PCI Compliance Services for Payment Platforms: Scope and Responsibilities

PCI DSS v4.0.1: What Applies to Payment Platforms

PCI DSS is the Payment Card Industry Data Security Standard, maintained by the PCI Security Standards Council. It provides technical and operational requirements for protecting payment account data.

PCI DSS scope includes environments that store, process or transmit cardholder data, as well as systems and services that can affect the security of the cardholder data environment. Scope therefore cannot be determined solely by whether an application stores card numbers.

PCI DSS v4.0 was retired on 31 December 2024. PCI DSS v4.0.1 is the current version, and the future-dated requirements introduced in v4.x became effective on 31 March 2025.

PCI DSS addresses payment-data security. It does not guarantee protection from every attack, prevent chargebacks or establish compliance with financial-services or privacy legislation.

The 12 PCI DSS Requirement Areas

PCI DSS groups its requirements into 12 areas. The following is a summary, not a substitute for the standard or an assessment:

1. Establish and maintain appropriate network security controls.
2. Configure system components securely.
3. Protect account data retained in storage.
4. Use strong cryptography when transmitting cardholder data over open, public networks.
5. Maintain defences against malicious software.
6. Build and maintain systems and software securely.
7. Limit access according to business need.
8. Identify system users and authenticate their access.
9. Control physical access to cardholder data.
10. Record and monitor access to systems and cardholder data.
11. Perform regular security testing.
12. Maintain security policies, responsibilities and supporting programmes.

Validating PCI DSS Compliance

PCI DSS validation involves assessment documents and, where required, qualified assessors and scanning vendors. These serve different purposes:

• Self-Assessment Questionnaire (SAQ). A validation tool for eligible merchants and service providers. All eligibility criteria for the selected SAQ must be met. SAQ D for Service Providers is the only SAQ available to eligible service providers; merchant SAQs must not be applied to them.
• Qualified Security Assessor (QSA). A PCI SSC-qualified assessor who evaluates the applicable controls. Where required by the compliance programme, the assessment is documented in a Report on Compliance (ROC), accompanied by an Attestation of Compliance (AOC).
• Approved Scanning Vendor (ASV). A qualified vendor that performs external vulnerability scans. Where applicable, passing scans are required at least once every three months. A passing scan does not demonstrate compliance with the entire standard.

Confirm your validation method, reporting frequency and required documents with the organisation managing your compliance programme, such as the relevant acquirer or payment brand.

Merchant and Service Provider Validation

Merchant and service-provider validation criteria differ. Payment-brand programmes define their own levels and reporting obligations, so merchant transaction thresholds should not be applied automatically to payment platforms.

First establish whether your organisation acts as a merchant, service provider or both. Then confirm the required assessment and reporting route. Transaction volume, services provided and programme rules can affect the validation requirements.

Using an assessed provider does not transfer its compliance status to your business. Review the provider’s current AOC, the assessed services and the controls assigned to each party.

Payment platforms can shrink the PCI audit scope and keep their own acquirers.

Why PCI DSS Compliance Matters to Payment Platforms

For payment platforms, PCI DSS compliance supports cardholder data security, acquiring-partner due diligence and the management of third-party payment infrastructure. When evaluating PCI compliance services, consider how they support these operational needs and which responsibilities remain with your team.

Stronger Protection for Payment Account Data

PCI DSS brings together access controls, secure configurations, vulnerability management and security testing. Applying these controls helps payment platforms address weaknesses in how cardholder data is stored, processed and transmitted. Documented data flows also help teams identify where sensitive information enters systems, logs and third-party services.

Clearer Evidence for Acquiring Partners and Customers

Acquiring banks and business customers may request evidence of PCI DSS compliance during onboarding or periodic reviews. Current assessment documents help them understand which services and environments have been assessed. An Attestation of Compliance (AOC), supported by an accurate description of scope, provides a basis for these checks.

Opportunities to Reduce PCI DSS Scope

Hosted payment collection and appropriately implemented tokenisation can reduce the number of systems exposed to raw card data. Depending on the architecture, this may reduce the controls and assessment work applicable to parts of the customer’s environment. The benefit depends on data flows, system connections and the remaining security responsibilities.

Better Oversight of Payment Service Providers

A PCI DSS compliance programme helps payment platforms document which controls they manage and which depend on external providers. Reviewing providers’ compliance status and agreeing shared responsibilities can reveal gaps before an assessment or integration change.

These benefits depend on the implementation and ongoing maintenance of applicable controls. Using assessed payment infrastructure does not automatically establish the customer’s own compliance.

How to Maintain PCI DSS Compliance?

PCI DSS compliance requires ongoing security controls and supporting evidence. For payment platforms, maintaining compliance includes:

• Confirming PCI DSS scope at the intervals required for the organisation’s role and after significant changes.
• Maintaining applicable security controls and documenting their operation.
• Completing annual validation through the assessment and reporting route required by the compliance programme.
• Performing vulnerability scans, security testing and remediation according to the applicable requirements.
• Maintaining security-awareness training and incident-response procedures.
• Reviewing third-party providers’ compliance status at least annually and documenting shared responsibilities.
• Performing targeted risk analyses where required by PCI DSS.

SAQ eligibility must be confirmed rather than assumed. Eligible service providers use SAQ D for Service Providers; organisations required to undergo a ROC assessment must follow that reporting route.

Consequences of Non-Compliance

Non-compliance or a payment-data breach can lead to remediation requirements, investigations, contractual assessments or restrictions on card acceptance. The consequences depend on the payment-brand programme, acquiring agreement and circumstances of the incident.

A breach may also create separate obligations under applicable data-protection law. Incident-related costs and liability should therefore be evaluated against the relevant contracts and legislation, rather than presented as a universal fixed amount.

How Integration Choices Affect PCI DSS Scope

Assessment effort and cost depend on your role, card-data flows, existing controls and required validation method. There is no universal cost or launch timeline.

Hosted payment collection and appropriately implemented tokenisation can reduce exposure to raw card data and may reduce PCI DSS scope. The effect depends on the complete architecture, including connected systems and components that can affect payment-data security.

Before integration, establish which systems handle card data, which provider services are covered by its assessment and which controls remain your responsibility. Using a PCI DSS-compliant gateway does not make your company compliant automatically.

How Can Payneteasy Contribute to Your PCI DSS Compliance?

Payneteasy is a payment technology platform, not a bank, acquirer or payment facilitator. It provides gateway and orchestration technology without providing merchant accounts or assuming clients’ settlement risk.

Payneteasy’s published assessment summary records an assessment of compliance with PCI DSS v4.0.1 for Payneteasy Technologies Limited, in the Level 1 Service Provider category, validated on 18 April 2026. See the PCI DSS compliance information and request the current AOC to confirm the assessed services and scope.

The PCI DSS Service Provider category concerns payment-data security; it is not a financial-services licence. Clients remain responsible for their own applicable controls and compliance validation.