I hoping someone in the know (like Andy, John, or another techie ) can answer my questions about PCI Standards. I gleaned some information about PCI from one of Andy's old security blog entries, and it seems like these standards pertain to merchants and service providers.

Do banks have to meet these standards too? My bank offers merchant credit card services through a correspondent bank relationship with FNBO. FNBO now wants to amend our contract to state that my bank meets all PCI Standards. I'm not liking it one bit. I'd rather state we comply with GLBA only. We are concerned that they are trying to make us responsible for our merchant customer's PCI efforts (or lack thereof).

Any thoughts?

I am not the expert on this that you'd want to bank on. I would assume (danger, danger, we know what that word means) that some of these rules apply to banks as we have terminals for credit cards, data, etc. I would also assume your V/MC rep could better answer this and direct you.

If you participate in any part of the card transaction stream, you need to be PCI or could face stiff penalties if any type of breach of card data occurs.

Below are some websites:
http://www.pcisecuritystandards.org
http://www.visa.com/cisp