Don’t Have Dangerous Gaps in PCI Compliance

Last Updated on October 2, 2026 by Dimitri Akhrin

PCI compliant payment processing should be part of the conversation before a business decides how it will accept cards. But choosing a processor that follows PCI DSS does not automatically make the merchant compliant.

The way your checkout is built matters. Where card data enters the payment flow matters. Which systems can affect that payment page matters too. That makes PCI compliance less about finding a processor with the right security badge and more about understanding how responsibilities are divided between your business and every payment provider involved.

TL;DR

• A PCI compliant processor does not make your business PCI compliant – Merchants still need to understand their own responsibilities, verify that third-party providers are compliant and complete the right PCI validation for their payment environment.
• Your checkout design can change your PCI scope – A hosted checkout, an embedded payment form and a merchant-controlled payment page can create very different security and validation requirements.
• Outsourcing card entry does not remove website security requirements – Even when a third party handles the payment fields, scripts, redirects and plugins on your site can still affect payment security.
• Every payment channel needs to be considered – eCommerce checkout, recurring billing, virtual terminals, invoices and in-person payments can each create different PCI responsibilities.
• PCI compliance is ongoing – Websites, integrations and employee access change over time, so merchants need to keep reviewing their environment and completing the questionnaires, scans and other validation that apply.

PCI Compliance Depends on More Than the Processor You Choose

PCI DSS, the Payment Card Industry Data Security Standard, is a set of requirements for protecting payment account data. According to the PCI Security Standards Council’s guidance for merchants, it is intended for all entities that store, process or transmit cardholder data, regardless of their size or transaction volume. If your company touches payment information at all, you’re responsible for helping keep that data secure.

That’s why more businesses use third-party providers to handle payment processing. Outsourcing can reduce the number of PCI DSS requirements that apply directly to your business. It does not remove your responsibility for PCI compliance.

The PCI Security Standards Council’s FAQ on outsourced payment processing says merchants remain responsible for confirming that their providers are PCI DSS compliant for the services they perform. Merchants also need written agreements with those providers, should monitor their compliance status at least annually and need to understand which security responsibilities belong to each party. On top of that, merchants still validate their own compliance using the appropriate method, which may include a Self-Assessment Questionnaire (SAQ).

What PCI DSS Actually Covers

PCI DSS applies to businesses that store, process or transmit payment card information. It also reaches systems and environments that can affect the security of cardholder data.

The standard addresses areas such as protecting stored account data, securing systems and networks, managing access, monitoring environments and regularly testing security controls.

The exact requirements that apply to one merchant can look very different from those that apply to another. A small eCommerce store that sends customers to a compliant third-party checkout may have a much smaller PCI scope than a business whose own website collects card numbers directly. Both still need to understand their responsibilities.

Whether and how a merchant has to validate compliance is set by the card brands. For specifics on your account, your acquirer or merchant services provider is the right place to start.

Your Checkout Design Can Change Your PCI Scope

 

This is one of the most important distinctions for eCommerce businesses. PCI SSC separates different payment page setups because the merchant’s website plays a very different role in each one.

Hosted or Redirected Checkout

The customer leaves the merchant’s checkout and completes payment on a page supplied by a PCI DSS compliant payment provider. This can significantly reduce the merchant’s direct involvement with cardholder data because the third party handles the payment page itself.

Embedded Payment Form or iFrame

The customer stays on the merchant’s website visually, but the fields that collect card information come directly from the compliant payment provider. To qualify for SAQ A, all elements of the payment page used to collect or process cardholder data must come from PCI DSS compliant service providers, along with the other eligibility requirements.

Merchant-Controlled Payment Page

If the merchant’s own website creates the payment fields or otherwise controls how payment information is collected, the PCI scope can become broader. The checkout may look almost identical to the customer while creating very different security responsibilities behind the scenes.

Outsourcing Card Data Does Not Mean You Can Ignore Your Website

This has become especially important under PCI DSS v4.x. Attackers don’t need to compromise the payment processor itself. They can attack the merchant’s website and change scripts, redirect customers or manipulate the payment experience before the transaction reaches the legitimate provider.

That’s why PCI SSC added stronger eCommerce protections around payment page scripts and tampering. The PCI SSC FAQ on SAQ A eligibility for scripts explains that merchants using embedded payment forms must confirm their site is not susceptible to script attacks that could affect their eCommerce systems. They can do that by applying the relevant PCI DSS script protections themselves or through a third party. Another option is written confirmation from their PCI compliant payment provider that the embedded solution includes those protections when implemented as instructed.

Scanning matters too. In June 2026, PCI SSC published an FAQ confirming ASV scanning applies to SAQ A eCommerce merchants. That includes merchants whose webpages redirect payments to a third-party provider or embed that provider’s iframe.

In other words, outsourcing card entry can reduce your PCI scope. It does not make your own website irrelevant to payment security.

Start by Mapping How Your Business Gets Paid

The best way to know which setup fits is to start with your own business. Before comparing processors, write down every way customers can pay you.

An eCommerce store may accept card payments through a shopping cart. A subscription business, whether it sells software or landscaping, might automatically bill saved payment credentials. A freelancer or service company may email invoices for varying amounts. A restaurant could accept cards in person and through online ordering. Each channel can create a different payment environment.

If you accept cards through several channels, don’t assume one compliant integration covers the others. For example, an eCommerce checkout may outsource card entry entirely while employees also enter phone orders through a virtual terminal. Both payment flows need to be considered when determining the right PCI validation requirements.

Don’t judge PCI compliance by which features a platform includes, either. The more useful question is: what parts of the payment process does the provider handle and what remains under your control?

What to Ask a Payment Provider About PCI Compliance

Don’t settle for “yes, we’re PCI compliant.” Ask how the provider helps your business maintain compliance.

• Is the payment service PCI DSS compliant? Verify that the provider’s compliance covers the services you plan to use.
• Where does cardholder data enter the transaction? Find out whether your website, application or employees ever handle card numbers directly.
• Which SAQ applies to my setup? Hosted checkout, embedded forms and merchant-controlled payment pages can have different validation requirements.
• Does my website require vulnerability scans? Current PCI DSS requirements can require scans even for some merchants that outsource payment collection.
• Who handles security updates? Know whether your business, eCommerce platform, developer or payment provider maintains each part of the checkout.
• What are our shared responsibilities? PCI SSC expects merchants to understand which party owns each security responsibility.

A PCI Compliant Gateway Helps, but It Is Not the Whole Answer

A secure payment gateway can reduce the amount of sensitive card information your business handles directly. BAMS offers payment gateway solutions that connect eCommerce checkout, processing and reporting while supporting PCI compliant payment environments. That can simplify security compared with building payment handling from scratch.

Using a PCI compliant gateway still does not eliminate the merchant’s PCI requirements. BAMS makes the same distinction in its own guidance: a secure gateway reduces your scope and risk, but merchants still need to validate their compliance annually.

PCI Compliance Is Not a One-Time Setup

A business can choose a secure payment provider today and still create problems later. Websites change. Plugins get added. Developers install scripts. Employees receive new access. Checkout flows get redesigned. PCI compliance needs to keep up with those changes.

BAMS requires merchants to complete PCI DSS compliance within 90 days of approval and provides a guided process. That process includes an annual Self-Assessment Questionnaire and quarterly security scans for merchants whose systems are connected to the internet. Merchants can review BAMS PCI compliance support to understand the requirements that apply to their payment environment.

Do Not Forget Third-Party Scripts

An eCommerce payment page may contain far more than payment code. Analytics tools, advertising tags, chat widgets and other third-party scripts can run on the same website. Under PCI DSS v4.x, merchants need to pay closer attention to whether those scripts can affect the security of the payment environment.

A script that has nothing to do with payments may not automatically create a PCI issue. But if it can influence payment page security, the business needs to understand that risk. That’s one reason to be cautious about adding plugins and scripts without knowing what access they have.

PCI Compliance and Payment Security Are Related but Not Identical

Passing a PCI validation does not mean fraud or security incidents are impossible. PCI DSS provides a baseline for protecting payment account data. Businesses should still use fraud controls, strong authentication, secure software practices and monitoring based on their risk.

For an online merchant, that may include AVS and CVV checks, transaction risk tools and clear procedures for reviewing suspicious orders. BAMS also provides eCommerce merchant services that combine payment processing with gateway, fraud management and reporting options for online businesses.

What to Compare Before Choosing a Payment Processor

Question	Why It Matters
Is the provider PCI DSS compliant?	Your provider needs to protect the payment functions it performs.
Who collects the card data?	The answer can significantly affect your PCI scope.
What SAQ applies?	Different integrations can require different validation paths.
Are website scans required?	Scanning can apply to eCommerce webpages even when payment collection is outsourced.
Who manages scripts and updates?	Your website can affect payment security even when card fields come from a third party.
What support is included?	Guidance on your responsibilities makes ongoing compliance easier to manage.

PCI Compliant Payment Processing FAQs

What is PCI DSS?

PCI DSS stands for Payment Card Industry Data Security Standard. It is a set of security requirements designed to protect payment account data. It applies to organizations that store, process or transmit cardholder data or can affect its security.

Does every business that accepts credit cards need PCI compliance?

Yes. PCI DSS applies to businesses that accept payment cards regardless of size. The specific requirements and validation method depend on how the business accepts and handles card information.

Does using a third-party payment processor make my business PCI compliant?

No. Outsourcing payment processing can reduce the number of requirements that apply to your environment. Merchants still need to make sure their providers are compliant and complete their own PCI validation.

Does using a PCI compliant gateway eliminate PCI requirements?

No. A compliant gateway can reduce exposure to cardholder data and may reduce PCI scope, but the merchant still has responsibilities under PCI DSS.

What is SAQ A?

SAQ A is a PCI DSS Self-Assessment Questionnaire for eligible card-not-present merchants that outsource payment account data functions to compliant third-party service providers and meet the questionnaire’s other eligibility requirements.

Can an embedded payment form qualify for SAQ A?

It can, as long as all payment page elements involved in collecting or processing cardholder data come from PCI DSS compliant service providers and all other SAQ A eligibility criteria are met.

Do eCommerce merchants using redirects still need security scans?

Yes. PCI SSC clarified in 2026 that SAQ A merchants with eCommerce webpages, including sites that redirect to or embed a third-party payment page, are responsible for the ASV scanning requirements in SAQ A.

How often does PCI compliance need to be reviewed?

PCI compliance is ongoing. Depending on the merchant’s environment, validation can include an annual Self-Assessment Questionnaire, quarterly vulnerability scans and other activities.

Sources

• PCI Security Standards Council – Merchant Resources
• PCI Security Standards Council – Outsourced Payment Processing and Merchant Responsibility
• PCI Security Standards Council – SAQ A eCommerce Script Requirements
• PCI Security Standards Council – SAQ A External Vulnerability Scanning

Most eCommerce payment platforms are expected to be PCI compliant, but your business can still be liable for gaps in your own setup. Look for those gaps before you finalize your choice. If you want to see how your current account compares, request a free five-point Merchant Account Price Comparison.