An ATM is the densest concentration of regulated data and physical-security controls a bank ever ships through a logistics chain. A single retired unit holds cardholder data on internal storage, encrypted PIN keys inside its tamper-resistant cryptographic module, deposited check images cached on receipt and scanner subsystems, and the residual cash-handling controls that traveled with it from the branch. ATM decommissioning PCI DSS exposure is not a subset of ordinary IT disposal; it is its own discipline.
This article is the companion to our broader bank branch and trading floor decommissioning guide. Where that piece treats the full branch closure workflow, this one isolates the ATM as the highest-PCI-exposure asset class within it. The destination question is the same one auditors ask: what proves that the cardholder data, the cryptographic keys, and the physical custody of cash-handling components were all severed correctly when the unit left the branch?
Why Does ATM Decommissioning PCI DSS Risk Concentrate So Heavily?
Most retired bank IT touches one or two regulatory domains. An ATM touches several at once.
A PTS-approved ATM in service contains, at minimum: an internal hard drive or solid-state storage running the ATM application stack and caching transaction logs; an Encrypting PIN Pad (EPP) holding the cryptographic keys that secure PIN translation to the acquiring bank; a card reader (often a Secure Card Reader, or SCR) with its own firmware and key material; a check-deposit module that retains scanned image data; a receipt printer with a small log buffer; and a network module that has cached IP addresses, VLAN tags, and connection credentials for the bank’s branch network.
Every one of those subsystems is in scope for PCI DSS Requirements 9.4 (media destruction) and 9.5 (POI device tamper prevention) under the v4.0.1 framework, with the future-dated provisions fully mandatory since March 31, 2025. Unlike a standard branch workstation, where a single sanitization decision covers the whole asset, an ATM requires four to six distinct sanitization decisions per unit: one for the storage media, one for the EPP, one for the SCR, one for any imaging subsystem, and any others the specific model adds.
ITAD’s contribution to the breach landscape is not theoretical. Improperly decommissioned data-bearing assets are implicated in 19% of financial-sector data breaches per the published industry research SureDispose tracks. The Morgan Stanley enforcement record, while a data-center asset reconciliation case rather than ATM-specific, showed how disposal failures compound: cumulative penalties of $161.5 million followed, comprising $60M (OCC, 2020), $35M (SEC, 2022), $6.5M (NY AG, 2022), and approximately $60M from a consumer class-action settlement. The penalty arithmetic for an ATM-driven incident has not been tested at that scale; the exposure surface is materially larger.
Are your ATM disposal procedures documented at the subsystem level? Take the free ITAD Readiness Assessment →
What Does ATM Decommissioning PCI DSS Compliance Require Under v4.0.1?
The relevant text sits in two requirement clusters.
Requirement 9.4.7 governs the destruction of electronic media containing cardholder data. The standard offers two compliant paths: physical destruction (cross-cut shredding, pulverization, or disintegration) sufficient to render reconstruction infeasible, or logical sanitization that renders cardholder data unrecoverable. For ATM internal storage, the practical reading is that physical destruction is the lower-risk path, particularly for legacy magnetic drives where forensic recovery techniques are well established. Cryptographic erase or NIST SP 800-88 Revision 2 Purge-level overwrite is acceptable on self-encrypting drives or solid-state media that natively support the operation, with verification logged.
Requirement 9.5 governs the lifecycle protection of POI (point-of-interaction) devices, which includes ATMs. The PIN Transaction Security (PTS) framework is the operational standard layered on top: a PTS-approved device must be cryptographically zeroized before it leaves merchant control. Zeroization is not the same as sanitization; it is a specific action that wipes the loaded encryption keys from the secure cryptographic module and renders the EPP inert. A drive can be wiped without the EPP being zeroized, and an EPP can be zeroized without the drive being wiped. Both are required, and they are sequenced operations, not a single one.
A common audit failure pattern: the bank’s ITAD program treats the ATM as one device, the vendor sanitizes the hard drive, generates a single Certificate of Destruction, and the EPP is shipped intact. The audit finding is that the cryptographic module left the merchant’s custody loaded.
NIST SP 800-88 Revision 2 (September 2025) is the underlying technical reference for the sanitization actions themselves. Rev 2 deprecated multi-pass overwriting in favor of cryptographic erase and single-pass overwrite for modern media, and aligned with IEEE 2883:2022. ATM decommissioning PCI DSS SOPs that still cite Rev 1 should be migrated; the documentation alignment matters more than the technique change for examiners.
How Does EPP Sanitization Differ From Drive Sanitization?
The EPP is the most distinctive component in this workflow because it cannot be sanitized using general-purpose IT tools.
A standard hard drive accepts NIST 800-88 Clear, Purge, or Destroy actions through software or physical destruction. An EPP is a sealed cryptographic module designed to resist exactly that kind of external access. The keys inside are protected by tamper-evident seals and active anti-tampering circuitry; attempting to open the housing without the manufacturer-approved zeroization sequence triggers the keys to wipe, but it also damages the module in ways that may not satisfy the documentation auditors expect.
The compliant path runs through manufacturer-defined zeroization commands invoked through the ATM application or vendor service software. The command sequence varies by manufacturer (NCR, Diebold Nixdorf, Hyosung, GRG Banking, and others all maintain their own procedures), and the sequence must be executed before the EPP physically separates from the ATM chassis. After zeroization, the EPP can be either physically destroyed or surrendered to the manufacturer’s exchange program; what matters for the audit is that the zeroization timestamp precedes the chain-of-custody handoff.
The Secure Card Reader and any imaging subsystems follow analogous patterns at lower stakes. They typically allow firmware reset through service-mode menus, but the reset clears configuration and does not always purge cached transaction data. The conservative ITAD approach treats the SCR and imaging subsystems as physical-destruction targets unless the manufacturer provides a verified sanitization tool with logged output.
Do your ATM disposal certificates document each subsystem separately? Take the free ITAD Readiness Assessment →
What Documentation and Chain of Custody Do Auditors Expect?
ATM disposition is one of the highest-scrutiny chain-of-custody events in retail banking IT, and the documentation expectations match.
The minimum documentary set an examiner will look for:
- Asset inventory at decommissioning. Serial numbers for the ATM chassis, internal storage media, EPP, SCR, imaging subsystem, and any auxiliary hardware, reconciled to the bank’s IT asset management system before pickup.
- Branch removal log. Dual-signature record (typically branch manager plus removal vendor) capturing the date, time, and condition of the unit at removal. For ATMs in lobby or vestibule installations, this includes confirmation that the cash cassettes were removed by the bank’s cash-handling team in advance of the IT removal team’s arrival; cash and IT travel separately.
- Tamper-evident transport. Sealed shipping configuration with seal numbers logged at branch and at receiving facility. PCI DSS v4.0.1 Requirement 9.5 expects continuous tamper-evident protection from removal through final destruction, and broken or unverifiable seals are an immediate finding.
- EPP zeroization log. Timestamped record of the zeroization command execution, including the operator, the device serial, and the manufacturer-defined verification output. This is the documentation most often missing in ATM disposal reviews.
- Certificate of Sanitization or Destruction per subsystem. Not a single CoD for the whole ATM. Individual certificates for the storage media, the EPP, the SCR, and any other in-scope module. Each certificate must reference the parent ATM serial and the branch of origin so the chain reconciles.
- Witnessed destruction option. For high-sensitivity branches or following a remediation finding, banks may require a designated representative to physically observe the destruction at the vendor’s facility. This is increasingly standard for credit unions and community banks that lack the volume to absorb a residual finding.
The Defensible Asset Disposition Framework that mature financial-services ITAD programs use applies a “blind audit” pattern: the bank’s master inventory is withheld from the destruction vendor, the vendor produces its own count, and the bank reconciles. Discrepancies trigger an equipment hold; nothing is destroyed or remarketed until inventory matches. For ATM disposition, blind audit matters more because the subsystem count multiplies opportunities for items to go unaccounted for.
Where You Stand Matters
An ATM is not equivalent to a teller workstation, a branch server, or even a POS terminal. The PCI DSS exposure profile is materially higher because each unit carries multiple PCI-scoped subsystems, each with its own sanitization protocol, and the failure mode is concentrated rather than distributed: a single missed EPP zeroization can produce the kind of finding that escalates a routine examination into a consent order. ATM decommissioning PCI DSS treatment should be authored and audited as its own SOP, not folded into a generic branch IT disposal procedure.
The banks that get this right tend to share a few traits. Disposal vendor selection is filtered through ATM-specific PTS lifecycle competence, not just generic data destruction certifications. EPP zeroization is verified before chain-of-custody handoff, not after. Subsystem-level certificates of destruction reconcile to the parent ATM serial. And the ATM disposal SOP is reviewed annually against the current PCI DSS version, not the version that was in effect when the SOP was written.
For institutions whose ATM disposition process has not been reviewed since the v4.0.1 future-dated requirements became mandatory in March 2025, the practical first step is a baseline assessment. ATM decommissioning PCI DSS readiness is the kind of program element that examiners surface early in any FFIEC or PCI assessment, and the documentation either exists or it does not.
Ready to assess your organization’s ATM disposal readiness against current PCI DSS expectations? SureDispose’s free assessment evaluates your current practices across cardholder data sanitization, EPP zeroization documentation, and chain-of-custody controls, then connects you with certified providers matched to your requirements. Take the Assessment →
Further reading:
- PCI DSS v4.0.1 official document library
- PCI PIN Transaction Security (PTS) program overview
- NIST SP 800-88 Revision 2: Guidelines for Media Sanitization
- FFIEC IT Examination Handbook: Information Security
SureDispose is an independent advisory platform. We connect organizations with vetted ITAD service providers but do not perform disposition services directly. Providers compensate us for qualified introductions.
This article is educational and reflects SureDispose’s reading of publicly available regulations and enforcement records as of April 30, 2026. It is not legal advice. Regulatory determinations for your organization are the responsibility of your compliance counsel. Specific enforcement actions referenced are summarized from public settlement documents; characterizations are the regulator’s, not SureDispose’s.