APRP Industry Standards Flashcards
7 cards from real APRP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 APRP Industry Standards flashcards as text
Which industry standard governs the end-to-end encryption of payment card data from the point of interaction to the acquirer?
Answer: PCI P2PE
PCI Point-to-Point Encryption (P2PE) standard defines requirements for encrypting cardholder data from the point of interaction through decryption at a secure point, reducing PCI DSS scope for merchants.
NACHA's WEB Debit Account Validation Rule requires originators to validate consumer accounts using which method before the first transaction?
Answer: A prenote or commercially reasonable external validation method
NACHA's WEB debit rule requires originators to use a prenote or a commercially reasonable fraud detection method to validate accounts before initiating the first debit.
Under Mastercard's dispute resolution framework (MCDR), what replaced the traditional chargeback and arbitration process?
Answer: The Dispute Resolution Management (DRM) system
Mastercard's Dispute Resolution Management (DRM) system streamlined the process by consolidating dispute stages and automating routing decisions.
Which regulatory framework requires US banks to file a Suspicious Activity Report (SAR) within 30 days of detecting a suspicious transaction?
Answer: Bank Secrecy Act (BSA)
The Bank Secrecy Act (BSA) and its implementing regulations require financial institutions to file SARs within 30 calendar days of initial detection of suspicious activity.
In the context of ACH risk management, what is an 'unauthorized debit' under NACHA rules?
Answer: A debit initiated without a valid authorization from the account holder
An unauthorized debit under NACHA rules is one where the Originator did not obtain proper authorization from the Receiver before initiating the ACH entry.
The CFPB's Prepaid Account Rule (Regulation E) extended protections to prepaid cards, requiring issuers to provide which document before account opening?
Answer: A short-form and long-form fee disclosure
The CFPB Prepaid Rule requires issuers to provide a short-form fee disclosure pre-purchase and a long-form disclosure with all fees and terms.
Under PCI DSS, what is the minimum frequency for running internal vulnerability scans on systems in the cardholder data environment?
Answer: Quarterly
PCI DSS Requirement 11 mandates that internal vulnerability scans be performed at least quarterly and after any significant changes to the network.