To help protect cardholder data and meet current credit card security standards, merchants using FullsteamPay through Qvinci RoyaltyHub are required to complete PCI compliance through SecurityMetrics. PCI compliance certification is required for businesses that process credit card transactions.

SecurityMetrics provides the compliance program and questionnaire used to confirm that your business is following the required payment security practices. Completing this process helps ensure your merchant account remains in good standing and avoids non-compliance fees.

What You Need to Do

1. Go to the SecurityMetrics portal: SecurityMetrics Qvinci RoyaltyHub PCI portal.
2. Select Sign up to create your SecurityMetrics online account.
3. From your SecurityMetrics To Do List, select Get Started with PCI A 4.0.1.
4. Complete the SecurityMetrics FastPass scoping tool so SecurityMetrics can determine the correct Self-Assessment Questionnaire for your business.
5. Answer the questionnaire based on how your business accepts, processes, stores, and transmits cardholder data.
6. Submit the questionnaire and complete any additional items SecurityMetrics identifies.

Why PCI Compliance Is Required

PCI compliance is required for any business that processes credit card transactions. Because FullsteamPay is used to process payments through Qvinci RoyaltyHub, merchants must complete the required PCI validation process. This helps confirm that payment data is handled securely and supports ongoing compliance with card brand security standards.

Monthly PCI Program Fee

The SecurityMetrics Compliance Program is included for a minimal monthly fee. This program provides access to the tools needed to complete the PCI questionnaire and maintain your compliance status.

If the PCI questionnaire is not completed, a PCI non-compliance fee may apply. To avoid non-compliance fees, complete the SecurityMetrics questionnaire and any required follow-up items as soon as possible.

- Common Questions -

• Do I have to complete PCI compliance if I already use FullsteamPay?

Yes. PCI compliance is required for businesses that process credit card transactions. Completing the SecurityMetrics questionnaire is part of maintaining your compliance status.

• What if I already have a SecurityMetrics account?

If you already have a SecurityMetrics account, log in and confirm that your current account is connected to the correct merchant profile for Qvinci RoyaltyHub and FullsteamPay. If you are unsure, contact SecurityMetrics support for assistance.

• What if I completed PCI compliance with another vendor?

If you completed PCI compliance through another vendor, you may need to provide proof of compliance or confirm whether that validation can be accepted. SecurityMetrics can help confirm the next steps for your account.

• How should I answer questions about third-party providers?

When the questionnaire asks about third-party providers, answer based on the services your business uses to process, transmit, or store cardholder data. If you are unsure how to answer a question, contact SecurityMetrics support before submitting.

• What if I need my IP address for the questionnaire?

If SecurityMetrics asks for an IP address, provide the IP address associated with the environment used to process payments. If you do not know which IP address to provide, contact your IT provider or SecurityMetrics support for guidance.

**Need Help?**

If you need help completing the SecurityMetrics questionnaire, contact SecurityMetrics support at 1-800-557-4797 or email support@securitymetrics.com.

If you have questions about your Qvinci RoyaltyHub account or FullsteamPay setup, contact your Qvinci support representative.