PCI DSS

What the standard governs

The Council names the intended audience of PCI DSS as entities that store, process, or transmit cardholder data and/or sensitive authentication data, or that could impact the security of the cardholder data environment — expressly including merchants, processors, acquirers, issuers and service providers. Volume is not the admission test: the Council states the standard is intended for all entities involved in payment processing regardless of size or transaction volume.

Source: PCI Security Standards Council, “PCI Data Security Standard (PCI DSS)” (intended audience, baseline requirements and compliance-program discretion); PCI Security Standards Council, “Merchant Resources” (Council FAQs on merchant applicability, encryption scope, P2PE and SAQs), accessed 2026-09-04.

Complying and validating are two different obligations

The Council writes the standard but does not run the enforcement program. Each of its founding payment brand members operates its own PCI compliance program, and the Council states that whether an entity is required to comply with or validate compliance to a PCI SSC standard is at the discretion of organizations that manage compliance programs, such as a payment brand, an acquirer, or another entity.

Source: PCI Security Standards Council, “PCI Data Security Standard (PCI DSS)” (intended audience, baseline requirements and compliance-program discretion); PCI Security Standards Council, “Merchant Resources” (Council FAQs on merchant applicability, encryption scope, P2PE and SAQs), accessed 2026-09-04.

Visa’s rules require a Member to ensure that agents and merchants with access to account or transaction information comply with PCI DSS, and to certify that compliance to Visa upon request. A separate rule requires the Member to report and verify its merchants’ PCI DSS compliance status to Visa at least every 6 months, and points to the Account Information Security (AIS) Program Guide for the criteria that set each merchant’s level. Validation levels therefore live in a brand program document, not in PCI DSS itself; ask your acquirer which level it has assigned you.

Source: Visa, “Visa Core Rules and Visa Product and Service Rules” (§1.9.4.1 and §12.5.1.2 “Account and Transaction Information Security Requirements”, edition 18 April 2026; Visa program rules only, with a stated LAC Region (Chile) exception to §12.5.1.2), accessed 2026-09-04.

Values that must not survive authorization

Visa’s rules list data a Member must ensure its agents and merchants do not store once authorization is complete:

• the full contents of any data taken from the magnetic stripe, on a card, in a chip, or elsewhere;
• Card Verification Value 2;
• the PIN or the encrypted PIN block;
• the Token Authentication Verification Value and the Dynamic Token Verification Value;
• the Visa Secure Cardholder Authentication Verification Value produced in 3-D Secure authentication.

Those are Visa’s program rules; other networks publish their own. Because the restriction follows the value rather than the input field, audit where each one can be written outside checkout: logs, exports and support tooling.

Source: Visa, “Visa Core Rules and Visa Product and Service Rules” (§1.9.4.1 “Account and Transaction Information Security Requirements”, edition 18 April 2026; Visa program rules only, stated with no regional exception), accessed 2026-09-04.

Scope reduction: what each step buys, and what it leaves

Read each scope claim narrowly, and record what it leaves behind.

Source: PCI Security Standards Council, “Does PCI DSS apply to merchants who outsource all payment processing operations and never store, process or transmit cardholder data?” (outsourcing responsibility, Requirements 12.8.2 and 12.8.4, and compliance-accepting entities); PCI Security Standards Council, “Merchant Resources” (Council FAQs on merchant applicability, encryption scope, P2PE and SAQs); Stripe, “Integration security guide” (this provider’s statements about its own integrations and API responses), accessed 2026-09-04.

What to hold on file for every provider

Outsourcing shifts work, not accountability. The Council’s FAQ keeps four duties with the merchant: ensure the provider is PCI DSS compliant for the services offered, maintain written agreements in which the provider acknowledges its responsibilities (Requirement 12.8.2), monitor its compliance status at least annually (Requirement 12.8.4), and clearly define the shared responsibilities. Adyen adds the operational form: request the provider’s Attestation of Compliance, check that it is listed on Visa’s Global Registry of Service Providers or Mastercard’s Compliant Service Provider List, and name each provider with its outsourced function in part 2F of your SAQ or AoC.

Source: PCI Security Standards Council, “Does PCI DSS apply to merchants who outsource all payment processing operations and never store, process or transmit cardholder data?” (outsourcing responsibility, Requirements 12.8.2 and 12.8.4, and compliance-accepting entities); Adyen, “PCI DSS compliance guide” (this provider’s guidance for its own merchants, expressly based on Adyen’s risk profile), accessed 2026-09-04.

Treat any provider’s integration-to-questionnaire mapping as that provider’s. Adyen states that its validation requirements per integration type are based on Adyen’s acceptable risk profile and may differ from what other acquirers require, so confirm a mapping published by your payment gateway — or by a payment facilitator handling the relationship — with your acquirer.

Source: Adyen, “PCI DSS compliance guide” (this provider’s guidance for its own merchants, expressly based on Adyen’s risk profile), accessed 2026-09-04.

Check the version before you assess

The sources cited here state no fixed revision calendar, so read the Document Library rather than assume a cycle. It currently features PCI DSS v4.0.1 together with a summary of changes from v4.0 to v4.0.1. Adyen’s guide states that v4.0.1 was released on June 11, 2024, that it replaced v3.2.1, and that a v4.0 document already completed stays valid until it expires — Adyen’s guidance to its own merchants. Adyen and Stripe each describe themselves as a PCI DSS Level 1 service provider assessed annually by an independent Qualified Security Assessor, and each says you must still attest annually.

Source: PCI Security Standards Council, “Document Library” (currently featured PCI DSS version and summary-of-changes document); Adyen, “PCI DSS compliance guide” (this provider’s guidance for its own merchants, expressly based on Adyen’s risk profile); Stripe, “Integration security guide” (this provider’s statements about its own integrations and API responses), accessed 2026-09-04.

The Council tells merchants to confirm their compliance obligations with the organization that manages their compliance program — such as their acquirer or payment brand — which it also calls the compliance-accepting entity. Read merchant account for the relationship behind it, and payment processor for the surrounding roles.

Source: PCI Security Standards Council, “Does PCI DSS apply to merchants who outsource all payment processing operations and never store, process or transmit cardholder data?” (outsourcing responsibility, Requirements 12.8.2 and 12.8.4, and compliance-accepting entities), accessed 2026-09-04.