PCI DSS Compliance

All companies that process credit card data must be compliant with the Payment Card Industry Data Security Standards (PCI DSS). This requirement is also applicable to E-commerce merchants who outsource all payment processing to PCI DSS validated third parties, and who have a website that doesn't directly receive cardholder data but can impact the security of the payment transaction.

The steps required to ensure PCI DSS compliance may depend on your PCI compliance level (annual total volume of credit, debit, and prepaid card transactions):

• Level 1: > 6 million transactions
• Level 2: 1 million – 6 million transactions
• Level 3: 20,000 – 1 million transactions
• Level 4: < 20,000 transactions

You can read more about PCI compliance levels here.

To ensure PCI DSS compliance, do the following:

1. If you already have PCI DSS compliance certificate, just submit it to the bank. You don't have to complete the next steps.
2. Complete the steps described in the below table depending on the acquiring method you use.

Acquiring method	Required steps
Pay by Link	None
Redirect integration	Complete the Self-Assessment Questionnaire SAQ A (mandatory for Level 1-3, recommended for Level 4).
Direct payment	Complete the Self-Assessment Questionnaire SAQ D (mandatory for all levels). Complete a quarterly network scan by an Approved Scanning Vendor (ASV). The list of Approved Scanning Vendors can be found here.
Web SDK Core	Complete the Self-Assessment Questionnaire SAQ A-ER (mandatory for all levels). Complete a quarterly network scan by an Approved Scanning Vendor (ASV). The list of Approved Scanning Vendors can be found here.
Web SDK Payment	Complete the Self-Assessment Questionnaire SAQ A (mandatory for Level 1-3, recommended for Level 4).
Mobile SDK Core	Complete the Self-Assessment Questionnaires SAQ A and SAQ D – requirements 6.3, 6.4, 6.5 (mandatory for all levels).
Mobile SDK Payment	Complete the Self-Assessment Questionnaire SAQ A (mandatory for Level 1-3, recommended for Level 4).