Transaction Authorization

Applies to. No PCI DSS v4.0.1 requirement defines authorisation, but it is the pivot of Requirement 3: sensitive authentication data, meaning full track or chip data, the card verification code and the PIN or PIN block, may be held only until the issuer's authorisation response arrives and must not be stored afterwards even if encrypted, while the PAN may be kept after authorisation only for a documented business need and then only rendered unreadable. Requirement 3 also asks for retention limits and secure deletion of any stored account data, and Requirement 4 covers the PAN while the authorisation request crosses open networks. The authorisation exchange itself, between the merchant's system, the acquirer or processor and the issuer, is outside the standard, which governs the account data in it rather than the decision.