Ask for a walkthrough
Menu

Guide · PCI DSS

PCI DSS for UK e-money and payment institutions

PCI DSS applies to a UK e-money or payment institution whenever it stores, processes or transmits payment card data, or runs a service that could affect the security of that data. It is enforced through your contracts with acquirers, sponsors and the card schemes, not by the FCA, whose authorisation covers different ground.

Applies to PCI DSS v4.0.1Last checked 13 Oct 2026Published 14 Oct 2026Written by Moshiul Islam Mishu, who has led PCI DSS assessments since 2018

In shortPCI DSS
  • List every way card data reaches you, and name your role in each: merchant, service provider or issuer.
  • If no card number touches your systems and your services cannot affect anyone else's card data, PCI DSS does not apply to you.
  • Ask the firm that connects you to the card schemes, your acquirer or sponsor, which validation it wants this year. Get the answer in writing.
  • Keep PCI DSS evidence and FCA evidence as two sets. Neither stands in for the other.
  • If other firms rely on your service, expect them to ask for your Attestation of Compliance.
On this pageWhen does PCI DSS apply to an e-money or payment institution?Who enforces it, if not the FCA?Is PCI DSS mandatory in the UK?How does it sit beside FCA authorisation?What an assessor will ask to seeHow the platform helpsSources

When does PCI DSS apply to an e-money or payment institution?

The PCI Security Standards Council says the standard is for every entity that stores, processes or transmits cardholder data, whatever its size [1]. Its glossary also treats as a service provider any business whose services could affect the security of that data [2]. FCA authorisation plays no part in the test. What matters is whether card data touches your systems or your services.

What you do Your role Who asks for evidence
Take card payments from your own customers, for example to load a wallet or fund a transfer Merchant Your acquirer
Store, process or transmit card data for other businesses, for example as a gateway or processor Service provider The card schemes, the acquirers or issuers you serve, and the firms that use your service
Issue cards, or support a card programme Issuer, or a provider of issuing services The card schemes; your sponsor may also ask, if you issue through one
Move money by bank transfer or open banking only None. PCI DSS does not apply No one, for PCI DSS

One firm can hold more than one role. The glossary says a merchant that handles card data for others is also a service provider [2]. Issuers are covered too: the Council’s answer on that point is yes, with the schemes deciding whether an issuer has to validate [3].

Who enforces it, if not the FCA?

The Council writes the standard. It does not set anyone’s compliance or validation duties, and says those are set by the card brands, acquirers and payment facilitators [4]. Each scheme runs its own programme [1].

Visa’s programme page shows how the chain works [5]:

  1. Acquirers must make sure their merchants validate at the right level, and must collect the documents.
  2. Issuers and acquirers must make sure every service provider they use shows compliance at least every 12 months.
  3. A third-party agent must be registered with Visa before a member or a merchant uses its services.
  4. Visa can impose non-compliance assessments, which the member pays.

So the obligation reaches you by contract: scheme to member, member to you. Visa’s rules make the member pay an assessment whether it absorbs the cost or passes it on in its own billing, and require its contracts with merchants and agents to set out the liabilities for failing to meet Visa’s standards [12].

Is PCI DSS mandatory in the UK?

PCI DSS is a contractual standard, not a statute. It binds you because you agreed to it when you signed with an acquirer, a sponsor or a scheme. Two UK regulators still matter.

  • The ICO. Its guide to data security says that if you process payment card data you are obliged to comply with PCI DSS. After a personal data breach involving card data, it will consider how far you had the standard’s measures in place, above all any control whose absence led to the breach [6].
  • The FCA. Its pages for payment and e-money firms, on operational resilience and on outsourcing do not mention PCI DSS [7][8][9].

How does it sit beside FCA authorisation?

The FCA’s rules and PCI DSS touch some of the same subjects with different authority behind them.

FCA rule What it asks of payment and e-money firms
Operational resilience (PS21/3) Covers firms authorised or registered under the Payment Services Regulations 2017 and the Electronic Money Regulations 2011. They had until 31 March 2025 to show they can stay within their impact tolerances [8]
Outsourcing The EBA outsourcing guidelines apply to payment and e-money institutions. You cannot hand any part of your regulatory responsibility to a third party [9]
Operational and security risk The FCA points firms to the EBA’s security guidelines, covered in chapter 18 of its Approach Document [7]
Third-party reporting (PS26/2) From 18 March 2027, authorised payment and e-money institutions must keep a register of material third-party arrangements and send it to the FCA each year [10]

PCI DSS has its own third-party rules. A service provider must tell its customers which requirements it is responsible for (requirements 12.9.1 and 12.9.2), and is expected to hand over its Attestation of Compliance on request [11]. The matching duty on you, to manage the providers you use, is requirement 12.8 [13]. One list of providers can feed both the FCA register and PCI DSS, but each asks for its own evidence.

What an assessor will ask to see

  1. A data-flow diagram showing each card flow (requirement 1.2.4), and a description of the role you hold in it [14]
  2. Your documented scope: the systems and third parties that store, process or transmit card data, or could affect its security (requirement 12.5.2) [14]
  3. Your list of third-party service providers, the written agreements, and how you track each one’s compliance status (requirement 12.8) [13][14]
  4. If you are a service provider, your written statement of which requirements you cover for customers (requirements 12.9.1 and 12.9.2) [11]
  5. If you issue cards and keep sensitive authentication data, the business reason for keeping it and how it is protected (requirement 3.3.3) [14]

The requirement numbers in this list were checked against the Council’s version 4.0 questionnaire for service providers [14]. Version 4.0.1 added and deleted no requirements [15].

How the platform helps

The platform checks your cloud accounts against PCI DSS v4.0.1, holds the evidence a cloud account cannot show, and files both by requirement. Whether a requirement is in place is for your QSA to decide, or for you on a self-assessment.

Sources

  1. Merchant resources, PCI Security Standards Council, https://www.pcisecuritystandards.org/merchants/, read 13 October 2026
  2. Glossary, PCI Security Standards Council, https://www.pcisecuritystandards.org/glossary/, read 13 October 2026
  3. FAQ 1217, “Does the PCI DSS apply to issuers?”, PCI Security Standards Council, January 2013, https://www.pcisecuritystandards.org/faqs/1217/, read 13 October 2026
  4. “Important Updates Announced for Merchants Validating to Self-Assessment Questionnaire A”, PCI Security Standards Council, 30 January 2025, https://blog.pcisecuritystandards.org/important-updates-announced-for-merchants-validating-to-self-assessment-questionnaire-a, read 13 October 2026
  5. Account Information Security (AIS) Program and PCI, Visa, https://corporate.visa.com/en/resources/security-compliance.html, read 13 October 2026
  6. A guide to data security, Information Commissioner’s Office, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/, read 13 October 2026
  7. Payment Services Regulations 2017 and Electronic Money Regulations 2011, Financial Conduct Authority, last updated 17 December 2025, https://www.fca.org.uk/firms/payment-services-regulations-e-money-regulations, read 13 October 2026
  8. Operational resilience, Financial Conduct Authority, last updated 15 September 2026, https://www.fca.org.uk/firms/operational-resilience, read 13 October 2026
  9. Outsourcing and operational resilience, Financial Conduct Authority, last updated 14 July 2026, https://www.fca.org.uk/firms/outsourcing-and-operational-resilience, read 13 October 2026
  10. PS26/2: Operational incident and third party reporting, Financial Conduct Authority, 18 March 2026, https://www.fca.org.uk/publications/policy-statements/ps26-2-operational-incident-third-party-reporting, read 13 October 2026
  11. FAQ 1576, “What evidence is a TPSP expected to provide to customers to demonstrate PCI DSS compliance?”, PCI Security Standards Council, February 2024, https://www.pcisecuritystandards.org/faqs/1576/, read 13 October 2026
  12. Visa Core Rules and Visa Product and Service Rules, sections 1.9.4.1 and 1.11.2.5, Visa, 18 April 2026, https://www.visa.co.uk/dam/VCOM/download/about-visa/visa-rules-public.pdf, read 13 October 2026
  13. FAQ 1312, “How is an entity’s PCI DSS compliance impacted by using third-party service providers (TPSPs)?”, PCI Security Standards Council, February 2024, https://www.pcisecuritystandards.org/faqs/1312/, read 13 October 2026
  14. Self-Assessment Questionnaire D for Service Providers and Attestation of Compliance, for use with PCI DSS version 4.0, PCI Security Standards Council, April 2022, https://listings.pcisecuritystandards.org/documents/PCI-DSS-v4-0-SAQ-D-Service-Provider.pdf, read 13 October 2026
  15. “Just Published: PCI DSS v4.0.1”, PCI Security Standards Council, 11 June 2024, https://blog.pcisecuritystandards.org/just-published-pci-dss-v4-0-1, read 13 October 2026

This guide explains the standard in general terms. It is not advice on your own compliance.

Normatiq does not perform PCI DSS assessments or issue Reports on Compliance. Your QSA does.

See it on your own case.

Ask for a walkthrough and we will show you the platform against a scope like yours.

Ask for a walkthrough

The button opens an email to info@normatiq.io.