What Is Payment Card Industry?

The payment card industry operates a self-regulatory structure: the card brands set rules, a standards council maintains them, and acquiring banks enforce them on the merchants and service providers they contract with.

Understanding that structure matters because it determines who you actually answer to, what validation you must perform, and what happens when something goes wrong. The standard itself is only part of the picture.

Who enforces what

The standards council publishes the requirements and accredits assessors. The card brands set compliance programmes and penalty structures. Your acquiring bank enforces them against you contractually and carries the liability upward.

Which means your practical counterparty is the acquirer. Questions about validation requirements, deadlines and evidence are answered by them rather than by the council.

Merchant levels determine validation

Levels are set by annual transaction volume, with the largest merchants required to undergo an on-site assessment by a qualified assessor producing a formal report on compliance.

Smaller merchants validate through a self-assessment questionnaire and an attestation, with quarterly external scanning by an approved scanning vendor where systems are internet-facing. A breach can move an organisation to a higher validation requirement regardless of volume.

Choosing the right questionnaire

Several questionnaire variants exist, each matched to a payment acceptance method — fully outsourced e-commerce, hosted payment page, terminal with no electronic storage, and so on. They differ enormously in length.

Selecting the wrong one is a common and consequential error, because an attestation against a questionnaire that does not match how you actually take payments is not valid. The acquirer will usually confirm which applies.

Service providers carry their own obligations

Organisations that handle card data on behalf of others, or that can affect the security of a payment transaction, validate as service providers with their own levels and requirements.

That category is broader than it appears: hosting providers, managed service providers, call centres, and increasingly any party whose scripts run on a payment page. Merchants are expected to maintain a list of their service providers and monitor their compliance status.

What happens after a breach

Forensic investigation by an approved investigator is mandatory, paid by the compromised entity, and its findings determine liability for fraud losses, card reissuance and brand penalties.

Compliance status at the time of the breach is what matters, not at the last assessment. An organisation found non-compliant at the moment of compromise faces materially worse consequences, which is the practical argument for continuous rather than annual compliance.

Scripts on payment pages, and the newer requirements

The current standard added explicit expectations around scripts executing on pages that take card details — inventory, authorisation and integrity monitoring — because attacks that skim card data from within the browser bypass every server-side control.

That applies even to organisations using a hosted payment page, where the surrounding page is still theirs. It is one of the requirements most commonly missed by merchants who believed outsourcing the payment form removed their obligations.

Where to start

Confirm with your acquirer which level you are, which questionnaire applies, and when your next attestation is due. Organisations are regularly using the wrong questionnaire without knowing it.

See PCI DSS. GuardsArm delivers PCI DSS 4.0 compliance.