banking security
Storing Bank Account Number and Sort-code in the Database
<p>I need to store UK Bank Account Number and Sort Code in my MYSQL database to send the users payments.</p>
<p>The PHP/Laravel site will be hosted on AWS with SSL &amp; off-course the Account Number and Sort Code will be encrypted (Mcrypt) when stored in the Database, in a separate table to the users table.</p>
<p>The end-users will be forced to use the HTTPS version of the site.</p>
<p>My Question: Do I need to be PCI compliant for this? or is there any other law related issues that I need to look into before?</p>
<p>I have been searching all-day and have not found any solid answers hence this post.</p>
<p>Kind regards</p>

<p>It sounds like you're not processing Payment Card data and are not bound by PCI compliance. If you're using BACS Direct Credit systems you need to follow their rules.</p>
<p><a href="https://www.bacs.co.uk/Resources/Pages/GuideAndRules.aspx" rel="nofollow noreferrer">https://www.bacs.co.uk/Resources/Pages/GuideAndRules.aspx</a></p>
<p>The technical information for using BACS systems appears to be available free on registration</p>
<p><a href="https://www.bacs.co.uk/Access/BacsApprovedServices/BacsApprovedSoftwareService/Pages/BacsApprovedSoftwareService.aspx" rel="nofollow noreferrer">https://www.bacs.co.uk/Access/BacsApprovedServices/BacsApprovedSoftwareService/Pages/BacsApprovedSoftwareService.aspx</a></p>
<p>Note that with <a href="https://www.ukfinance.org.uk/confirmation-of-payee#BUSINESS" rel="nofollow noreferrer">Confirmation of Payee</a> being introduced, you may need to store the payee's verification name along with the bank account details; this may then make the bank accounts table liable to GDPR as personally identifiable information.</p>
