PCI DSS
Payment Card Industry Data Security Standard
PCI DSS is the Payment Card Industry Data Security Standard. It is mandatory under contracts with banks and payment systems for anyone who stores, processes or transmits card data.
What is PCI DSS (Payment Card Industry Data Security Standard)?
## What it is and who maintains it
PCI DSS (Payment Card Industry Data Security Standard) was developed by the PCI Security Standards Council (PCI SSC), founded by the payment systems Visa, Mastercard, American Express, Discover and JCB. The standard sets out technical and organizational requirements for protecting cardholder data: the primary account number (PAN), expiration date, CVV2 and related data.
## How it works
The standard is not a law. Its obligation comes from contracts: the acquirer or PSP includes PCI DSS compliance in its onboarding terms, and the payment systems enforce it through scheme rules. The framework is built around 12 requirements grouped under six control objectives: network security, protection of cardholder data, vulnerability management, access control, monitoring and testing, and information security policy.
## Where it applies in high-risk verticals
In fintech and payments, PCI DSS applies to issuers, processors, PSPs and merchants. In gambling and betting, it is relevant to online casinos and bookmakers that accept card deposits and payouts. A common question here is who is responsible for storing the data: the operator itself or a payment provider using a hosted input page.
## How the scope of requirements depends on architecture
The fewer systems that touch card data, the smaller the audit scope. If card data is entered on the provider's page and never passes through the operator's infrastructure, the operator can use a simplified self-assessment questionnaire (for example, SAQ A). If the operator itself accepts, stores or transmits PANs, the audit scope covers all connected infrastructure and usually requires an external assessment by a Qualified Security Assessor (QSA).
## Common mistakes
Typical problems include logging full card numbers in debug logs, storing CVV after authorization, lack of network segmentation between the payment module and other services, overdue vulnerability scans, and shared administrator accounts. Another frequent error is assuming that a provider's PCI DSS compliance automatically covers the whole store or casino. Responsibility for the operator's own systems stays with the operator.
FAQ
Is PCI DSS mandatory for online casinos and bookmakers?
Formally, it is not a legal requirement but a condition of contracts with the acquirer and payment system rules. If an operator accepts cards directly or through a provider, compliance is usually required, and the scope depends on whether card data touches its systems.
How is PCI DSS different from PCI DSS compliance?
PCI DSS is the standard itself, with its set of requirements. Compliance means confirmed adherence to it: a self-assessment via an SAQ questionnaire or a report from a QSA auditor, along with vulnerability scanning by an ASV.
Can PCI DSS be fully transferred to the payment provider?
Only partly. If card data does not pass through the operator's infrastructure, its obligations are reduced. However, the operator's own website, servers and staff remain its responsibility.