Eye on Management: Leadership Change at the PCI Council; Roam Data’s Paull Leaves

The PCI Security Standards Council has hired a former MasterCard Inc. executive as its new general manager to replace the retiring Bob Russo, and point-of-sale terminal maker Ingenico S.A.’s mobile-payment subsidiary Roam Data has a new leader.

Russo, who became the PCI Council’s first general manager in March 2007,about six months after the general-purpose payment card networks created the organization, will retire at year’s end. He’ll be replaced by Stephen W. Orfei, whom the Wakefield, Mass.-based Council hired after a nine-month search, according to a recent news release. Orfei will assume the general-manager position in September before the Council’s annual community meetings in Orlando, Fla., Berlin, Germany, and Sydney, Australia.

Orfei currently is vice president of strategic relationships at consulting firm Arsenal Security Group, according to his LinkedIn profile. Before joining Arsenal in early 2011, he worked at MasterCard for about 13 years in e-commerce and emerging-payment systems.

Neither Orfei nor Russo was available for interviews Thursday.

The PCI Council is charged with overseeing and updating the main Payment Card Industry data-security standard and its related standards governing card software and PIN-accepting devices. As general manager, Russo helped make the term “PCI” one of the most familiar acronyms in the electronic-payments industry, but the nature of his job made him a lightning rod for criticism, especially from merchants. Retailers often decried the PCI standards as complex and costly to comply with.

Critics also noted with irony that the card networks, which actually enforce the PCI standards, would routinely declare that a merchant or processor that had suffered a data breach was out of PCI compliance even if it had passed its most recent annual security audit. Others questioned the Council’s deliberate pace in adjusting the standards to accommodate new channels such as mobile payments.

Through it all, Russo insisted that data security is something merchants, merchant acquirers, and processors, and card issuers need to be thinking about constantly, not just once a year. “LoopPay Inc., a mobile-payment service aimed at consumers. Ingenico first invested in Roam in 2009 and took a controlling stake in 2012.

Roam supplies its half-moon-shaped mobile card readers, which attach to smart phones for mobile acceptance, to such industry players as Groupon Inc. and North American Bancard.

Guerin came to global POS terminal vendor Ingenico in 2012 after four years as owner and chief executive of Corail-Software, a provider of predictive software aimed at determining costs and delays resulting from unanticipated events in complex systems. He is now serving concurrently as chief solutions officer for Ingenico and chief executive at Roam.

Paull came to Roam from Market Platform Dynamics, a Boston-based consulting firm, where he had been advising the company. His payments experience also includes executive positions with merchant processor Worldpay, ATM maker Triton Systems, terminal maker VeriFone, and processor MerchanTec International.