Definition
PCI compliance refers to adherence to the Payment Card Industry Data Security Standard (PCI DSS), a set of security requirements established by the major card networks to protect cardholder data and reduce payment card fraud. Any business that accepts, processes, stores, or transmits credit or debit card information is required to comply.
The 12 PCI DSS Requirements
The PCI DSS is maintained by the PCI Security Standards Council and is structured around 12 core requirements covering network security, cardholder data protection, vulnerability management, access controls, monitoring, and information security policies. The current version is PCI DSS 4.0, which introduced a more outcomes-based approach compared to previous versions.
PCI Compliance Levels
Compliance levels are tiered based on transaction volume. Level 1 merchants processing more than 6 million card transactions per year face the most rigorous requirements, including an annual on-site audit by a Qualified Security Assessor (QSA) and quarterly network scans. Smaller merchants at Levels 2 through 4 can self-assess using a Self-Assessment Questionnaire (SAQ).
Consequences of Non-Compliance
The consequences of non-compliance or a data breach can be significant. Card schemes can impose fines on acquiring banks, which typically pass those costs to the merchant. Fines can range from $5,000 to $100,000 per month depending on the severity of the non-compliance. A data breach that results from non-compliance can also expose the business to fraud losses and reputational damage.
PCI Compliance for Small Businesses and Tokenisation
For most small to medium businesses, the most practical path to compliance involves using PCI DSS-validated payment solutions. Relying on a payment processor that handles card data in their own compliant environment dramatically reduces the compliance burden.
Tokenisation is a technology commonly used in compliant payment environments. It replaces actual card numbers with a randomly generated token that has no exploitable value outside the specific payment system. Even if a merchant’s system is compromised, tokenised data cannot be used to process fraudulent transactions.