Does PCI DSS apply to a small HOA that accepts credit card dues payments?

Yes. PCI DSS applies to any entity that stores, processes, or transmits cardholder data, or whose systems could affect the security of the cardholder data environment, regardless of association size. Ask your payment processor which validation level applies to your transaction volume.

What happens to our accounting data if we switch software or management companies?

Records created for the association are generally treated as belonging to the association, not the vendor holding them. Confirm export format and data return terms in the contract before signing, and confirm any specific state law backing this with your own counsel.

Do we need to validate a resident's bank account before the first ACH dues payment?

Yes. Nacha's operating rules require that first-time online ACH debits from a consumer be validated before the debit is submitted to the ACH system. Ask your payment vendor how it performs this validation.

The systems your board runs day to dayLesson 15 of 22

Academy/Technology

Accounting platforms

What to check before your board signs up for accounting software, so payments stay compliant and your data stays yours.

An accounting platform is the software your board or manager uses to track dues, expenses, budgets, and financial statements. Before adopting one, confirm three things: whether it triggers PCI DSS if it accepts card payments, whether ACH dues debits get validated before the first draw, and who owns the data if you switch vendors later.

What the software actually has to track

At minimum, an association accounting platform keeps a general ledger, tracks dues billed and collected per unit, records vendor invoices and expenses against a budget, and produces the financial statements a board reviews each month. Many platforms also handle bank reconciliation and generate the year-end reports an accountant needs. None of that is unique to associations, but the payment and data questions below are.

Taking card payments pulls the association in too

If owners can pay dues by credit or debit card through the platform or its payment portal, the association is in scope for the Payment Card Industry Data Security Standard (PCI DSS), a security baseline for anyone who stores, processes, or transmits card data, even if the actual card numbers never touch the association's own systems.

"Entities that store, process, or transmit cardholder data (CHD) and/or sensitive authentication data (SAD) or could impact the security of the cardholder data environment (CDE)" must comply, and the standard "provides a baseline of technical and operational requirements designed to protect payment account data."

Source: PCI Data Security Standard (PCI DSS), PCI Security Standards Council

Which specific PCI validation level applies depends on transaction volume and method, and is set by your payment processor or acquiring bank, not by PCI DSS itself. Ask your processor directly which level applies to your association.

ACH dues payments need a validation step first

If the platform collects dues by ACH bank debit, the network operating rules require a validation step before the very first debit from a new resident's account, not just a form the resident fills out once.

"NACHA will enforce a new rule beginning March 2022 that requires that all first-time WEB debits from consumers be validated before submission to the ACH system."

Source: Explanation of Nacha's WEB debit account validation rule, VeriCheck

Ask any payment vendor to describe, in its own words, how it satisfies this validation step before the first debit runs.

Who owns the data when you switch

Accounting records built up over years, ledgers, dues history, vendor payment records, are the association's asset, not the software vendor's or the management company's, even while a vendor is the one hosting them.

"Your homeowners association's funds and documents belong to the board, not to whoever happens to be managing them at the moment."

Source: HOA Management Company Transition Checklist for Boards, RowCal

Whether a specific state statute backs this up, and how strongly, varies by state; confirm the legal backstop, if any, with your own counsel. Either way, negotiate data export format and admin credentials handover into the contract before you sign, not after you decide to leave.

Check yourself

Answer before you read the explanation, recalling it is what makes it stick.

Your association's owner portal lets residents pay dues by credit card through a third party processor. Who has PCI DSS obligations here?

A board sets up online ACH dues payments for the first time. What has to happen before the very first debit goes through?

Your board is evaluating a new accounting platform to replace the current one. What should it confirm before signing?

Sources

PCI Data Security Standard (PCI DSS), PCI Security Standards Council
Explanation of Nacha's WEB debit account validation rule, VeriCheck
HOA Management Company Transition Checklist for Boards, RowCal

Technology

Setting up dues collection next? See how online payments fit into the same compliance picture.

Which PCI validation tier applies to your association, whether your state has a data ownership statute like the one described above, and what your management contract actually says about data return on termination all vary. Check each with your processor, your counsel, and your contract.

Not legal advice

totalHOA Academy is intended to provide general educational information and a practical starting point for understanding community association governance and operations. While we aim to provide useful and accurate information, we do not guarantee that every article is complete, current, or applicable to your specific association or situation.

Nothing in the Academy should be considered legal, financial, tax, accounting, or other professional advice. Laws vary by state, and your association's declaration, CC&Rs, bylaws, rules, policies, and other governing documents may impose different requirements.

Use the information in the Academy at your own discretion. Before making decisions that affect your association, its owners, finances, legal rights, or obligations, review your governing documents and consult an attorney, accountant, or other qualified professional when appropriate.