What Is PCI Compliance? Who Sets It, Who Enforces It

Who writes the rule

PCI stands for Payment Card Industry, and the rule is the PCI Data Security Standard, PCI DSS. It is not a law. It is the card brands' own rulebook, written down by a body they set up for the job: “The Council was founded in 2006 by American Express, Discover, JCB International, MasterCard and Visa Inc.” Those founding members “share equally in ownership, governance, and execution of the organization's work,” and each one “incorporates the PCI Data Security Standard (PCI DSS) as part of the technical requirements for their respective data security compliance programs.”

So when your bank says you must be PCI compliant, it is passing on a condition of taking those brands' cards. You are in it because you take them: the Council's glossary defines a merchant as “any entity that accepts payment cards bearing the logos of any PCI SSC Participating Payment Brand as payment for goods and/or services.” Size does not get you out. In the Council's words, PCI DSS is for “all entities involved in payment processing, including merchants, regardless of their size or transaction volume.”

The version in force is v4.0.1. The Council published it in June 2024 as “a limited revision” with “no additional or deleted requirements.” PCI DSS v4.0 was retired on 31 December 2024. Since then v4.0.1 is “the only active version of the standard supported by PCI SSC.” Each requirement breaks into many smaller ones, and which of them reach you depends on how you take cards; the PCI DSS 4.0.1 requirements for small merchants guide walks them in plain words.

Who enforces it: the brands, through your acquirer

The Council writes the standard and stops there. It says so itself, in one sentence worth knowing by heart:

Each card brand runs its own compliance program, and that program decides “which entities need to validate compliance, validation levels, whether an entity is eligible to complete a Self-Assessment Questionnaire (SAQ) or must complete a Report on Compliance (ROC), and any fines or penalties.” Visa puts the split plainly: the Council “owns, maintains and manages the PCI DSS and all its supporting documents; however, Visa manages all data security compliance enforcement and validation initiatives.”

The brands do not phone a corner shop. They reach you through your acquirer, the bank behind your card processing (the glossary: “Also referred to as ‘merchant bank,’ ‘acquiring bank,’ or ‘acquiring financial institution.’”). Visa's rule for them: “Acquirers must ensure that their merchants validate at the appropriate level and obtain the required compliance validation documentation from their merchants.”

That is why your acquirer is the one asking. Your acquirer assigns your merchant level from your yearly card volume for each card brand. Visa, Mastercard and Discover set their own thresholds; ask your acquirer which level you are. The merchant level calculator shows how volume per brand turns into a level before you ask.

The Council's own advice to small merchants points the same way: “Whether a small merchant is required to validate compliance is determined by the individual payment brands. For questions regarding compliance validation and reporting requirements, merchants should contact their acquirer (merchant bank) or payment brand they do business with, as applicable.”

What a small shop actually does each year

Being compliant and proving it are two different jobs. The first never stops: Visa's rules say “A service provider and merchant must always maintain full compliance.” The second is paperwork on a cycle, because Visa's programs require “that participants demonstrate compliance on a regular basis.” Your acquirer sets the date. Processors that spell the cycle out call it yearly; Braintree tells its merchants “You are still required to complete an annual SAQ.”

Step one decides the size of everything after it. A Self-Assessment Questionnaire is the “Reporting tool used to document self-assessment results from an entity's PCI DSS assessment,” and the Council publishes one per way of taking cards. The receipt below is the usual match; tap your line to open its checklist.

Each form has eligibility criteria the short line above cannot hold. Before you start an SAQ, confirm with the organization you submit it to (usually your acquirer, the merchant bank) that you are eligible for it. The SAQ type finder asks the eligibility questions one at a time, and PCI SAQ types explained shows how each form differs from the next.

The last step is the one people forget to finish. The Attestation of Compliance is “the official PCI SSC form for merchants and service providers to attest to the results of a PCI DSS assessment, as documented in a Self-Assessment Questionnaire (SAQ) or Report on Compliance (ROC).” You sign it, and so does the QSA company if one was involved. Bigger merchants get the second route: depending on the card brands' programs, an entity either has a detailed assessment documented in a Report on Compliance or self-assesses with an SAQ. The step-by-step guide to becoming PCI compliant takes the loop one step at a time.

What “PCI compliant” means, and what it does not

“PCI compliant” is not a badge the Council hands out. It means two things at once: the way you take cards meets every requirement on your SAQ all year round, and you hold signed paperwork for the current cycle. The Council is blunt that the second part is not its call: “PCI SSC does not define compliance requirements for any organization or set compliance validation responsibilities … Compliance validation requirements are set by brands, acquirers, payment facilitators, etc.”

Most of what goes wrong for small shops starts with one of the beliefs below. Each is checked against the documents.

What happens if you skip it

Nobody from the Council will chase you. The cost of skipping arrives through the same chain as the rule. A PCI non-compliance fee on a merchant statement comes from the acquirer or processor under its card-brand program, never from the PCI Security Standards Council. Up the chain, Visa's rules say that if a merchant does not comply, “Visa may assess a non-compliance assessment to the issuer or acquirer,” and that the issuer or acquirer “must not represent that Visa has imposed any assessment on the service provider or merchant.” How much your acquirer charges is set by your acquirer, not by the standard. American Express publishes its own merchant non-compliance fees in its Data Security Operating Policy.

The bigger cost is a breach. Requirement 12.10.1 expects an incident response plan that “exists and is ready to be activated,” with roles and contacts that include notifying the payment brands and acquirers. A shop without one finds out who to call, and in what order, on the worst day to learn it. The incident response plan template gives you the sections to fill in.

Who answers which question

Half the confusion about PCI is asking the wrong party. Pick the question you have; the receipt names who owns the answer, shows the document that says so, and gives you a sentence to send.

PCI compliance on one receipt