Latest / The Payments Shed / Ep. 5 - Merchant compliance in a complex world with Aperia Compliance at Money 20/20 USA 2025

Transcript

Ep. 5 - Merchant compliance in a complex world with Aperia Compliance at Money 20/20 USA 2025 · The Payments Shed

• 0:06
  Welcome back to the Payment Shed podcast.
• 0:08
  Today we have Savannah Keys, the director of strategic
• 0:11
  partnerships at Imperial Compliance.
• 0:13
  Savannah, thank you so much for coming on the show.
• 0:16
  Tell us them all about yourself and about Imperial Compliance.
• 0:18
  Yeah. So like I said, or like you
• 0:20
  said, Savannah Keys or the period compliance, I've been in
• 0:24
  the payment space for about the last six years.
• 0:26
  I came from more middleware payments technology, but this
• 0:30
  past year I just entered more of the payments compliance space.
• 0:34
  Aperia Compliance is APCI compliance platform for merchant
• 0:38
  aggregators. So we work with acquirers, Isos,
• 0:42
  banks, really anybody that has merchants under them and we give
• 0:46
  them a white labeled platform that their merchants can go in
• 0:49
  and fill out their PCISAQS. So Level 3 and level 4
• 0:53
  merchants. Amazing.
• 0:54
  Compliance is scary. Compliance is tough.
• 0:58
  Yeah. How should merchants really be
• 0:59
  looking at it? You know, it's interesting
• 1:02
  compliance to a lot of merchants.
• 1:04
  They have no idea what it means when we think about small,
• 1:07
  medium merchants, you know, really those level threes and
• 1:09
  level fours doing their PCI on their own.
• 1:12
  We're talking about small mom and pop shops.
• 1:14
  We're talking about small organizations that don't have
• 1:17
  the time, don't have the resources and and they just
• 1:19
  don't know. So if you're told, hey, sit
• 1:22
  down, you have to fill out this PCI audit or you're going to
• 1:24
  have this big scary non compliance fee.
• 1:27
  A lot of people don't know where to start.
• 1:29
  And then you add and compound the fact that every year it's
• 1:31
  another regulation, another thing on their list.
• 1:34
  So, I mean, it's really tricky, but that's really kind of where
• 1:37
  the creation of our platform started.
• 1:39
  I think a big piece that education is key, right?
• 1:41
  You mentioned there a lot of merchants, they don't understand
• 1:44
  PCIS. They're trying to educate them,
• 1:45
  something they've never really heard of.
• 1:48
  Otherwise they get fined is quite scary, right?
• 1:50
  So not really sure how to react to it.
• 1:52
  Do we think that acquirers and ISIS are doing enough to educate
• 1:55
  their merchants? You know, that's a great
• 1:57
  question. So some are, some aren't, you
• 2:00
  know, let's be really honest. Some just take the route of,
• 2:05
  hey, I gave them a tool, they didn't use it, I'm going to
• 2:08
  charge them a non compliance fee and that's where a lot of their
• 2:11
  revenue comes from. And not saying that's good or
• 2:12
  bad, that's just their viewpoint on it.
• 2:15
  However, we do work with some merchants that really do try and
• 2:19
  ensure that all of their merchants are PCI compliant.
• 2:22
  And then they're also rolling out additional tools that are
• 2:25
  compliance adjacent. So, you know, ADA web compliance
• 2:29
  and privacy is a big deal that is federally recognized now, you
• 2:34
  know, the payment page script monitoring.
• 2:36
  So there are a lot of things that are compliance or federal,
• 2:40
  federally regulated that have come out in the last couple
• 2:43
  years that we're seeing our partners want to get back to
• 2:46
  their merchants. They want to help them not only
• 2:48
  become compliant to avoid that fee, but also give them tools to
• 2:52
  help their business. I've made a good point there.
• 2:55
  It's a revenue stream for most acquirers, right?
• 2:57
  And whether we like it or not, they're making in some cases
• 3:00
  millions of of peace and non compliance fees.
• 3:03
  So it's kind of careful what you wish for.
• 3:05
  We want to, we want to sell our customers to help our customers,
• 3:07
  but we also have revenue that needs to be brought into the
• 3:10
  business, right. It's a difficult balance when we
• 3:13
  talk about regulation technology fraud, it's improving every
• 3:18
  single day. It is what's superior compliance
• 3:21
  doing to try and keep up with how fast the industry is moving.
• 3:24
  Yeah. So one of our most recent
• 3:27
  projects is we will always be a compliance platform.
• 3:30
  However, we are trying to shift how we look at it because that's
• 3:35
  where the industry is going. So PCI compliance, I'm sure you
• 3:39
  and your listeners have heard, but there may not be credit card
• 3:43
  numbers in the future. That doesn't mean compliance
• 3:45
  will go away. I think there will always be
• 3:47
  compliance around the payments piece, but we're really looking
• 3:51
  at how do we marry risk with compliance.
• 3:54
  So we're creating a, a future tool, but think of it as kind of
• 3:57
  like your credit monitoring. So when a merchant logs in, they
• 4:01
  can see how am I stacking up, You know, am I really risky
• 4:06
  because of what my business does and how I process my payments?
• 4:09
  And then their part or their acquirer or processor can say,
• 4:13
  hey, based on your risk, we suggest one, that you become PCI
• 4:17
  compliant. But two, here's data breach
• 4:20
  insurance for you and here's payment page script monitoring
• 4:23
  or website compliance. There's all of these tools that
• 4:26
  we can help provide them based on them specifically.
• 4:31
  Merchant by merchant, right? Everyone's needs are different.
• 4:34
  Yes. Incredible.
• 4:35
  What does the next 12 months look like, do you think, in the
• 4:37
  world of of of compliance? So I think that risk piece is
• 4:41
  really big. So there's a lot happening in
• 4:43
  the industry where people are starting to talk about if a
• 4:46
  merchant becomes PCI compliant, it doesn't protect them from a
• 4:51
  breach. Compliance doesn't equal, you
• 4:54
  know, safe. And so I think you'll see a lot
• 4:58
  of people going more towards Yes BE PCI compliant, but download
• 5:02
  this endpoint protection, Yes BE PCI compliant, but also take
• 5:06
  these other steps to protect your business, especially for
• 5:09
  these small merchants. It sounds like it's you may
• 5:12
  think you're PC on compliant but it doesn't mean you're not open
• 5:15
  to that breach, right? Compliance doesn't equal
• 5:17
  security. Yeah, absolutely.
• 5:19
  Fantastic. So much money 2020 so far for
• 5:22
  you. How's it been today?
• 5:24
  It's been great. You know, I love Money 2020.
• 5:26
  I think this is my favorite show of the year, the energy, the
• 5:29
  people. Yeah, I think this is my fifth
• 5:31
  year coming. So I'm starting to see people on
• 5:34
  the hallway that I'm like, I know you out of this many
• 5:36
  people. That's really cool.
• 5:38
  But there's a lot of great vendors here, and I'm learning a
• 5:41
  lot from everybody. Amazing.
• 5:43
  And last thing, yes, Savan shelf of shame, what grinds your gears
• 5:47
  in payments so we could tell our listeners?
• 5:49
  You know this ones really interesting because I used to
• 5:51
  say this when I entered the payment space and it really
• 5:54
  matched what I was doing at the time.
• 5:58
  But I hate when vendors say set it and forget it, especially in
• 6:02
  the payment space because as you just said it is changing daily.
• 6:05
  So I think anything payments or really even technology related,
• 6:09
  you can't just set it and forget it.
• 6:10
  You constantly have to be on top.
• 6:12
  Of it, I think it's a good point.
• 6:13
  Now I think we can sometimes blame sales people for that,
• 6:15
  right? We just move on to the next one.
• 6:17
  Really good point. So thank you so much for your
• 6:19
  time and have a great event. Yes, likewise.
• 6:22
  Thanks.