PCI Compliance Among Retailers Growing

PCI compliance for the nation's largest retailers hit 77 percent for the end of last year, according to Visa.

In addition, the credit card company said Jan. 22 that compliance among midsize merchants, or Level 2s, also sharply increased, growing to 62 percent.

When Visa last reported PCI compliance figures for the largest retailers, or Level 1s, in late October 2007, that figure was 65 percent. The number has been steadily increasing. In December 2006, for example, Level 1 PCI compliance was at 36 percent.

The new figures also show a sharp improvement for midsize retailers, which jumped from October's 43 percent. Level 2 retailers process between 1 million and 6 million Visa transactions a year.

Visa also reported that the percentage of retailers in both groups that had promised that they were not retaining prohibited data hit 99 percent.

The figures were first revealed in a speech that Jennifer Fischer, a Visa PCI executive, gave to a Los Angeles PCI seminar audience the week of Jan. 14. However, the slides that Fischer used suggest that Visa helped those numbers look stronger by removing from the list some 38 Level 1 retailers that weren't going to make their PCI deadlines and extending their deadlines to Sept. 30, 2008.

There are only 364 Level 1 retailers, which are merchants that process more than 6 million Visa transactions a year. Visa did the same thing for the 1,011 Level 2 retailers, only there it excluded 302 merchants, that were given until Dec. 31, 2008. Were it not for those exclusions, the compliance figures would have both been much lower and would have given a more accurate sense for how many of the nation's largest retailers are truly complying with data security requirements.

For the nation's 2,596 Level 3 merchants -- those whose annual e-commerce transactions number from 20,000 to 1 million -- the compliance level was only 54 percent.

The group that represents the largest percentage of all Visa transactions are Level 1s, which are responsible for half of all Visa transactions. But the second-largest group is the nation's 6 million Level 4s, which process fewer than 1 million transactions a year and are responsible for almost a third (32 percent) of all Visa transactions, the Visa documents said.