Aconite PIN Manager is primarily a solution for electronic capture and distribution of PINs through digital channels – web and mobile banking, SMS and IVR – those that are increasingly used by banks and card issuers to communicate with customers. Aconite PIN Manager can optionally also support secure PIN storage, PIN generation and PIN verification.

ePIN capture supports both customer self-select during the card ordering process and PIN change (including EMV® Offline PIN*) after issuance. ePIN distribution can support initial notification of a randomly-chosen PIN for a new card, or PIN reminders in case of forgotten PIN.

APM connectivity options

APM connectivity options

Aconite PIN Manager (APM) integrates with existing infrastructure through web services APIs and can also support XML file-based interfaces – for bulk PIN import, for example. Depending on the implementation options selected, APM will interface with card management systems, web and mobile banking servers, SMS gateways, IVR servers, authorization systems and core banking systems. APM also integrates with Aconite’s card issuance solution to inject PINs into the card personalization process.

Web and Mobile Banking

Aconite Technology provides an API that enables mobile banking app and website designers to implement the security protocols developed by Aconite’s cryptography experts. These ensure that PIN data is always encrypted in transmission, is never associated with card data and is protected within the insecure browser domain. With the Aconite API, designers can develop PIN capture and display features that maintain the issuer’s user experience (UX) but use Aconite technologies to guarantee security.

An alternative to the API is provided by a JavaScript widget that can be used in a browser-based web channel to invoke an on-screen Virtual PIN Pad™ that in addition to utilizing the Aconite security protocol, implements extra security features to prevent key logging and screen-scraping attacks.

The Aconite PIN Manager capture and display processes meet the highest security standards demanded by PCI, card payment schemes and national standards organizations, such as UK Cards.


APM can deliver PINs to mobile phones via SMS messages, and in conjunction with web banking, IVR or call center, supports out-of-band verification (using one-time-passcodes) as required by payment card schemes.

IVR systems can implement the Aconite API as described above to provide PIN capture and notification functions.

PIN Storage, Generation and Verification

APM can be implemented as the system of record for PINs. Storing PIN data in APM’s PIN Vault™ rather than in a Card Management System, for example, helps those existing systems to achieve PCI compliance while ensuring that strong encryption and aliasing techniques are used to protect stored PINs. 

Where self-select PIN is not provided on initial card issuance, APM supports the generation of PINs both individually on demand or in bulk batches. APM will then allow the subsequent change of PIN through ePIN capture.

PINs in the PIN Vault can be used for verification purposes during transaction processing or for cardholder identification. An API call for verification is provided.

Contact us for more in-depth information on Aconite PIN Manager or click here to download
Aconite's PIN Manager Solution Paper.


*EMV Offline PIN change requires integration with Aconite Technology's Transaction Management solution – details here.