PCI DSS Requirements for Payment Gateways and Processors

Digital payments are expanding across Africa, with payment gateways, processors, fintech companies, banks, merchants, and payment service providers handling increasing volumes of card transactions. As payment environments become more connected, protecting payment account data becomes an important security priority.

Payment gateways and processors may store, process, or transmit cardholder data. Their systems may also connect with applications, APIs, databases, cloud infrastructure, merchants, banks, and payment networks that can affect the security of the cardholder data environment.

This makes understanding the PCI DSS requirements for payment gateways and processors important for businesses involved in card payment processing.

PCI DSS scope is not determined simply by whether an organization is called a gateway, processor, fintech, or payment service provider. Scope depends on the organization's services, systems, payment data flows, technology architecture, and relationship with the cardholder data environment.

This article explains the key roles in the payment ecosystem and the major PCI DSS requirements relevant to payment gateways, processors, payment APIs, payment applications, and third-party payment providers.

What Is PCI DSS?

The Payment Card Industry Data Security Standard (PCI DSS) is a global information security standard designed to protect payment account data.

PCI DSS establishes technical and operational requirements for organizations that store, process, or transmit cardholder data or sensitive authentication data, as well as organizations that can affect the security of the cardholder data environment.

The standard can apply to organizations involved in payment processing, including:

Payment gateways
Payment processors
Payment service providers
Banks
Fintech companies
E-commerce businesses
Merchants
Acquirers
Issuers
Third-party service providers

The current published version is PCI DSS v4.0.1.

For payment organizations, PCI DSS is particularly relevant because modern payment environments can connect merchants, banks, applications, APIs, cloud platforms, databases, and external payment networks.

A security incident involving payment account data can result in unauthorized access, financial losses, regulatory consequences, customer concerns, and reputational damage.

Evaluate Your PCI DSS Compliance. Assess your payment environment against PCI DSS v4.0.1 with INTERCERT.

What Are the Key Roles in the Payment Ecosystem?

PCI DSS can apply to different organizations involved in card payment processing. The specific responsibilities depend on the organization's role, services, systems, and relationship with payment account data.

1. Payment Gateways

Payment gateways transmit transaction information between merchants, payment processors, acquiring institutions, and other payment entities.

Depending on their technology and services, gateways may store, process, or transmit payment account data and can therefore fall within PCI DSS scope.

Relevant security areas can include:

Payment account data protection
Secure data transmission
Network security
Access control
Authentication
Vulnerability management
Application security
Logging and monitoring
Third-party service provider management

2. Payment Processors

Payment processors handle transaction processing between merchants, financial institutions, payment networks, and other participants in the payment ecosystem.

Their infrastructure may include payment applications, databases, APIs, network systems, cloud environments, and other technologies that store, process, or transmit payment account data.

The applicable PCI DSS requirements depend on the processor's specific environment and services.

3. Payment Service Providers

Payment service providers offer payment processing and related technology services to merchants and businesses.

Their PCI DSS responsibilities depend on the services provided, payment data handled, systems operated, and role within the transaction flow.

Where a service provider stores, processes, or transmits payment account data, or can affect the security of the cardholder data environment, PCI DSS scope should be evaluated accordingly.

4. Merchants

Merchants accept card payments through websites, mobile applications, physical locations, and other payment channels.

Their PCI DSS responsibilities depend on how payment transactions are handled and whether their systems store, process, or transmit payment account data or can affect the security of the cardholder data environment.

Using a third-party payment processor does not automatically remove the merchant's PCI DSS responsibilities.

5. Banks and Acquiring Institutions

Banks and acquiring institutions play an important role in authorizing and processing card transactions between merchants and payment networks.

Their PCI DSS responsibilities depend on the systems, services, payment data, and connected environments within their respective scope.

Understanding these five roles provides a clearer basis for identifying where payment account data moves and which systems may fall within PCI DSS scope.

What PCI DSS Requirements Apply to Payment Gateways and Processors?

The specific PCI DSS requirements applicable to a payment gateway or processor depend on its scope and technology environment. However, several security areas are commonly relevant.

Network Security Controls

Payment processing environments require security controls that protect networks and systems from unauthorized access.

Depending on the environment, this can involve:

Network segmentation
Firewall and network security controls
Secure network configurations
Restrictions on inbound and outbound traffic
Protection of wireless environments where applicable
Monitoring of network activity

Network architecture should be evaluated based on the systems connected to the cardholder data environment and the security impact of those connections.

Secure System Configuration

Payment gateways and processors commonly operate servers, databases, applications, cloud infrastructure, network devices, and other technologies.

PCI DSS includes requirements concerning secure configurations and protection against common security weaknesses.

Organizations should consider:

Secure configuration standards
Removal of unnecessary services
Secure default settings
System hardening
Configuration management
Protection of system components

Protection of Stored Account Data

Organizations that store payment account data must apply applicable controls to protect that information.

Payment environments should identify:

What payment account data is collected
Where it is stored
Why it is retained
Who can access it
How long it is retained
How it is securely deleted

Primary Account Number (PAN) is particularly important within PCI DSS scope. Storage, access, retention, and protection controls should be evaluated according to the applicable requirements.

Encryption of Payment Data in Transit

Payment account data transmitted across networks should be protected according to applicable PCI DSS requirements.

This can involve:

Secure transmission protocols
TLS configuration
Certificate management
Secure communication channels
Protection against unauthorized interception

This is particularly relevant where payment systems communicate through APIs, merchant platforms, cloud services, banks, and external payment networks.

Secure Software and Payment Applications

Payment gateways and processors often depend on custom applications, payment platforms, APIs, mobile applications, and other software components.

PCI DSS includes requirements concerning secure software development and security testing.

Relevant areas can include:

Secure software development practices
Code security
Vulnerability identification
Security testing
Change control
Application security
Protection against common software vulnerabilities

Payment applications that store, process, or transmit payment account data, or can affect the security of the cardholder data environment, may fall within PCI DSS scope.

Payment Page and E-Commerce Security

E-commerce payment environments introduce additional security considerations because payment information can be exposed through websites and browser-based functionality.

PCI DSS v4.0.1 includes requirements concerning payment page scripts and mechanisms for detecting unauthorized changes to payment pages.

These requirements can be relevant where payment pages use:

JavaScript
Embedded payment forms
Third-party scripts
Payment processor integrations
Iframes
Client-side payment functionality

Browser-side attacks can target payment page scripts before payment information reaches the processor. Organizations should therefore establish clear security responsibilities for payment page components and related third-party technologies.

Vulnerability Management

Payment infrastructure represents an attractive target for cybercriminals, making vulnerability management an important PCI DSS area.

Relevant activities can include:

External vulnerability scanning
Internal vulnerability identification
Patch management
Critical security updates
Malware protection where applicable
Vulnerability remediation
Security testing
ASV scans

Payment processors should consider the security of internet-facing applications, APIs, servers, cloud infrastructure, network devices, and other systems within PCI DSS scope.

The exact testing requirements depend on the systems and services included within the organization's environment.

Access Control and Authentication

Payment processing environments should restrict access to systems and payment account data according to business and security requirements.

Relevant controls can include:

Unique user identification
Role-based access
Least-privilege access
Strong authentication
Multi-factor authentication where applicable
Privileged account controls
Access reviews
Secure remote access

Privileged accounts require particular attention because administrative access can provide extensive control over payment applications, databases, cloud infrastructure, network systems, and security platforms.

Organizations should establish appropriate controls for employees, contractors, administrators, developers, and other users with access to in-scope systems.

Physical Security

PCI DSS is not limited to cloud infrastructure and applications.

Payment processors operating physical data centers, server rooms, offices, or other in-scope facilities may need to address physical security requirements.

Relevant controls can include:

Restricting physical access
Visitor management
Physical access monitoring
Protection of media containing account data
Secure storage
Secure disposal
Monitoring sensitive facilities

Organizations operating their own data centers or using colocation facilities should consider physical security as part of the overall PCI DSS environment.

Logging and Security Monitoring

Payment environments require visibility into security events and user activity.

PCI DSS includes requirements addressing logging and monitoring activities that could affect the security of payment account data.

Payment processors should consider logging relevant events such as:

User access
Administrative activity
Authentication events
Security events
System changes
Access to sensitive resources
Relevant network activity

Logs should be protected against unauthorized modification and reviewed according to applicable PCI DSS requirements.

Centralized monitoring can provide visibility across cloud environments, applications, APIs, databases, and network infrastructure.

PCI DSS Requirements for Payment APIs

Modern payment ecosystems increasingly rely on APIs to connect merchants, banks, fintech platforms, mobile applications, payment gateways, and processors.

A payment API may allow merchants, marketplaces, mobile applications, and other systems to submit payment information, retrieve transaction information, or communicate with a payment processor.

An API does not create a separate PCI DSS standard. Instead, the API and connected systems may fall within PCI DSS scope depending on how payment account data moves through the environment.

API Authentication and Authorization

API access should be restricted to authorized systems and users.

Organizations should establish appropriate authentication mechanisms, authorization controls, credential management, and access restrictions.

API Encryption

Payment account data transmitted through APIs should be protected according to applicable PCI DSS requirements.

TLS configuration, certificate management, and secure communication channels should be evaluated as part of the payment architecture.

API Input Validation

Payment APIs should validate incoming data to reduce risks associated with malformed requests and injection attacks.

API Logging

Relevant API activity should generate appropriate security and audit records.

Rate Limiting and Abuse Protection

Payment APIs can be targeted by automated attacks, credential abuse, enumeration, and other malicious activity.

Organizations should consider appropriate controls based on the API architecture and risk profile.

Secure API Development

API development should follow secure software development practices and include appropriate security testing throughout the software lifecycle.

These areas are relevant when evaluating PCI DSS requirements for payment processing systems built around API-driven architectures.

PCI DSS Requirements for Third-Party Payment Processors

Businesses may rely on third-party payment processors, payment gateways, banks, and payment service providers to process card transactions.

Outsourcing payment processing can reduce the amount of payment infrastructure operated directly by a merchant. However, outsourcing does not automatically remove the merchant's PCI DSS responsibilities.

Third-party relationships should clearly establish:

Services provided by the third party
Whether payment account data is stored, processed, or transmitted
Systems included within the third party's PCI DSS scope
Responsibilities retained by the customer
Security responsibilities assigned to each party
PCI DSS validation status
Security incident notification procedures
Ongoing third-party monitoring requirements

PCI DSS Requirement 12 includes requirements concerning third-party service providers and their relationships with customers.

For businesses working with international payment providers, clearly defining responsibilities becomes particularly important when payment processing crosses organizational and geographic boundaries.

PCI DSS Service Provider Requirements

Payment gateways, processors, and payment service providers may qualify as service providers depending on the services they provide and their relationship with payment account data.

PCI DSS contains requirements specifically applicable to service providers.

These can include areas such as:

Written agreements with customers
Clearly defined security responsibilities
Maintaining information about PCI DSS status
Incident response
Monitoring responsibilities
Customer-facing compliance information
Third-party service provider management

The applicable validation method depends on the organization's role, scope, services, transaction environment, and requirements established by relevant payment brands and acquiring organizations.

Organizations should review applicable PCI SSC validation documents and payment brand requirements when determining their specific obligations.

PCI DSS Cardholder Data Security Requirements

Cardholder data protection is central to PCI DSS.

Organizations should distinguish between cardholder data and sensitive authentication data and determine where each type of information enters, moves through, and leaves the environment.

Cardholder data can include:

Primary Account Number (PAN)
Cardholder name
Expiration date
Service code

Sensitive authentication data can include authentication values and other sensitive payment authentication information.

Organizations should identify whether payment information is:

Collected
Processed
Transmitted
Stored
Logged
Cached
Backed up
Exposed through applications or APIs

Mapping these data flows becomes particularly important when transactions involve multiple banks, payment gateways, processors, merchants, and international payment networks.

Understanding these data flows provides a clearer basis for establishing PCI DSS scope and determining applicable security controls.

How PCI DSS Applies to Payment Processing Companies in Africa

Africa has a growing digital payments ecosystem involving banks, fintechs, payment service providers, merchants, payment processors, mobile payment platforms, and e-commerce businesses.

A payment processor may operate:

Payment processing applications
Databases
APIs
Cloud infrastructure
Network infrastructure
Authentication systems
Monitoring platforms
Customer portals
Administrative interfaces
Third-party integrations

Each component can have a different relationship with the cardholder data environment.

Organizations should therefore determine PCI DSS scope based on actual data flows, system connectivity, security dependencies, and business processes.

Payment platforms may connect merchants in one country with acquiring banks, payment networks, processors, and cloud infrastructure located in other jurisdictions. This can make accurate scope definition particularly important for businesses operating across multiple markets.

PCI DSS and Third-Party Service Providers: Shared Responsibilities

A common misconception is that outsourcing payment processing transfers all PCI DSS responsibilities to the payment provider.

That is not the case.

For example, a merchant may use a PCI DSS-compliant payment service provider for transaction processing. The provider may be responsible for securing its own payment processing environment, while the merchant may retain responsibilities involving its website, payment page, integrations, access controls, policies, and other systems within its own scope.

The division of security responsibilities should therefore be clearly established between the organizations.

PCI DSS validation by a third-party service provider does not automatically make the customer's environment PCI DSS compliant.

This distinction is particularly important when businesses use international payment processors or regional payment service providers.

Common PCI DSS Challenges for Payment Gateways and Processors

Payment organizations can face complex security requirements because their environments involve multiple technologies, applications, integrations, financial institutions, and external service providers.

Complex Payment Ecosystems

Payment transactions may involve merchants, banks, processors, gateways, card networks, fintech platforms, and other organizations.

Cross-Border Transactions

Payment businesses operating across multiple markets may need to manage complex payment data flows, infrastructure, and third-party relationships.

API Dependencies

Modern payment architectures often depend on numerous APIs connecting merchants, applications, banks, and payment providers.

Cloud Infrastructure

Cloud-based payment environments require clear identification of security responsibilities between payment organizations and their cloud service providers.

Legacy Systems

Some payment environments may contain older applications and infrastructure that require careful security management and modernization.

Third-Party Relationships

Payment ecosystems commonly involve gateways, processors, acquiring institutions, banks, cloud providers, security vendors, and other service providers.

Evolving Cyber Threats

Payment environments remain attractive targets for attackers seeking payment account data and transaction credentials.

Growing Digital Commerce

The expansion of e-commerce and digital payments increases the importance of protecting online payment environments and customer payment information.

How to Prepare for a PCI DSS Assessment

Organizations preparing for PCI DSS validation should establish a clear understanding of their payment environment.

Key activities can include:

Define the cardholder data environment.
Map payment data flows.
Identify systems that store, process, or transmit account data.
Identify connected systems that can affect the security of the CDE.
Review applicable PCI DSS requirements.
Evaluate technical and operational controls.
Review third-party service provider relationships.
Collect appropriate evidence for applicable requirements.
Address identified control deficiencies.
Complete the applicable PCI DSS validation process.

The process should consider the complete payment ecosystem, including payment providers, banks, cloud platforms, merchant integrations, APIs, and other connected services.

The exact validation method depends on the organization's role, PCI DSS scope, transaction environment, acquiring relationships, payment brands, and applicable validation requirements.

Start Your PCI DSS Assessment. Evaluate applicable security controls with INTERCERT’s independent assessment approach.

PCI DSS Requirements Checklist for Payment Gateways and Processors

A high-level checklist can include:

Network security controls
Secure system configurations
Stored account data protection
Encryption during transmission
Secure software development
Payment application security
Payment page security
Vulnerability management
Access control
Authentication
Multi-factor authentication where applicable
Physical security
Logging and monitoring
Incident response
Security policies and procedures
Third-party service provider management
Security responsibility allocation
PCI DSS validation and reporting

This checklist provides a high-level view of security areas relevant to payment environments. Organizations should review the complete PCI DSS requirements applicable to their specific scope rather than relying solely on a general checklist.

Why Choose INTERCERT for PCI DSS Assessment?

INTERCERT provides independent PCI DSS assessment and certification services for organizations operating payment gateways, payment processors, payment applications, APIs, and other payment environments.

INTERCERT's PCI DSS assessment approach includes:

Independent third-party assessment
Qualified Security Assessor (QSA)
Qualified PCI DSS professionals
PCI DSS v4.0.1 alignment
Assessment of payment applications and APIs
Evaluation of payment processing environments
Review of applicable security controls
Scope-based assessment
Evaluation of technical and operational controls
International certification experience

With Qualified Security Assessor (QSA) expertise and an impartial third-party approach, INTERCERT evaluates applicable PCI DSS requirements based on the organization's defined scope, payment environment, systems, and data flows.

For payment gateways and processors, this assessment can provide an independent evaluation of the security controls applicable to the organization's PCI DSS environment.