ISO 9564-1:2017

Overview

ISO 9564-1:2017 - Financial services - Personal Identification Number (PIN) management and security - Part 1 defines the basic principles and minimum security requirements for effective PIN management in card-based systems. The standard covers the PIN life cycle (creation, issuance, activation, entry, transmission, verification, storage, deactivation and disposal) and applies to issuers and interchange environments that support cardholder verification in retail banking channels such as ATMs, POS terminals, fuel dispensers, vending machines, banking kiosks and PIN selection/change systems.

Key topics and technical requirements

• PIN lifecycle protections: Guidance for secure establishment, issuance, activation, change, replacement, deactivation and destruction of PINs to minimize fraud risk.
• PIN handling devices: Security requirements and physical protection for PIN entry devices (PEDs) and integrated circuit (IC) readers, including device characteristics and keypad considerations.
• PIN entry and transmission: Controls for secure PIN entry and for protecting the PIN during transmission to the issuer or to an ICC for offline verification.
• PIN encipherment and PIN blocks: Use of protected PIN block formats (compact and extended formats, including Formats 0–4) and constraints on PIN block translation and journalizing.
• PIN verification modes: Differences between online PIN verification (host-based) and offline PIN verification (card/ICC-based) and related protection measures.
• Operational controls: Recording media handling, oral and telephone PIN controls, storage, mailer handling and secure disposal of sensitive material.
• Scope exclusions: The standard explicitly does not cover browser-based environments without persistent cryptographic relationships (see ISO 9564-4), customer misuse, privacy of non-PIN data, message integrity or replay protection, specific key-management techniques, offline PIN in contactless devices or multi-application ICC specifics.

Practical applications - who uses ISO 9564-1:2017

• Card issuers and payment processors implementing PIN issuance and verification systems
• Acquirers, interchange operators and banks managing PIN flows across networks
• ATM and POS manufacturers, PED vendors and IC reader designers
• Security architects, compliance officers and auditors responsible for retail payment security and fraud mitigation
• Service providers operating PIN selection/change systems, mailer production and secure PIN delivery

Related standards

• ISO 9564-2 (approved encipherment algorithms for PIN protection)
• ISO 9564-4 (PIN security in environments without persistent cryptographic relationships)
• Other retail banking security standards: ISO 11568, ISO 13491 and ISO 16609

By following ISO 9564-1:2017, organizations can align PIN management and PIN security practices with internationally recognized requirements for card-based payment systems, reducing operational risk and fraud exposure.