AusPayNet Audit Services

According to AusPayNet IAC Code Set Volume 1 "All entities involved in either the processing of Interchange PINs and/or Transactions from entry at the Terminal up to and including delivery to the Issuer’s authorisation processor, or involved in the management and security of PINs must adhere to an agreed set of procedures and adopt a common audit process to ensure adherence to those security procedures". Based on this, members and participants of AusPayNet's Payment Systems, Acquirers and Issuers and Third Parties handling PINs may be required to undergo the  AusPayNet Annual Security Audit.

AusPayNet requests that all IA(Issuers and Acquirers) Participants must complete an Annual Security Audit once every calendar year. The result of Annual Security Audit (Annexure A)  must be signed by the IA Participant and countersigned by either an internal or external auditor and submitted to the AusPayNet within six months of the end of the calendar year in which the annual audit was completed.

Holding a PCI PIN Attestation of Compliance (AOC) does not automatically exempt you from the AusPayNet Annual Security Audit.

While the PCI PIN AOC demonstrates compliance with global PCI PIN security standards, it primarily applies to acquiring-related services (e.g., PIN processing and encryption during card-present transactions on the acquiring side). In contrast, AusPayNet’s Annual Security Audit applies to both acquiring and issuing activities within the Australian payments ecosystem.

Entities involved in the processing or management of Interchange PINs — whether on the acquiring or issuing side — must comply with the specific requirements outlined in the AusPayNet IAC Code Set. However, If an acquier Participant who has had a PCI PIN audit completed by a Qualified PIN Assessor (QPA) may meet the security Audit Requirement by completing Annexure A.1 and submitting a duly signed copy of the PCI PIN AoC(s). The PCI PIN audit must have been completed in the same calendar year as the part 1 audit.