Payment companies and PCI DSS 4.0.1: ready for the assessment

The PCI Security Standards Council develops and maintains the standard. PCI DSS sets a baseline of technical and operational requirements for protecting payment account data. For a company that stores, processes or transmits card data for its clients, it is the shared language with acquirers and card schemes.

The 4.0.1 revision clarified wording and applicability notes, including for issuers. It left the effective date of the new requirements unchanged. In practice, policies written for 3.2.1 need a full rewrite, while documents written for 4.0 only need checking against the clarified wording.

Until 31 March 2025 these requirements were treated as best practice. They are now mandatory, and companies whose last assessment ran under 3.2.1, or under 4.0 without them, see new items in the report.

Payment page scripts

Requirements 6.4.3 and 11.6.1 cover e-commerce: scripts on the payment page must be authorised, checked for integrity and monitored for tampering. If your gateway serves the payment form to merchants, the question reaches both you and them.

Annual scope confirmation

Requirement 12.5.2 introduces an annual scope confirmation exercise. The company documents where card data lives and which systems connect to it before the assessor arrives.

For each requirement we start from what is actually in place and record the gap with a priority and a date.

The PCI SSC states that compliance-accepting entities, typically payment brands and acquirers, determine how merchants and service providers validate and which requirements are assessed. So the first preparation step is a written answer from your acquirer or partner on the format.

What to know about a QSA assessment

An assessor marks a requirement "not applicable" only after confirming it through testing, and documents that confirmation. A weak scope rationale can stretch an assessment: the assessor widens the sample, and systems you did not prepare land in scope.

We map card data flows: where data enters, where it is stored, who reaches it and through what. Then, with your team, we look at what can leave scope: network segmentation, tokenisation, moving storage to a processor, removing stray copies in logs and exports.

Vendors and clouds

Every provider that touches card data or can affect its protection belongs in your risk picture. We collect the list, the split of responsibilities and the compliance confirmations you receive from them.

How we run the preparation

1. A paid 30-minute consultation and a scope letter: systems, dates, fixed price.
2. Gap assessment against 4.0.1 with a plain-language report and a technical annex.
3. Remediation by us or with your team; a person checks every finding.
4. Documents and evidence mapped to requirement numbers.
5. Re-check before the QSA assessment or the SAQ.

A penetration test, if the assessment needs one, is arranged on request with a separate provider. The payment licence and the AML programme sit with our licensing and compliance teams.