Stricter guidelines. Smarter security
Here’s what merchants need to know about PCI DSS v4.0
Read More
How Your Payment Integration Defines Your PCI DSS Scope
The Payment Card Industry Data Security Standard (PCI DSS) is the financial industry's defense against cyber threats. It is a set of security mandates designed to protect cardholder data and keep fraudsters at bay. Version 4.x, the latest evolution, became mandatory in March 2024 and introduces new ways to secure payments, giving businesses more flexibility in how they achieve compliance. But there’s a catch: your PCI DSS scope—how deeply you need to comply—is dictated by your chosen payment integration method, as well as the number of card transactions processed each year.
For businesses processing payments through Peach Payments, the integration type directly impacts how much of the compliance burden falls on them versus their payment provider. From minimal involvement to full-scale security operations, let’s break down the three major approaches and their compliance implications.
How It Works: Customers are redirected to a secure payment page hosted by Peach Payments. Since all sensitive card data is handled externally, merchants deal with the lowest PCI DSS scope.
Merchant Responsibilities:
PCI DSS Scope: Minimal. Since cardholder data never touches the merchant’s environment, compliance is simplified. This method is ideal for businesses that want to reduce risk and avoid the heavy lifting of security management.
We also recommend that merchants who use Embedded Checkout complete a SAQ-A Form, which can be found on the PCI Security Standards Council website.
Read more about these types of forms in this blog
How It Works: A payment widget is embedded directly into the merchant’s checkout page, allowing customers to pay without leaving the site. Peach Payments handles transaction processing, but some security responsibilities remain with the merchant.
Merchant Responsibilities:
PCI DSS Scope: Moderate. While merchants don’t handle raw cardholder data, they must ensure their checkout environment is secure. This means additional security measures, such as monitoring for attacks and limiting access to critical systems.
Peach Payments’ Embedded Checkout solution reduces the PCI 4.x scope for merchants (by helping merchants meet the future-dated requirements 6.4.3 and 11.6.1), while offering numerous other benefits such as alternative payment methods and customization capabilities.
How It Works: Merchants transmit cardholder data directly to Peach Payments via API, giving them full control over the payment experience—but also placing them in the highest PCI DSS scope.
Merchant Responsibilities:
PCI DSS Scope: Extensive. Merchants handling raw cardholder data must comply with the strictest security requirements, including extensive monitoring, encryption, and policy enforcement. Businesses choosing this route must complete PCI SAQ D and, in some cases, undergo an independent PCI audit.
The deadline for full PCI DSS v4.0 compliance, including future-dated requirements, is March 2025. This means that enterprise business would need to have their full PCI DSS 4.x checklist in order before their next audit.
For merchants, the choice of payment integration is as much about security as it is about business strategy. The question isn’t just how you want to accept payments—it’s how much risk you’re willing to take on.
Whatever your choice, one thing is clear: PCI DSS compliance isn’t optional. It’s the foundation of trust in online commerce, and staying ahead of the game isn’t just about meeting regulations—it’s about securing your business and your customers against an ever-changing threat landscape.
The deadline for new PCI requirements is around the corner. Visit this page to learn more
No spam. Just the latest news, ecommerce tips and tricks to help you scale your business.
Here’s what merchants need to know about PCI DSS v4.0
Read MorePeach Payments does the heavy lifting, but here's what you need to do
Read MoreA Deep Dive into the Importance of Payment Security and How Peach Payments Ensures Robust Protection.
Read MoreWhat You Need to Know About PCI DSS 4.x
Read MoreNedbank Direct EFT is now available as a payment option on ecommerce websites that use Peach Payments, a leading South African payment gateway.
Read MorePeach Payments is paving the way for a transformative 2025. From Pay by Bank to Embedded Checkout, explore how we revolutionised payments in 2024
Read More