PTS (PIN Transaction Security)
PCIComplianceHubLast updated
The Council's programme of security requirements and laboratory evaluations for the devices that accept PINs and read cards: PIN entry devices, secure card readers, unattended payment terminals and the hardware security modules behind them. A PTS-approved device appears on the Council's list. Several SAQs turn on it: SAQ B-IP is for merchants using only PTS-approved POI devices, and SAQ P2PE for solutions built from them.
Applies to. No PCI DSS v4.0.1 requirement names PTS; it reaches merchants through the SAQs and Requirement 9. SAQ B-IP and SAQ P2PE are available only where the card-reading devices are PTS-approved, and Requirement 9 asks merchants to keep a list of POI devices, inspect them for tampering or substitution and train staff to spot it, which is easier to evidence when each device has a listed PTS approval number. On the service provider side, HSMs used for PIN processing and key management are approved under the PTS HSM requirements, and the Council's listing is the usual evidence of it.