Paypal PCI Compliance

Question

Should the Omnipay Paypal checkout option be able to pass Paypal's PCI compliance checks?

I have a client with a Paypal account ( although this is a payments pro account ) which has been limited ( cannot withdraw). They wanted to verify the checkout process etc.

I'm using the latest version of CiviCRM and Paypal Checkout via the omnipay extension. It previously used Payments Pro.

I believe that removes the main part of PCI compliance ( everything is handled on their side). However they have come back to the client saying it was a express checkout payment ( Assume they treat 'express checkout' and 'paypal checkout' as the same thing ) and were passed a document after they said they can't validate it.

Has anyone had any experience with Paypal checkout on Civicrm and passing Paypal's new checks?

I'm not sure whether they are trying to validate a website payments pro solution rather than just Paypal checkout?

Thanks in advance for any help, will be very much appreciated.

Answer 1

Only PayPal can tell you the reasons for an account limitation and the steps required to resolve it.

PCI stands for "Payment Card Industry", and is a standards body that Visa and MasterCard and other payment card providers are part of. They created a set of standards that merchants must meet to be compliant. PayPal does not validate, and is not responsible for, merchant's compliance when handling payment card data directly (e.g. credit card for fields on your website). Merchants accounts who do touch credit card numbers directly (e.g. a Pro integration), and are not compliant, are likely to have their accounts deactivated.

But since you seem to be talking about a regular PayPal Express Checkout payment, which would not involve any payment card data external to PayPal's site, your client's PCI compliance is not relevant at all for this type of payment. Something else is going on with regards to it.