PCI DSS Compliance: What Merchants Need to Know
PCI DSS compliance means meeting the 12 security requirements the Payment Card Industry Data Security Standard sets for any business that stores, processes, or transmits card data. Since March 2025, every business accepting cards has to meet the current version, PCI DSS v4.0.1, or face processor fines and higher fraud exposure.
Across the merchants we've helped set up chargeback alerts, the messiest disputes almost always have a compliance gap underneath. An unencrypted card field, a vendor with standing access nobody revoked, logs nobody's watching.
By the end of this guide you'll know which level applies to you, what compliance costs, and how to check it yourself.
Key takeaways
- Payment Card Industry Data Security Standard compliance is mandatory for every business accepting cards.
- Meet version 4.0.1, the only active version since March 31, 2025.
- Budget $1,000 a year at the small end, $200,000 at the largest.
- Your merchant level comes from annual transaction volume, and a breach can override it.
- Verify with a Self-Assessment Questionnaire, or a Qualified Security Assessor audit.
- A card-data breach turns straight into fraud-driven chargebacks.
Worried about the disputes that follow a breach? Catch them early with our dispute alerts.
What is PCI DSS compliance?
PCI DSS compliance means meeting the Payment Card Industry Data Security Standard's 12 requirements for protecting card data. Any business that stores, processes, or transmits that data is bound by it, whatever its size.
The requirements cover network security, data protection, access control, monitoring, and written policy.
The PCI Security Standards Council writes and updates the standard. Visa, Mastercard, American Express, Discover, and JCB founded that council. Those card networks enforce the standard through your merchant agreement.
Your acquiring bank passes the obligation to you in your contract. So the force behind it is contract law.
One date matters more than the rest. Every v4.0 requirement became mandatory on March 31, 2025, per Varonis. Any guide that still describes v3.2.1 is out of date.
Who needs PCI DSS compliance?
Every business that stores, processes, or transmits cardholder data needs PCI DSS compliance. The standard applies at every revenue level, from a one-person store to a global retailer.
Size changes how much work compliance takes. A merchant on a fully hosted checkout still has to validate, but the form is short.
Your obligation turns on one question. Does card data touch your systems at all? A business paid only through a PayPal balance transfer sits outside the standard. The same business processing cards through PayPal does not.
Most merchants underestimate what counts as touching. Taking a card number over the phone, keeping one in an email inbox, or storing one in a spreadsheet all put you in scope, even without a checkout page.
Can I do PCI compliance myself?
Most merchants can complete PCI DSS compliance themselves using a Self-Assessment Questionnaire, and only the largest merchants have to bring in an outside assessor. The questionnaire is a form you answer and send to your acquiring bank.
Doing it yourself works when your setup is simple and your answers are honest. You still need quarterly network scans from an Approved Scanning Vendor if you have internet-facing systems in scope. That scan is the one piece you can't run yourself.
Honest is the operative word. You're attesting to controls you may have to prove later. A questionnaire that claims a control you never built protects you from nothing once investigators arrive.
How much does PCI DSS compliance cost?
PCI DSS compliance costs about $1,000 to $3,200 a year on a hosted checkout, and up to $200,000 for a Level 1 audit, per Paytia.
The spread comes down to which validation path you're on.
Cost tracks the questionnaire type that applies to you, and it jumps again when an assessor has to come on site.
A short questionnaire means fewer controls to prove, fewer scans to run, and fewer staff hours gathering evidence. A full audit means an assessor tests your environment directly for weeks.
Here's what the two ends of the range look like in practice:
Those figures buy you the validation itself.
They leave out what it costs to fix whatever the assessment finds. If you're starting from a weak setup, the repair bill for new encryption tooling and network segmentation work can run higher than the assessment fee.
Weigh that cost against what a breach-driven chargeback spike would run you. Our ROI calculator puts a number on the disputes compliance work is meant to head off.
What are the 12 requirements of PCI DSS?
PCI DSS v4.0.1's 12 requirements group into six control objectives, split by what part of your card environment each one protects. The six objectives break down like this:
- Build and maintain a secure network and systems covers your firewalls and system configuration.
- Protect account data covers encryption at rest and in transit.
- Maintain a vulnerability management program covers malware defenses and patching.
- Implement strong access control measures covers who can reach card data.
- Monitor and test networks regularly covers logging and testing.
- Maintain an information security policy covers the written rules your staff follow.
1. Build and maintain a secure network and systems
This objective requires a firewall configuration that protects cardholder data and system passwords that aren't the vendor defaults. Requirements 1 and 2 are in this objective.
The default-password rule catches more merchants than the firewall rule does.
Shipped credentials on a router, a database, or a payment terminal are public knowledge, so leaving one in place hands an attacker the front door. Change every one of them before the device touches card data, and check your payment terminals first.
Authenticating the cardholder at checkout is a different job, and 3D Secure is the control that handles it.
2. Protect account data
This objective requires you to protect stored account data and encrypt it whenever it crosses an open network. v4.0.1 widened the language from cardholder data to account data. That pulls sensitive authentication data more clearly into scope.
Storage is where merchants get caught. After a charge clears, you can never keep the full stripe data, the card security code, or the PIN. That holds even if you encrypt them.
For anything you are allowed to keep, credit card encryption makes the stored value useless to anyone who lifts it.
3. Maintain a vulnerability management program
This objective requires anti-malware protection on your systems and a patching process that closes known vulnerabilities. Requirements 5 and 6 are in this objective.
Critical patches carry a one-month deadline under the standard, so schedule patching monthly. Custom software you build yourself falls under the same requirement as software you buy.
The scope trips people up. It covers every system that touches your card environment, so an old admin plugin on your marketing site counts if that server can reach your payment systems. Map what connects to what before you decide a machine is out of scope.
4. Implement strong access control measures
This objective limits card-data access to the people whose job needs it, gives each of them a unique ID, and restricts physical access too. Requirements 7 through 9 are in this objective.
Unique IDs matter most here. Shared logins make it impossible to tell who touched what, which breaks your logging before you reach the monitoring requirement. Pull your user list every quarter and revoke every vendor account whose project has ended.
Physical access counts as access. A back-office terminal anyone can walk up to, or a drawer of printed order records, sits in scope the same way a database does.
5. Monitor and test networks regularly
This objective requires you to log all access to card data and to test your security controls on a schedule. Requirements 10 and 11 cover it.
Logging matters more than most merchants expect.
Review your access logs weekly for logins outside business hours, and for any account touching card data that isn't on your access list.
Testing is the other half. That means quarterly scans by an Approved Scanning Vendor, plus an annual penetration test if you're in scope for one. A failed scan isn't a fine on its own, though you do have to fix what it finds and rescan until it passes.
6. Maintain an information security policy
This objective requires a written security policy your staff read, acknowledge, and are trained on annually. Requirement 12 is the only one in this objective.
Policy sounds like the easy requirement, and it's the one that makes the other 11 stick. It names an owner for each control and sets your incident-response steps before you need them. It also covers the third-party providers handling card data for you.
Write down which provider handles what. When a breach involves a vendor, the first question your acquiring bank asks is which of you was responsible for the control that failed.
How do I verify I'm PCI DSS compliant?
Most merchants verify with a Self-Assessment Questionnaire, while Level 1 merchants need a Qualified Security Assessor's Report on Compliance. Both get filed with your acquiring bank.
Which questionnaire you use comes down to how card data moves through your business. There are several types (A, A-EP, B-IP, and D among them), and each asks about the controls that fit that setup. Your architecture decides the type.
Take the two most common cases.
A merchant on Shopify or Stripe Checkout, where card data never touches their own servers, usually qualifies for SAQ A, the shortest form. A merchant with a custom checkout that handles raw card numbers needs SAQ D, which runs to hundreds of questions.
Your scope can change without you noticing.
A support agent pastes a card number into a chat tool. Card data has now landed somewhere it shouldn't. That can push you into a stricter questionnaire, or cost you the short one entirely.
What happens if you're not PCI DSS compliant?
Non-compliance exposes you to card-network fines, commonly described as running from four figures to six figures a month. Card networks don't publish an exact fine schedule, so treat that range as a rough order of magnitude, not a quote.
The fine scales with how bad the gap is and how long it runs.
Your acquiring bank is contractually liable to the networks for your compliance, so the bank pays the penalty and passes it down to you. The remediation work usually comes with it.
Breach investigations show what tends to be missing. Of all the breached companies Verizon has looked at, none was fully compliant on the day it was hit.
Verizon also found that 91.9% of companies assessed after a breach were failing requirement 10. That's the one covering how you track and monitor access. The control most of them were missing is the one that would have shown them the break-in.
Fines are the visible cost, and a breach costs you more in chargebacks than in fines.
What are the PCI DSS compliance levels?
PCI DSS sorts merchants into four levels by annual card transaction volume, per basistheory.com. Level 1 sits above 6 million a year, and Level 4 below 20,000 e-commerce transactions. Your level sets your validation path.
Volume decides your level, and revenue never enters the calculation. If you accept several card brands, the network with the strictest applicable threshold classifies you. A single major breach can move you to Level 1 no matter what your volume was before:
Each card network sets its own thresholds. According to Basistheory.com, Visa and Mastercard agree at the Level 1 line of 6 million transactions, but their middle tiers differ. Check each network you accept rather than assuming one level covers you everywhere.
What is a PCI DSS audit?
A PCI DSS audit, formally a Report on Compliance, is an assessment by a Qualified Security Assessor who tests your environment against all 12 requirements. The assessor files the report with your acquiring bank. It's the Level 1 validation path.
The assessor checks it all first-hand. They read your network diagrams, sample your systems, talk to your staff, and test controls directly.
That's why an audit takes weeks and costs far more than a questionnaire.
Preparation is most of the work. Assessors ask for evidence you either have on file or you don't. Gather your network diagrams, access lists, and scan reports before the engagement starts.
An audit finding isn't the end of the process either. Open findings give you a window to fix them. Miss the network's deadline and you face the same fines as a merchant who never validated at all.
What are the pros and cons of PCI DSS?
PCI DSS cuts your breach and fraud exposure, and it costs small merchants real money and staff hours to prove something their processor already largely handles. Both are true at once.
What you get:
- Lower risk of a card-data breach through your own systems.
- A concrete security baseline to build against.
- Contractual cover if a breach investigation looks at your controls.
What it costs you:
- Annual validation work that recurs whether or not anything changed.
- Staff hours from people who aren't security specialists.
- Scanning and assessment fees that don't scale down to your size.
Small merchants carry the heaviest burden.
A Level 4 merchant's questionnaire still takes real hours to answer honestly. A small store feels that fixed cost far more than an enterprise with a compliance team.
How do you become PCI DSS compliant?
Becoming PCI DSS compliant starts with finding your merchant level and questionnaire type, then closing the gaps that questionnaire finds. Most gaps are in network segmentation, encryption of stored card data, and access logging.
Here's the sequence:
- Confirm your level by pulling your annual e-commerce transaction count, per card brand, from your processor dashboard.
- Identify your questionnaire type by asking your acquiring bank which SAQ applies to your setup.
- Complete the questionnaire honestly, marking every control you can't currently prove.
- Close each gap by changing the configuration the questionnaire flagged, starting with default passwords and stored card data, then run an Approved Scanning Vendor scan.
- Submit your attestation to your acquiring bank and set a calendar reminder for next year.
Vendor choice is what keeps Level 4 compliance in the low thousands instead of the tens of thousands.
The one change that helps most is getting card data off your servers. Switch to a hosted checkout or a payment gateway that uses tokenization, such as Stripe or Braintree, and you can move from SAQ D to SAQ A.
Our guide on encryption versus tokenization covers which one fits which part of your stack.
That path assumes you haven't already built a custom payment stack. A custom payment stack facing a full SAQ D or a QSA audit needs a security consultant. The cost figures above reflect that gap.
How does PCI DSS compliance affect chargebacks?
A compliance gap that leads to a card-data breach produces a wave of fraud-driven chargebacks. Every exposed card number becomes usable for purchases the real cardholder will dispute. The breach and the disputes are the same event, separated by a few weeks.
The damage compounds from there. Card networks watch merchants whose fraud-driven dispute ratios climb. Visa's Visa Acquirer Monitoring Program folded the older Visa programs into one set of thresholds.
Cross a threshold and you enter a chargeback monitoring program, which brings monthly fines and higher processing costs.
Your chargeback rate is the number those programs measure you on. Compliance only covers your side of the chain, so it can't stop a chargeback from a card stolen at a different merchant and used at yours.
That second half is what we handle. We send alerts from Ethoca and Verifi the moment a cardholder disputes a charge. We then refund it before it turns into a chargeback.
FAQ
What are the 6 major principles of PCI DSS?
The six are a secure network, safe account data, patched systems, tight access control, network monitoring, and a written policy. All 12 requirements spread across those six.
Is PCI DSS compliance legally required?
PCI DSS is a contract term the card networks enforce through your merchant agreement. Breaking it costs you fines and processing rights rather than criminal charges.
Does Stripe or Shopify make me PCI compliant?
No. A compliant provider shrinks your scope and can win you the shortest questionnaire, but you still validate your own compliance every year.
How do PCI DSS, PCI PIN, and PCI P2PE differ?
PCI DSS covers card data across your whole setup, while PCI PIN covers PIN handling at the terminal and PCI P2PE covers certified point-to-point encryption. Most e-commerce merchants only need PCI DSS.
