Who Has to Comply with the PCI DSS?

PCI DSS compliance applies to all organizations that work with cardholder data — no exceptions for size. If your business accepts, stores, or sends card information, the standard applies to you. That includes merchants, service providers, and any third parties supporting payment systems.

Your annual transaction volume determines how detailed your compliance process needs to be. Environment and access to sensitive data affect the technical and operational measures you must enforce.

Merchant Validation Criteria

Merchants are grouped into levels based on how many transactions they process:

• Level 1: Over 6 million transactions — full on-site audit and submission of a Report on Compliance (ROC) plus an Attestation of Compliance (AOC).
• Level 2: 1 to 6 million — self-assessment, quarterly scans, annual penetration test, and AOC.
• Level 3: 20,000 to 1 million (eCommerce) — self-assessment, quarterly scans, and AOC submission.
• Level 4: Under 20,000 (eCommerce) or under 1 million overall — simpler self-assessment, quarterly scans, and AOC.

The more card data you handle, the higher your risk — and the more strict your PCI DSS security measures need to be.

Service Provider Validation Criteria

Service providers are companies that support merchants by handling card data on their behalf, for example, cloud hosts, payment gateways, or fraud detection tools. If they process over 300,000 transactions per year, they must undergo an annual on-site audit by a qualified assessor.

Understanding the PCI DSS meaning is essential here: unlike merchants, they’re also responsible for securing the services they offer to clients, not just their internal systems.

Benefits of PCI DSS Compliance

Complying with PCI DSS lowers risk, safeguards customer data, and supports smooth operations. Beyond security, it can also strengthen your business position.

Customer Trust

When customers know their information is safe, they’re more likely to do business with you. PCI DSS compliance sends a clear signal that you take security seriously.

Competitive Advantage

Many businesses still fall short on compliance. Meeting PCI DSS standards signals trustworthiness — a key factor that can set you apart, especially in a crowded market. It's also a launch-speed advantage: build on a platform that is already PCI DSS Level 1 certified, with 1000+ pre-built integrations and 99.95% uptime behind 20+ years on the market since 2006, and you go live selling under your own brand instead of building compliance infrastructure from scratch.

Business Continuity

Breaches can cause downtime, penalties, and long-term damage. PCI DSS helps reduce that risk by enforcing tight controls, including limits on how long sensitive data is stored — its duration matters.

Penalties for Non-Compliance

The company doesn't necessarily need to be PCI DSS compliant on its own — achieving and maintaining full compliance can be a highly complex and expensive process, especially when it comes to securing infrastructure. Instead, many businesses choose to work with certified third-party payment gateways or processors that are already PCI DSS compliant. By outsourcing payment handling to these providers, companies can still ensure secure transactions and meet regulatory expectations without bearing the full burden of compliance themselves.

Non-compliance comes with consequences. You could face fines from card networks, extra scrutiny from banks, or be cut off from processing payments entirely. Breaches may also lead to lawsuits or investigations. Since full PCI DSS certification can be costly and complex, many businesses rely on certified payment gateways. These providers already meet the standards, allowing secure transactions without maintaining PCI-compliant infrastructure in-house.

PCI DSS 4.0 Requirements in 2026

The standard referenced throughout this article is PCI DSS 4.0.1, the current active version. PCI DSS 3.2.1 was retired on March 31, 2024, and version 4.0.1 (a clarification release over the original 4.0) has been in force since June 2024. The key date for 2026: as of March 31, 2025, all of the standard's "future-dated" requirements — controls that were optional during a transition period — became fully mandatory. That means every organization being assessed today is being held to the complete 4.0.1 requirement set, not the lighter version many companies implemented in 2022–2024.

PCI DSS 4.0.1 organizes its controls into 12 requirements grouped under 6 goals:

What actually changed from the old standard — and what's catching businesses off guard in 2026 assessments — comes down to a handful of new controls:

• Payment page script security (Req. 6.4.3): merchants must now inventory every script that runs on payment pages and verify its integrity, aimed squarely at e-skimming/Magecart-style attacks.
• Payment page tamper monitoring (Req. 11.6.1): a mechanism to detect unauthorized changes to HTTP headers and page content on payment pages.
• Stronger passwords (Req. 8.3.6): minimum password length raised to 12 characters.
• Broader MFA (Req. 8.4.2): multi-factor authentication now applies to all administrative access to the cardholder data environment, not just remote access.
• Customized approach: instead of following prescriptive controls line by line, organizations can now design and document their own control that meets the same security objective — useful for companies with non-standard architectures, but it requires a formal risk analysis to justify.

For merchants and service providers, the practical takeaway is that "PCI compliant" now implicitly means "PCI DSS 4.0.1 compliant" — assessors are validating against the full rule set, and the two controls above (6.4.3 and 11.6.1) are currently the most common gaps found in 2025–2026 assessments. This is also where working with an already-certified payment partner pays off: Payneteasy's infrastructure absorbs these control updates centrally, so merchants on the platform aren't the ones who have to re-architect payment pages every time the standard tightens.