ISO 9564-1:2017

Financial services - Personal identification number (PIN) management and security - Part 1: Basic principles and requirements for PINs in card-based systems

ISO 9564-1:2017 specifies the basic principles and techniques which provide the minimum security measures required for effective international PIN management. These measures are applicable to those institutions responsible for implementing techniques for the management and protection of PINs during their creation, issuance, usage and deactivation.

ISO 9564-1:2017 is applicable to the management of cardholder PINs for use as a means of cardholder verification in retail banking systems in, notably, automated teller machine (ATM) systems, point-of-sale (POS) terminals, automated fuel dispensers, vending machines, banking kiosks and PIN selection/change systems. It is applicable to issuer and interchange environments.

The provisions of ISO 9564-1:2017 are not intended to cover:

a) PIN management and security in environments where no persistent cryptographic relationship exists between the transaction-origination device and the acquirer, e.g. use of a browser for online shopping (for these environments, see ISO 9564-4);

b) protection of the PIN against loss or intentional misuse by the customer;

c) privacy of non-PIN transaction data;

d) protection of transaction messages against alteration or substitution;

e) protection against replay of the PIN or transaction;

f) specific key management techniques;

g) offline PIN verification used in contactless devices;

h) requirements specifically associated with PIN management as it relates to multi-application functionality in an ICC.

To comply with a standard, you need to quickly understand its issues in order to determine its impact on your activity.

The Requirements department helps you quickly locate within the normative text:
- mandatory clauses to satisfy,
- non-essential but useful clauses to know, such as permissions and recommendations.

The identification of these types of clauses is based on the document “ISO / IEC Directives, Part 2 - Principles and rules of structure and drafting of ISO documents ”as well as on a constantly enriched list of verbal forms.

With Requirements, quickly access the main part of the normative text!

The Redline + service - standards comparator allows you to easily and simply identify major changes between the current standard and its last canceled version.

At a glance, you will be able to identify the additions, deletions or modifications to a text, table, figure and formula.


The Redlines + service is offered to you on the collection of French standards in force, in French language and in HTML and PDF format.

For an overview of the service, click on View a standard in redline format

COBAZ is the simple and effective solution to meet the normative needs related to your activity, in France and abroad.

Available by subscription, CObaz is THE modular solution to compose according to your needs today and tomorrow. Quickly discover CObaz!

Request your free, no-obligation live demo

I discover COBAZ