Lesson 13 of 13

Payments compliance.

PCI DSS, the self-assessment questionnaires, and the US rules and laws that apply to checkout.

By Nagesh Koritala 11 min read Last verified: November 2026

Lesson 1: Improve the checkout
Lesson 2: The checkout flow
Lesson 3: Authorization
Lesson 4: Payment states
Lesson 5: Capture
Lesson 6: Clearing and settlement
Lesson 7: Cash capture
Lesson 8: Returns and refunds
Lesson 9: Disputes
Lesson 10: Tokens and stored credentials
Lesson 11: Transaction types
Lesson 12: Complete reference
Lesson 13: Payments compliance (this lesson)

All 16 pages in this guide

Checkout sits under more rulebooks than almost any other part of a business. Some are security standards, some are card network rules, some are laws. The work is knowing which apply to you, who checks them, and what each one changes in your checkout.

Here is the US map, from the standard everyone names first to the ones teams forget. If you also sell into Europe or the UK, expect an extra layer: their strong customer authentication and privacy laws.

PCI DSS in one screen

The Payment Card Industry Data Security Standard is set by the PCI Security Standards Council, founded by the card brands. The card brands and your acquirer enforce it. It applies to any business that stores, processes, or transmits card data, and to any system that can affect that data.

Current version

v4.0.1

Published June 2024. Version 3.2.1 retired 31 March 2024. The requirements v4 marked “future-dated” became mandatory on 31 March 2025.

The goal

Shrink the scope

The less card data touches your systems, the less of PCI DSS applies. Hosted fields, tokenization, and P2PE all exist for this.

Never store

Sensitive auth data

Security codes, full stripe or chip data, and PINs may never be kept after authorization, even encrypted. Card numbers may be displayed with at most the first digits (BIN) and last four, unless there is a documented business need.

PCI DSS requirement group	What it asks	Checkout example
1 · 2	Network security controls; secure configurations	Payment servers firewalled; no default passwords
3 · 4	Protect stored account data; encrypt it in transit	Tokens instead of card numbers; TLS on every payment call
5 · 6	Malware protection; secure systems and software	6.4.3: inventory, authorize, and check the integrity of every script on payment pages
7 · 8	Restrict access by need to know; identify and authenticate users	Multi-factor authentication for all administrative and all remote or non-console access into the cardholder data environment
9	Restrict physical access	Terminal inspections for skimmers in stores
10 · 11	Log and monitor; test security regularly	11.6.1: detect unauthorized changes to payment pages; quarterly ASV scans
12	Policies and programs	Incident response plan, vendor management, targeted risk analyses

Which self-assessment questionnaire are you?

Smaller merchants prove compliance with a self-assessment questionnaire (SAQ). Pick how you accept cards to see which one usually applies. Your acquirer makes the final call.

SAQ finder

The SAQ A trap. In January 2025 the Council removed the payment-page script requirements (6.4.3 and 11.6.1, plus the related risk analysis in 12.3.1) from SAQ A. In their place, merchants that embed the provider's payment form, for example in an iframe, must confirm their site is not susceptible to script attacks that could affect the e-commerce system. The Council's FAQ gives two ways to show that: use techniques like those in 6.4.3 and 11.6.1 anyway, or get confirmation from your PCI-compliant payment provider. Merchants that fully redirect shoppers to the provider's page are not covered by this condition. If you embed, someone must be watching the scripts on your checkout.

Merchant levels (Visa's, by annual transactions; other brands are similar): Level 1 over 6 million, validated each year by a Report on Compliance (ROC) from a Qualified Security Assessor (some brands accept a certified internal assessor). Level 2: 1 to 6 million. Level 3: 20,000 to 1 million e-commerce. Level 4: under 20,000 e-commerce or up to 1 million total. Levels 2 to 4 usually file an SAQ. Most merchants submit an Attestation of Compliance (AOC), and externally facing systems usually need quarterly scans by an Approved Scanning Vendor (ASV). For the smallest merchants, the acquirer sets what is required. Your vendors that touch card data (gateway, tokenization, call-center payment tools) must give you their own AOC as service providers.

The full compliance map

Rule or standard	Who sets it	Applies to	What it changes in checkout
PCI security standards
PCI DSS	PCI SSC	Anyone storing, processing, or transmitting card data	Everything above
PCI PTS POI	PCI SSC	Payment terminal makers; merchants must use approved devices	Buy terminals from the approved list
PCI PIN Security	PCI SSC	Anyone handling PINs and their encryption keys	Mostly your processor's job; matters for PIN debit
PCI P2PE	PCI SSC	Point-to-point encryption solutions	A listed P2PE solution can cut in-store PCI scope sharply
PCI MPoC	PCI SSC	Accepting cards on phones and tablets	Governs SoftPOS and Tap to Pay apps. It succeeds SPoC and CPoC, which PCI sunset in 2026 (existing listed solutions stay valid until they expire)
PCI Secure Software Standard & Secure SLC	PCI SSC	Payment software vendors	Replaced PA-DSS, retired in 2022
PCI 3DS Core Security Standard	PCI SSC	Operators of 3-D Secure servers, access control servers, directory servers	Your 3DS provider should hold it
PCI Token Service Providers	PCI SSC	Network token providers	Assurance that the token vault is secured
Card network rules
Visa Core Rules · Mastercard Rules · Amex Merchant Operating Guide (US) or Merchant Regulations · Discover Network Operating Regulations	Each network	Every merchant, through the acquirer contract	Authorization, capture timing, refunds, descriptors, surcharging, disputes
Data security programs (Visa AIS, Mastercard SDP)	Networks	Merchants and service providers	How PCI compliance is validated and reported; penalties after breaches
Stored-credential and subscription rules	Networks	Anyone saving cards or billing on a schedule	Consent, disclosures, CIT/MIT flags, cancellation, trial reminders (lessons 10 and 11)
Monitoring programs (VAMP, ECM, EFM)	Networks	High-fraud or high-dispute merchants	Fines and possible loss of card acceptance (lesson 12)
Surcharging rules	Networks and state law	US merchants adding a card fee	Visa caps surcharges at the lower of 3% or your acceptance cost, Mastercard at 4%; no surcharges on debit or prepaid cards; 30 days' notice to your acquirer (and to Mastercard); clear disclosure; some states restrict or ban it. A pending Visa and Mastercard settlement (preliminarily approved June 2026) may widen surcharging rights, so confirm current rules
EMVCo specifications	EMVCo (owned by the networks)	Chip, contactless, 3-D Secure, tokenization, Click to Pay	3-D Secure 2 is current (version 1 was retired in 2022)
Payment laws and regulations
3-D Secure in the US	Card networks (EMVCo protocol)	Online card payments	Not required by US law. Merchants use it selectively, on risky orders, to shift liability for fraud chargebacks to the issuer. (If you sell to Europe or the UK, their strong customer authentication law makes it mandatory for most payments.)
Regulation II (Durbin)	US Federal Reserve	US debit	Debit fee caps for issuers with $10 billion or more in assets (the current cap was struck down by a federal appeals court in October 2026 and returned to the Federal Reserve); merchant routing choice, including online
Regulation E and Regulation Z (Fair Credit Billing Act)	US CFPB	Consumer debit and credit	Consumer error and billing-dispute rights behind many disputes
ROSCA and state automatic-renewal laws	US Congress and states (California's is among the strictest)	Subscriptions and free trials sold online	Clear terms before billing, express consent, easy cancellation. The FTC's 2024 “click to cancel” rule was vacated by a federal court in July 2025. The FTC began a new rulemaking in March 2026; no replacement rule is in force yet. ROSCA and state laws still apply.
Nacha Operating Rules	Nacha	ACH bank payments	Account validation for online debits, authorization records, return handling, and risk-based fraud monitoring of debits under rules phased in during 2026
Financial crime
AML / KYC / KYB (US Bank Secrecy Act and equivalents)	Governments	Acquirers, payfacs, marketplaces	Merchant onboarding checks; matters most if you pay out to sellers
Sanctions screening (OFAC in the US)	Governments	Every US person and business; enforced by OFAC directly, and screened by banks too	Screen payouts and high-risk orders against sanctions lists
Money transmission licensing	US states, other regulators	Businesses holding or moving money for others	Marketplaces and platforms usually rely on a licensed payment provider
Privacy and accessibility
CCPA/CPRA and other state privacy laws	US states	Personal data, including names, addresses, and device data used for fraud screening	Lawful basis, retention limits, access and deletion requests
ADA · WCAG	US law, applied by courts and the Department of Justice; W3C guidelines	E-commerce checkouts	Keyboard and screen-reader access to every payment step; WCAG 2.1 or 2.2 AA is the usual benchmark
Vendor assurance
SOC 1 · SOC 2 · ISO 27001	AICPA; ISO	Your payment, fraud, and tax vendors	Ask for reports during vendor review, alongside their PCI AOC

A checkout team's compliance checklist

Card data enters only through your provider's hosted fields, page, or wallet sheet. Never log it, never send it through your own APIs.
Keep an inventory of every script on payment pages, with a reason for each, and monitor them for changes.
Store tokens, network transaction IDs, and consent records. Never store security codes.
Collect each vendor's AOC every year. Know your merchant level and file your SAQ or ROC on time.
Flag stored-credential transactions correctly (CIT, MIT, type, original ID).
For subscriptions, show terms before payment, confirm enrollment, send receipts, and make cancellation easy.
Decide when to run 3-D Secure, for example on high-risk orders, to shift fraud liability.
Watch fraud and dispute ratios monthly against network thresholds.
Test the payment flow with a keyboard and a screen reader.

This lesson is an educational overview, not legal advice. Your acquirer, QSA, and legal team decide what applies to your business.

Sources for this guide

Card network rules change. Time limits, fees, and authorization windows here reflect published rules and provider documentation as of late 2026; confirm details with your processor before you build against them.

Sources

Your progress stays on this device.

Follow one order.

A $480 order traced day by day: where the money sits, from the first hold to the refund.

Open follow one order All lessons

Questions about payments? Email me. I read every note.