18+ --:--:-- UTC

PCI DSS

Payment Card Industry Data Security Standardissuer PCI Security Standards Council (PCI SSC)version v4.0.1verified 2026-08-03Current · 94%

PCI DSS is the security standard that protects payment-card (cardholder) data across the payments stack. It is maintained by the PCI Security Standards Council and mandated contractually by the major card brands for any organisation that stores, processes or transmits cardholder data. In iGaming it governs the deposit and withdrawal flows: operators and their payment providers must secure the cardholder-data environment, protecting the primary account number (PAN) and sensitive authentication data against breach and fraud.

Current version

Payments security

v4.0.1

What it covers

Building and maintaining secure networks and systems (firewalls, secure configurations)Protecting stored cardholder data and encrypting data in transitMaintaining a vulnerability management programme (anti-malware, secure development)Implementing strong access control measures (need-to-know, unique IDs, MFA)Regularly monitoring and testing networks (logging, scanning, penetration testing)Maintaining an information security policyCustomised and defined implementation approaches to validation

Applies to

iGaming operators that store, process or transmit cardholder dataPayment service providers and payment gateways in the gambling stackMerchants accepting card deposits and processing card withdrawalsAny entity in the cardholder-data environment (CDE)

Compare PCI DSS head-to-head

vs ISO/IEC 27001

Key facts

IssuerPCI Security Standards Council (PCI SSC)
CategoryPayments security
Where it’s usedGlobal; a contractual card-brand mandate (Visa, Mastercard, American Express, Discover, JCB) rather than a law, applied wherever card data is handled.
Current versionPCI DSS v4.0.1Published 11 June 2024 as a limited revision of v4.0; corrects errors and clarifies intent with no new or removed requirements.
Structure12 core requirements grouped under 6 goals, with 300+ sub-requirements
Future-dated requirements51 of the 64 new v4.x requirements were future-dated and became mandatory on 31 March 2025All applicable requirements are now in full effect; v3.2.1 was retired on 31 March 2024.
Role in iGamingSecures the cardholder-data environment behind deposits and withdrawals.Protects the PAN and sensitive authentication data (e.g. CVV, PIN, full track data).

Related standards

PCI PIN SecurityPCI 3DSPCI SSF (Secure Software Framework)

Related terms

operatorremote gamblingamlkyc

Sources

PCI Security Standards Council — official sitepcisecuritystandards.org
PCI SSC Blog — adopting the future-dated requirements of PCI DSS v4.xblog.pcisecuritystandards.org

A standard is a ruleset, not a promise. A certificate against PCI DSS attests that a game or system met it at test time — it does not change the house edge or guarantee a session outcome. This is a teaching summary; confirm against the issuer (PCI Security Standards Council (PCI SSC)).

← All technical standards