PCI DSS
The Payment Card Industry Data Security Standard is a comprehensive set of security requirements established by the PCI Security Standards Council for all entities that store, process, or transmit cardholder data.
PCI DSS was created in 2004 by the five major card brands (Visa, Mastercard, American Express, Discover, and JCB) and is now managed by the PCI Security Standards Council, an independent body formed in 2006. Compliance is a contractual obligation required by card brands rather than a legal requirement, but failure to comply can result in fines, increased transaction fees, and loss of card acceptance privileges.
The standard organizes requirements into 12 specific areas covering six control objectives: building and maintaining a secure network, protecting cardholder data, maintaining a vulnerability management program, implementing strong access control measures, regularly monitoring and testing networks, and maintaining an information security policy.
Compliance validation requirements depend on annual transaction volume. Merchants processing over 6 million transactions annually (Level 1) require an annual onsite security audit by a Qualified Security Assessor. Merchants processing between 1-6 million transactions annually (Level 2) must complete an annual Self-Assessment Questionnaire and quarterly network scans. Smaller merchants (Levels 3 and 4) have similar SAQ and scanning requirements, though specific validation requirements may vary by acquiring bank.
Related Content
Optimize Your Payment Processing
Let Verisave analyze your merchant statement to identify hidden fees and misconfigurations related to pci dss.
Get a Free AuditRelated Terms
3D Secure
An authentication protocol for online card transactions that adds an additional verification layer between the cardholder and issuing bank, shifting fraud liability from merchants to card issuers when properly implemented.
ACH Payment
Automated Clearing House payment is an electronic bank-to-bank payment method that transfers funds directly between bank accounts through the ACH network, typically used for direct deposits, bill payments, and recurring transactions.
Acquirer
A financial institution that processes credit card payments on behalf of merchants, maintains merchant accounts, and facilitates the settlement of funds from card-issuing banks to merchant bank accounts.
Address Verification Service (AVS)
A fraud prevention tool that compares the numeric portions of a billing address provided during a transaction against the address registered with the card-issuing bank, returning match result codes to help merchants assess transaction risk.
Aggregator
A payment service provider that enables multiple merchants to process card transactions under a single master merchant account rather than each merchant having their own dedicated merchant account, common with services like Square, Stripe, and PayPal.