Issuer

Applies to. Banks and other institutions that put payment cards in cardholders' hands, and the processors and other companies that perform or support issuing on their behalf. Where such an entity stores, processes or transmits account data it is subject to PCI DSS like any other entity, with one addition: 3.3.3 allows issuers and companies supporting issuing services to store sensitive authentication data, but only what a documented issuing business need requires, kept secure and encrypted with strong cryptography.

Example. An issuing processor authorises transactions for several banks and holds the values needed to check card verification codes during authorisation. Under 3.3.3 it must be able to show the assessor a written business justification for keeping that data and demonstrate that it is stored encrypted, rather than relying on the prohibition on storing sensitive authentication data that applies to everyone else.

Limits. The issuer is not the acquirer: the issuer stands behind the cardholder, the acquirer stands behind the merchant. The allowance in 3.3.3 belongs to issuers and their issuing service companies only; a merchant or an ordinary service provider cannot claim an 'issuing need' to keep sensitive authentication data. Being an issuer does not by itself change what else applies: the rest of the standard applies to the issuer's in-scope environment as usual, and how an issuer validates is governed by payment brand rules. An entity that both issues and acquires holds both roles at once.