Who PCI DSS applies to, and who enforces it
PCI SSC names its audience as all entities involved in payment card processing: merchants, processors, acquirers, issuers and service providers. A payment gateway that handles card data for merchants is a service provider.
PCI SSC writes the standard. Whether an entity must comply, or validate its compliance, is at the discretion of the organisations that manage compliance programmes, such as a payment brand or an acquirer. Visa states that it manages enforcement and validation for Visa card data, and that issuers and acquirers answer for their merchants and service providers.
The PCI DSS version in force
PCI DSS v4.0.1 was published on 11 June 2024 as a limited revision, with no requirements added or deleted. Version 4.0 was retired on 31 December 2024. The requirements that were best practice until a future date took effect on 31 March 2025, and no later version of PCI DSS was listed on 13 October 2026.
PCI DSS levels at Visa and Mastercard
A level sets how an organisation validates compliance. Each brand defines its own, by the number of its transactions a year.
- Merchants, Level 1: more than 6 million of the brand's transactions a year, at Visa and at Mastercard, validated by an annual Report on Compliance (ROC).
- Merchants below Level 1: an annual Self-Assessment Questionnaire (SAQ). Visa lists three merchant levels and Mastercard four.
- Service providers, Visa: Level 1 for a VisaNet processor, or above 300,000 Visa transactions a year.
- Service providers, Mastercard: every third party processor and merchant payment gateway is Level 1, whatever its volume.
- Payment facilitators, Mastercard: Level 1 above 300,000 Mastercard and Maestro transactions a year, Level 2 at or below.
The SAQ types
PCI SSC publishes ten SAQs for v4.0.1: A, A-EP, B, B-IP, C, C-VT, P2PE, SPoC, D for merchants and D for service providers. Each fits one way of handling cards, and the acquirer or the brand decides which one an organisation may use.
SAQ A is for card-not-present merchants whose account data functions are completely outsourced to PCI DSS validated and compliant third parties. Since 31 March 2025, a merchant using SAQ A also confirms that its site is not susceptible to script attacks that could affect its e-commerce systems.
PCI DSS, a licence or a certificate?
- A licence
- PCI DSS is an industry standard, applied through the card brands' programmes and acquirers' contracts. A financial regulator's authorisation is a separate matter.
- A PCI certificate
- Not recognised. PCI SSC's FAQ 1220 states that the only documents recognised for PCI DSS validation are its official forms, among them the ROC, the SAQ and the Attestation of Compliance (AOC).
- A level
- Sets how compliance is validated, by an assessor's report or by self-assessment. A merchant at the lowest level is still required to comply with PCI DSS.
- MPoC
- A PCI standard for a product: software and solutions that take card payments on a phone. PCI DSS applies to the organisation that handles card data.
Where PCI DSS shows up in a platform
Modules that do the work
- CheckoutA hosted checkout for cards, wallets, bank payments and crypto, routed to the best provider.
- Card acquiringCard acceptance on the phone, in store and online, through the acquirer you choose.
- Card issuingVirtual and physical cards, wallets and controls, on the issuer processor you choose.
- Analytics & monitoringProduct analytics, attribution, engagement and crash reports, on a tracking plan you control.
Platforms that need it
Guides that go deeper
- PCI DSS for a payment gateway: scope, levels and how to shrink itWhat PCI DSS v4.0.1 asks of a payment gateway: who sets your validation level, when you need a Report on Compliance from a QSA, and how tokenisation and hosted fields shrink scope.
- SoftPOS certification, explainedWhat it takes for a phone to accept card payments: the PCI standard behind it, card scheme approval, attestation and monitoring, and what a merchant needs on day one.
- How to become a PSP or a payment facilitatorGateway, acquirer, payment facilitator or payment institution: where the licence line falls, how the card schemes register payment facilitators, what merchant KYB demands, and the UK and UAE rules.
- BIN sponsorship: how to launch a card programmeWho does what in a sponsored card programme, what the BIN sponsor, Visa and Mastercard ask of a programme manager, the rules for crypto-linked cards, and where an EMI licence fits.
Where it is written
The laws and standards this page's facts come from.
- PCI SSC, PCI Data Security Standard (PCI DSS)
- PCI SSC, Just Published: PCI DSS v4.0.1, 11 June 2024
- PCI SSC, Document Library: the Self-Assessment Questionnaires for PCI DSS v4.0.1
- Visa, Account Information Security Program and PCI: compliance validation levels
- Mastercard, Site Data Protection Program and PCI: merchant and service provider levels
General information, not legal advice: what applies to you depends on your services and your market.