Why PCI DSS matters
PCI DSS is the floor for card security. Anyone touching cardholder data — primary account numbers (PANs), cardholder names, expiration dates, service codes, and sensitive authentication data — must comply with the standard set by the card networks. Non-compliance doesn't get you fined by a government; it gets you fined and eventually offboarded by the networks and your merchant acquirer.
How compliance is sized
PCI defines four merchant levels by annual card transaction volume, with Level 1 (largest) requiring an annual on-site Qualified Security Assessor (QSA) report and Levels 2–4 generally able to use Self-Assessment Questionnaires.
The smart move for almost every fintech is scope minimization: design the architecture so cardholder data never enters your systems. Tokenization, point-to-point encryption, and using hosted card-capture iframes from your processor are the standard moves.
Common pitfalls
- Logs that capture PANs. Application logs, debug output, and crash dumps are a classic PCI blow-up.
- "In scope" by mistake. A single internal microservice that touches a PAN drags every adjacent system into scope.
- Stale SAQs. The applicable SAQ depends on your architecture; the wrong SAQ filed is the same as no SAQ.
PCI is a tax on touching card data. The cheapest PCI program is the one where you don't touch the data.