In its communication, ExxonMobil said POS devices that the oil company has designated "end of life" (G-SITE, Ruby without Sapphire, Omni 3300) must be upgraded or replaced by certified devices (Nucleus, Passport, Ruby Sapphire, Allied Pinnacle, Allied Retalix, Vx570) by December 31, 2010.[image-nocss]
The July 1 deadline on personal identification number (PIN) pads for debit transactions to be VISA-PED (PIN entry device) or PCI-PED compliant was pushed even further back to match the revised deadlines of August 1, 2012, which is the current deadline for in-pump, triple data encryption standard (Triple DES) upgrades.
The note went on to say that POS devices not declared "end of life" and that do not meet PCI requirements must be upgraded by Aug. 1, 2012.
Visa appears to be working in similar ways with the other major oil companies and their processing networks. Gray Taylor, head PCATS, the c-store standards body which was integrated last month into NACS, said a NACS-PCI special interest group had notified Visa of industry challenges and each oil company worked with Visa to determine an appropriate schedule delay. "Virtually all oils have a delay granted from Visa," Taylor told CSP Daily News.
In its statement to wholesalers, ExxonMobil officials said the company "provided to Visa, on behalf of all its retailers, a summary plan for completing the upgrades. ExxonMobil must also report progress quarterly. Now that equipment and software is available from the POS vendors, it is imperative that all branded wholesalers continue with site upgrades and make regular progress."
The statement went on to say that failure to demonstrate "appropriate progress" may result in fines or penalties from Visa, which may be passed on to branded wholesalers. In addition, Visa reserves the right to require removal of non-certified devices from the network if appropriate progress is not achieved.
ExxonMobil, in the statement, said it is evaluating its position for sites that are not PCI compliant and may assess additional fees until compliance is met. "It continues to be [the retailer's] responsibility to ensure cardholder data, including paper documents [receipts, reports, journal tapes, etc.], is protected," the statement said. "In the event of a breach, [the retailer] continues to be responsible for card-data related losses that occur at [their] location."
Just as this article went to press, officials with ExxonMobil confirmed its negotiations with Visa and the deadline changes noted in its communications to branded wholesalers.
An Idaho retailer, who spoke on condition of anonymity, said he's not surprised. He recently had a talk with his area fuel representative, where the retailer mentioned his impatience over not yet receiving the necessary "patch" required to achieve compliance. The representative said that if the retailer did achieve compliance by the deadline, he'd be the only one in the district to do so.
[Editor's Note: For more PCI talk, check out CSP magazine's May 2010 cover story and for ongoing discussion, join the C-TechGroup at MyCStoreWorld.com.]
Members help make our journalism possible. Become a CSP member today and unlock exclusive benefits, including unlimited access to all of our content. Sign up here.