PCI DSS
Payment Card Industry Data Security StandardAuth & security
The mandatory security standard governing storage, processing, and transmission of cardholder data. Compliance level depends on annual transaction volume; at the highest level (Level 1, 6M+ Visa transactions) merchants must complete an annual on-site audit. Tokenization reduces the scope of compliance.
In practice.
PCI DSS scope is the first technical question in most underwriting conversations. Merchants who keep card data out of their own systems, through hosted fields or tokenization, can usually self-assess with a short questionnaire, while touching PANs directly means audits and real cost. Descope first, then integrate.
Related terms: PAN · Tokenization · CVV
Auth & security