Storing the PAN is not a &quot;PCI violation&quot;.
It&#x27;s not best practice, for sure, and you then have an obligation to secure your systems much more thoroughly, but you can do it.
&quot;Payment brand rules allow for the storage of primary account number (PAN), expiration date, cardholder name, and service code.&quot;
<a href="https:&#x2F;&#x2F;www.pcisecuritystandards.org&#x2F;documents&#x2F;SAQ_InstrGuidelines_v3-1.pdf" rel="nofollow">https:&#x2F;&#x2F;www.pcisecuritystandards.org&#x2F;documents&#x2F;SAQ_InstrGuid...</a><p>(There are <i>other</i> types of data you can NEVER store (also described in the above document) like the CVV or PIN code, which is perhaps what you meant.)