networks.
- 04
TR-39 audits for PIN debit POS
TR-39 audits of PIN debit point-of-sale transactions for merchants, as required by the EFT networks.
- 05
ISO, ESO and KLD facilities
The subsections of TR-39 that apply to Independent Sales Organisations, Encryption Support Organisations and Key Loading and Distribution facilities.
- 06
Key management consultancy
Help designing key ceremonies, dual control and split knowledge procedures, HSM configuration and key inventories before assessment.
- 07
Key-injection facility (KIF) audits
Annex B assessments of facilities that load keys into POS terminals and PIN pads, plus Annex A where keys are injected remotely.
- 08
PIN readiness review
A pre-assessment gap review against the 33 requirements, so you can fix key management and device issues before the formal assessment.
- 09
Combined PIN and DSS assessments
Processors that need PCI DSS as well as PCI PIN, and card vendors that also need PCI card production audits, can have them assessed by one team on one timeline, cutting duplicate evidence requests.
Core PIN requirements vs Annex A vs Annex B: what applies to you
Every PCI PIN assessment covers the core requirements. The two normative annexes add requirements only if you carry out the activities they cover, so scoping starts by deciding which apply.
| Part of the standard | Who it applies to | What is assessed |
|---|---|---|
| Core requirements (33 requirements in seven control objectives) | Every acquirer, processor and agent in scope of a PCI PIN assessment | How PINs are processed, the full lifecycle of the keys that protect them from generation to destruction, and the HSMs and PIN entry devices used |
| Normative Annex A: symmetric key distribution using asymmetric techniques | Organisations that distribute symmetric keys remotely using public key techniques (remote key loading), including any certification and registration authority they operate for it | Remote key distribution operations, and certification and registration authority operations where you run them |
| Normative Annex B: key-injection facilities | Key-injection facilities (KIFs) that load keys into POS terminals, PIN pads and other PIN acceptance devices, in-house or as a third party | Secure room controls, key loading, dual control and split knowledge, and device inventory and chain of custody |
If you load keys into devices, our Annex B key injection facility assessments page covers that scope in detail.
PCI PIN vs PCI DSS vs TR-39: who needs which
These are three separate assessments. PCI PIN and PCI DSS are PCI SSC standards; TR-39 is a US industry audit that the debit networks require of their members. Many acquirers and processors need more than one.
| Standard | Who it applies to | What is assessed | Who assesses |
|---|---|---|---|
| PCI PIN Security Requirements | Acquirers and their agents that process PIN transactions, third-party processors, key injection facilities, and ATM and POS operators named by the card brands or networks | PINs and the cryptographic keys that protect them, through the key lifecycle, plus the HSMs and PIN entry devices used | A PCI SSC Qualified PIN Assessor (QPA), on a cycle set by each card brand or network |
| PCI DSS | Every merchant and service provider that stores, processes or transmits cardholder data, or can affect its security | Cardholder data and the systems, networks and people around it, across 12 requirements | A QSA for a Report on Compliance, or the business itself through a Self-Assessment Questionnaire |
| ASC X9 TR-39 | Members of US EFT (debit) networks such as Star, NYCE and Pulse, including ATM and PIN debit POS operations | PIN security and key management, against the ASC X9 technical report formerly known as TG-3 | An auditor meeting the network's own rules; a separate audit from a PCI PIN assessment |
We are approved by the PCI SSC as both a QPA and a QSA, so processors that need PCI PIN and PCI DSS can have both planned together; see our PCI DSS audits.
How it works
Our five-step PCI PIN assessment methodology
- 1
Scoping
We confirm the entity type, networks, HSMs, key hierarchy and which annexes apply.
- 2
Documentation review
Key management procedures, key inventories, device logs and HSM configuration are reviewed ahead of fieldwork.
- 3
Fieldwork
Interviews, observation of key ceremonies and secure rooms, and technical testing on-site or remotely where appropriate.
- 4
Reporting
Report on compliance and attestation, with clear findings and remediation guidance.
- 5
Follow-up
We verify corrective actions and support you through brand or network submissions.
Why Sovereign Secure
Why choose Sovereign Secure for your PCI PIN assessment?
Established in 2012, we deliver PCI, ISO and Cyber Essentials work for banks, payment processors, card manufacturers and fast-growing companies.
Read client testimonials →- Approved QPA. The PCI Security Standards Council has approved us to assess PCI PIN security. Verify us on the PCI SSC QPA list.
- Proven with banks and processors. Trusted by financial institutions and payment companies across the US, Europe and Asia.
- Remote-ready. We have completed PIN audits remotely when circumstances required it, without lowering the standard.
- GEAR member 2026 to 2028. Sovereign Secure sits on the PCI SSC Global Executive Assessor Roundtable, the forum where senior leaders of qualified assessor companies give the Council recommendations and input.
- One team for PIN, DSS and card production. Acquirers, processors and card vendors often need more than one PCI standard; we plan them together.
Testimonials
What our clients say
In my tenure as Principal Analyst for First National Bank of Omaha's Key Management and Cryptography program and many more years in the industry, I never realized how easy it could be to work with an assessor, nor the true value they could bring to a PIN security program until I began to work with Azie (Sovereign Secure, Ltd). Azie's knowledge and expertise is beyond reproach, and she truly stands out above and beyond in providing updates and changes in the compliance programs to her clients. Her passion and integrity are evidenced when she comes well prepared, is thorough and works efficiently, resulting in an accurate assessment.
I highly recommend services of Sovereign Secure through my work with Azie Amini; PCI PIN Security audits. I have known Azie for fifteen years and have nothing but positive things to say, regarding her PCI PIN services both in auditing and as a PIN security instructor. We have used her services for various payment companies that I have been employed by including Albertsons Companies.
Approaching our PCI PIN 3.0 audit at the start of a pandemic was an overwhelming goal filled with uncertainties ranging from, “How could we ensure the safety of our employees & auditors?” to “Could this actually be done remotely?” Our colleagues at Sovereign Secure were true partners in this successful venture. While flexing to the distinct needs of an essential business, like ours, running during a pandemic, they stayed true to the high standards required of a business to ensure the PCI PIN 3.0 certification by the use of extraordinary communication, experienced auditors, and unique documentation delivery avenues. They made what was once thought of as impossible, not only very much possible, but also a pleasurable learning & partnership experience for our payment solutions team.
FAQ
Frequently asked questions
Can't find your answer? Call us on +44 161 523 5276 or send us a message.
Who needs a PCI PIN assessment?
Acquirers and their agents that process PIN-based transactions, third-party processors, key-injection facilities and certain ATM and POS operators. In practice that covers banks and credit unions, payment processors, ATM deployers and ISOs. Requirements are set by the card brands and EFT networks, which also decide how often you are assessed.
What does a PCI PIN assessment cover?
PCI PIN v3.1 has 33 requirements in seven control objectives, covering how PINs are processed, the full lifecycle of the keys that protect them and the equipment used; our guide to the PCI PIN Security Requirements explains each one. Annexes A and B add requirements for remote key distribution and key-injection facilities.
What are Annex A and Annex B?
Normative Annex A covers the distribution of symmetric keys using asymmetric techniques (remote key loading). Normative Annex B covers key-injection facilities that load keys into PIN acceptance devices. Whether they apply depends on what your organisation does.
Do you assess key injection facilities?
Yes. We assess key injection facilities, which load cryptographic keys into POS terminals and PIN pads, against Normative Annex B of the PCI PIN standard, plus Annex A where keys are injected remotely. As a P2PE Assessor (Europe and USA) we can also assess a KIF for listing as a P2PE component; see P2PE assessments. Our key injection facility audits page explains the scope.
How often is a PCI PIN assessment required?
There is no single PCI SSC frequency. Each card brand or EFT network sets its own validation cycle, which can differ by entity type. We confirm what applies to you during scoping.
How does a PCI PIN audit differ from a PCI DSS audit?
PCI DSS protects cardholder data and is assessed by a QSA; PCI PIN protects PINs and the keys that encrypt them and is assessed by a QPA. PIN fieldwork focuses on key ceremonies, HSMs, secure rooms and device management rather than the wider IT estate. See our PCI DSS audits if you need both.
Is there a PCI PIN certification?
Not from the PCI SSC, which approves assessors rather than certifying organisations. What buyers call PCI PIN certification is a completed assessment: the QPA’s Report on Compliance and Attestation of Compliance, which the card brands or networks that require it accept as evidence of PCI PIN compliance.
Can PCI PIN assessments be conducted remotely?
Partly. Document review, key inventories and many interviews can be remote, and we have completed PIN audits remotely when circumstances required it. Key ceremonies and secure rooms are normally observed on site; we agree the approach with you and, where needed, the brand or network.
What is TR-39?
TR-39 (formerly TG-3) is the ASC X9 technical report used by US EFT networks such as Star, NYCE and Pulse to audit PIN security and key management for their members, including ATM and PIN debit POS operations.
How long does a PIN assessment take?
It depends on the number of sites, secure rooms and key hierarchies, and whether Annex A, Annex B or TR-39 work is in scope. We agree the fieldwork and reporting timetable at scoping, and good documentation beforehand shortens it considerably.
How much does a PCI PIN assessment cost?
It depends on the number of sites and secure rooms, key hierarchies and HSMs, whether Annex A or Annex B applies, whether TR-39 work is included and travel for on-site fieldwork. We give you a fixed quote after scoping.
Last reviewed October 2026 by the Sovereign Secure assessment team.
Related services
- Key injection facility auditsKey injection facility (KIF) assessments by a PCI SSC Qualified PIN Assessor: PCI PIN Annex B, remote key injection and secure rooms. Get a fixed quote.
- PCI DSS assessmentsPCI compliance audits and PCI assessments by a PCI SSC-approved QSA company: Report on Compliance, AOC and QSA-validated SAQs. Get a fixed quote.
- PCI Card Production auditsPCI Card Production and Provisioning assessments by a PCI SSC-approved CPSA: logical and physical security audits for card manufacturers and personalisers.
- IoT & hardware testingIoT penetration testing and hardware security testing for connected devices and POS terminals: firmware, debug interfaces, radio and cloud APIs. Get a quote.
- PCI compliance costWhat PCI DSS compliance costs in the UK: QSA audit, SAQ, ASV scan and pen test cost drivers, plus a free estimator.
Free consultation
Talk to an assessor
We aim to reply within one working day, and send a fixed quote once your scope is confirmed.
- PCI SSC-approved QSA, QPA, CPSA, P2PE and 3DS assessors
- IASME-licensed Cyber Essentials certification body
- Clients across the UK, US, Europe, Middle East and Asia since 2012
“They made what was once thought of as impossible, not only very much possible, but also a pleasurable learning & partnership experience for our payment solutions team.”
Call +44 161 523 5276
Email [email protected]