# PCI DSS v4.0: A Practical Compliance Guide for Card-Handling Businesses

> Updated 2026-06-01 - 10 min read

If your business stores, processes or transmits payment-card data, PCI DSS applies. The current standard, PCI DSS v4.0, modernizes the requirements and introduces a customized approach to validation. This guide explains what PCI DSS v4.0 requires and how to reach and prove compliance - including Level 1 for banks, fintechs and payment aggregators.

## Who PCI DSS applies to

PCI DSS applies to any entity that stores, processes or transmits cardholder data (CHD) or sensitive authentication data - merchants, processors, gateways, and service providers. Your merchant/service-provider level (1 to 4) determines whether you self-assess (SAQ) or need a QSA-led assessment.

In India, RBI-regulated banks, fintech platforms and payment aggregators typically need Level 1 PCI DSS - the most rigorous tier.

## The 12 PCI DSS requirements (at a glance)

- Install and maintain network security controls
- Apply secure configurations to all system components
- Protect stored account data; encrypt transmission of cardholder data
- Protect systems against malware; develop secure systems and software
- Restrict access to data by business need-to-know; authenticate access
- Restrict physical access; log and monitor all access
- Test security of systems and networks regularly (including VAPT)
- Maintain an information-security policy and program

## Scope, SAQ and QSA

The most important lever in PCI DSS is scope: minimizing the cardholder-data environment (CDE) through segmentation dramatically reduces cost and effort. Smaller merchants may validate via a Self-Assessment Questionnaire (SAQ); higher volumes and service providers need a Qualified Security Assessor (QSA)-led Report on Compliance.

PCI DSS v4.0 also requires segmentation penetration testing to prove that out-of-scope networks truly cannot reach the CDE.

## Path to PCI DSS v4.0 compliance

- Map card flows and define/minimize the cardholder-data environment
- Run a gap analysis against PCI DSS v4.0
- Remediate controls; validate segmentation with a pentest
- Run required VAPT and ASV scans
- Support SAQ or QSA-led assessment and maintain evidence

## FAQ

**Do payment aggregators need Level 1 PCI DSS?**
Typically yes. RBI-regulated payment aggregators, banks and larger fintechs generally require Level 1 PCI DSS - the tier that mandates a QSA-led Report on Compliance.

**What changed in PCI DSS v4.0?**
v4.0 modernizes requirements, adds a 'customized approach' to validation, strengthens authentication (MFA), and formalizes segmentation penetration testing, among other updates.