PCI Compliance

PCI compliance means that an organisation meets the requirements of the Payment Card Industry Data Security Standard (PCI DSS), the set of technical and operational rules for protecting payment card data. The standard applies to every business that stores, processes or transmits cardholder data, or that could affect the security of such data: merchants of all sizes, processors, gateways, acquirers, issuers and the service providers that support them.

The standard is written by the PCI Security Standards Council, the body created by the major card brands of the payment card industry. It is not a law. Compliance is a contractual obligation: card networks require it of acquirers, and acquirers require it of merchants through the merchant agreement. A few jurisdictions refer to the standard in legislation, and data protection regulators treat it as a benchmark of reasonable security.

PCI DSS is organised into twelve requirements grouped under six goals: building and maintaining secure networks and systems, protecting account data, maintaining a vulnerability management programme, implementing strong access control, regularly monitoring and testing networks, and maintaining an information security policy. In practice this covers firewalls and secure configurations, encryption of card numbers in storage and in transit, anti-malware and patching, restricting access to those who need it, multi-factor authentication, logging, regular testing and staff training.

Some data may never be kept after a transaction is authorized, even encrypted. This sensitive authentication data includes the full contents of the magnetic stripe or chip, the three- or four-digit security code and the PIN. Version 4.0 of the standard was published in 2022 and replaced version 3.2.1 in March 2024, with a number of new requirements becoming mandatory in March 2025. The current version, 4.0.1, is a limited revision published in June 2024.

The requirements apply to the cardholder data environment: the people, processes and systems that handle payment card data, together with anything connected to them. Defining that scope accurately is the first step in any assessment, and reducing it is the most effective way to cut the cost and risk of compliance. Common methods include:

• Outsourcing the payment page. With a hosted checkout or provider-hosted fields, card numbers go straight from the shopper's browser to the payment provider.
• Tokenization. Tokenization replaces stored card numbers with tokens that are useless if stolen.
• Encryption at the terminal. Validated point-to-point encryption encrypts card data inside the reader so that the merchant's tills and network never see it in readable form.
• Network segmentation. Systems that handle card data are isolated from the rest of the corporate network.

Outsourcing reduces scope but not responsibility. The merchant must still confirm that its providers are compliant and manage what remains on its side, such as the web page that loads the payment form.

Every in-scope organisation must comply with all applicable requirements, but how it proves this depends on its PCI level, which is based on annual transaction volume. The largest merchants and service providers undergo an on-site assessment by a Qualified Security Assessor, an independent firm approved by the council, which produces a Report on Compliance. Smaller ones complete a Self-Assessment Questionnaire. There are several versions of the questionnaire, matched to how the business accepts cards, ranging from a short form for merchants that have fully outsourced card handling to a long form covering every requirement.

In both cases the result is summarised in an Attestation of Compliance, which is submitted to the acquirer or card brand, and many organisations must also have their internet-facing systems scanned every quarter by an Approved Scanning Vendor. Validation is annual, but the standard expects controls to operate continuously. Service providers, including a payment facilitator, give their attestation to clients and may be listed on the card brands' registries of compliant providers.

Enforcement runs through the contractual chain. Card brands may fine acquirers whose merchants are not compliant, and acquirers pass these charges on. Many acquirers charge small merchants a monthly non-compliance fee until a questionnaire is filed, in addition to any regular PCI fee for their compliance programme.

The serious costs follow a data breach. A merchant found to have been non-compliant when card data was stolen can face a forensic investigation at its own expense, liability for the issuers' costs of reissuing cards and reimbursing fraud, higher processing fees, reclassification to the top validation level and, in the worst case, loss of the ability to accept cards. Regulators and affected customers may bring separate actions under data protection law.

Compliance at the date of assessment is not the same as security. Several organisations that suffered large breaches had been validated as compliant beforehand, and investigations typically find that controls had lapsed since the assessment. The standard addresses card data only, not other personal information or wider cyber risk, and firms often combine it with broader frameworks or a SOC 2 report. Small merchants find the questionnaires hard to understand, and attackers have shifted toward methods that exploit gaps at the edges of scope, such as malicious scripts injected into checkout pages, the online equivalent of card skimming. Version 4.0 added requirements aimed at that threat.

• PCI Security Standards Council