PCI DSS rRequirement 3.3 states “Maskthat PAN must be masked when displayed (the first six and last four digits are the maximum number of digits to be displayed).” See also the note under PCI DSS requirement 3.3: “This requirement does not apply to employees and other parties such that only personnel with a legitimate business need tocan see the full PAN.  This requirement does not supersede stricter rcovers all displays of PAN, including those on paper reports, computer screens and payment card receipts.

Requirements in place for displays of cardholder data ( 3.3 also includes the following note: “This requirement does not supersede stricter requirements in place for displays of cardholder data “ for example, legal or payment card brand requirements for point-of-sale (POS) receipts).”  It should be noted that the maximum digits allowed per PCI DSS may be different than what is specified in existing regulations.  PCI DSS does not override laws, government regulations, or other legal requirements that govern what can be printed on receipts.  Entities are encouraged to contact their acquirer or the applicable payment brand to determine if any such regulations apply.

Since this requirement coAlso note that any paper receipts receivers all displays ofd and/or stored by merchants that contain PAN, including those on paper reports, computer screens and receipts, the maximum digits allowed per must adhere to applicable PCI DSS may be more than are specified in existing regulations (see FACTA below)requirements, including Requirement 9 regarding physical security. Please note, however, that PCI DSS does not override any other laws that legislate what can be printed on receipts (such as the U.S. Fair and Accurate Credit Transactions Act (FACTA) or any other applicable laws). Also note that any paper receipts stored by merchants for legitimate business reasons and which contain the full PAN must adhere to the PCI DSS, especially Requirement 9 regarding physical security.