Merchant Account Setup for Funeral Homes: PCI Guide

Last Updated on October 21, 2026 by Dimitri Akhrin

Guide Orientation: What This Covers and Who It’s For

This guide walks you through merchant account setup and secure payment integration for funeral service businesses, with a specific focus on PCI compliance in integrated payment systems. We wrote it for family-owned funeral home operators managing one to ten locations who process high-ticket transactions (often exceeding $15,000) and need payment workflows that match the sensitivity and regulatory complexity of their industry.

By the end, you’ll understand how to evaluate payment gateway providers, structure your payment stack for PCI compliance, protect cardholder data without adding operational burden and avoid the compliance gaps that leave funeral homes exposed to fraud and fines. However, this guide does not cover general retail POS setup or enterprise-scale payment architecture. It serves operators whose transactions carry both financial weight and emotional stakes.

TL;DR

• Map your card data flows first — Identify every point where cardholder data enters, moves through, or is stored in your funeral home before making any technology decisions. Phone payments, paper forms and emailed invoices are common blind spots.
• Choose payment gateway providers that shrink your PCI scope — Hosted payment fields, tokenization and PCI-compliant virtual terminals shift the heaviest compliance burdens to your provider, potentially reducing your self-assessment from hundreds of questions to a few dozen.
• Tokenize all stored payment methods — Preneed contracts and payment plans require storing card data. Tokenization replaces actual card numbers with useless tokens, eliminating your most dangerous data-storage liability.
• Treat compliance as a quarterly rhythm, not a one-time project — Complete your PCI SAQ annually, review access logs quarterly, train staff on data handling and verify your provider’s compliance certification each year.
• Funeral homes have unique payment compliance needs — High-ticket transactions, preneed trust account requirements, state-specific regulations and emotionally sensitive contexts all demand a merchant account setup built for your industry, not adapted from generic retail configurations.

Why PCI Compliance in Funeral Home Payment Systems Matters Now

Funeral homes occupy an unusual position in the payments landscape. You process transactions that are large, infrequent, emotionally charged and sometimes subject to fiduciary obligations that don’t exist in standard retail. South Carolina’s 2024 funeral-contract legislation, for example, requires certain payments for funeral merchandise to be held in a trust account at a federally insured institution until the merchandise is delivered. Because of rules like this, your payment system isn’t just a convenience; it’s a compliance instrument.

The threat environment has also intensified. Visa blocked more than 51.8 million presumed-fraudulent transactions worth US$11.8 billion in the first half of 2024 alone. Meanwhile, 269 million card records were posted on dark-web and publicly accessible sources in 2024, including 70 million more card records offered for sale than the year before. Small businesses with outdated or loosely integrated payment systems are attractive targets. After all, compliance gaps are more common where dedicated IT staff are scarce.

In fact, the cost of inaction isn’t abstract. A single data breach can trigger PCI noncompliance fines passed through by your acquirer, card brand penalties and reputational damage. That damage is especially devastating in a trust-dependent industry like funeral services. Getting your payment integration right from the start is not optional; it’s the foundation of sustainable operations.

Core Concepts: Understanding PCI Compliance for Integrated Payments

What PCI DSS Actually Requires

The Payment Card Industry Data Security Standard (PCI DSS) is a set of security requirements maintained by the PCI Security Standards Council. It applies to every business that stores, processes, or transmits cardholder data. For most funeral homes, you fall under merchant Level 4, the lowest card brand volume tier. It generally covers merchants processing fewer than 20,000 eCommerce transactions or up to 1 million total card transactions a year. Generally, Level 4 merchants validate compliance with a Self-Assessment Questionnaire (SAQ).

PCI DSS compliance isn’t a one-time certification. Instead, it’s an ongoing obligation that covers network security, access controls, encryption, monitoring and vulnerability management. The current version is PCI DSS v4.0.1, which places greater emphasis on script management on payment pages and continuous security monitoring.

Key Distinctions That Affect Your Setup

Tokenization vs. Encryption: Encryption scrambles card data so it can be unscrambled with a key. Tokenization replaces card data with a meaningless token that has no exploitable value if stolen. Tokenization is one of the most effective ways to reduce your PCI scope because your systems never store raw card numbers.

Hosted Payment Pages vs. Direct Integration: A hosted payment page (or hosted payment fields) means the customer’s card data is entered on your payment provider’s secure environment, not on your website or terminal software. As a result, this dramatically reduces the number of PCI requirements you must satisfy directly. A direct API integration gives you more control over the checkout experience but increases your compliance burden.

Payment Stack: Your payment stack is the full set of tools and services involved in accepting, processing and settling a payment. For a funeral home, this typically includes a payment gateway, a merchant account, a terminal or virtual terminal for in-person and phone payments and potentially an online invoicing or preneed payment portal. Every component in this stack must be PCI compliant and you must secure the connections between them.

The Framework: Four Phases of Compliant Payment Integration

Securing PCI compliance in an integrated payment system is not a single action. Instead, it follows four interconnected phases that build on each other:

• Scope Assessment (Phase 1) — Map every point where cardholder data enters, moves through, or is stored in your business.
• Architecture Selection (Phase 2) — Choose the payment gateway, merchant account and integration model that minimizes your compliance surface area.
• Implementation & Hardening (Phase 3) — Deploy your payment stack with proper access controls, tokenization, monitoring and documentation.
• Ongoing Validation & Response (Phase 4) — Maintain compliance through regular self-assessments, vulnerability scans, staff training and incident response planning.

Each phase feeds into the next. For example, skipping scope assessment (Phase 1) leads to architecture decisions that leave gaps. Similarly, neglecting ongoing validation (Phase 4) means your initial compliance erodes within months. The steps below break each phase into actionable guidance.

Step-by-Step: Building a PCI-Compliant Payment System for Funeral Services

Step 1: Map Your Cardholder Data Environment

Objective: Identify every system, device and process that touches payment card data so you know exactly what to secure.

Start by listing every way a family can pay you. In-person card swipes at your arrangement office. Phone payments for preneed contracts. Online payments through your website. Invoices sent via email with a payment link. In other words, each of these represents a cardholder data entry point. Then trace the path: where does that card data go after entry? Does it pass through your office computer? Is it stored in your accounting software? Does your staff write card numbers on paper forms?

In particular, preneed contracts create a unique data flow for funeral homes. You may accept a deposit today for services delivered months or years later. If so, you may need to store a payment method on file or set up recurring billing. This is a high-risk area because stored card data is the primary target for attackers. Document every instance where you store card data, even temporarily.

Anti-patterns: Assuming your card terminal is your only data touchpoint. Ignoring phone-based payments where staff may write down card numbers. Overlooking spreadsheets or paper files that contain partial card data.

Success indicators: You have a written diagram showing every entry point, every system that processes or stores card data and every connection between those systems. You’ve documented every card data flow.

Step 2: Select a Payment Gateway and Merchant Account That Reduce Your PCI Scope

Objective: Choose payment gateway providers and a merchant account configuration that shift the heaviest compliance burdens away from your internal systems.

In fact, this is the most consequential decision in your entire payment integration. The right architecture can move you from the longest self-assessment (SAQ D) to the shortest (SAQ A) by ensuring cardholder data never touches your servers. By contrast, the wrong one can make you responsible for network segmentation, intrusion detection and quarterly vulnerability scans you’re not equipped to manage.

Capabilities to Prioritize

For funeral homes, prioritize these capabilities in your payment gateway provider:

• Hosted payment fields or hosted payment pages for online and emailed invoice payments, so card data is captured in the provider’s PCI-certified environment.
• Tokenization for any recurring or stored-card scenario (preneed contracts, payment plans).
• Virtual terminal with PCI-compliant infrastructure for phone payments, so staff enter card data into the provider’s secure portal rather than your own systems.
• Support for high-ticket transactions without arbitrary per-transaction limits that force you to split payments awkwardly.
• Next-day or same-day funding, which matters significantly when you’re covering casket costs, facility fees and third-party vendor payments out of pocket before settlement.

A provider like BAMS can be particularly relevant here. Its merchant accounts include dedicated support specialists and next-day funding for eligible merchants. Both address the cash flow pressure funeral homes face when high-ticket transactions settle slowly.

Anti-patterns: Choosing a gateway based solely on transaction fees without evaluating its PCI compliance support. Using a retail-oriented gateway that caps transactions at $5,000. Accepting a “free” terminal that requires you to handle raw card data internally.

Success indicators: Your chosen gateway supports hosted payment capture and tokenization. Your merchant account accommodates transactions above $15,000. You have written confirmation of the provider’s PCI DSS compliance certification (their Attestation of Compliance, or AOC).

Step 3: Implement Access Controls and Network Segmentation

Objective: Ensure that only authorized personnel and systems can access cardholder data and that your payment systems are isolated from the rest of your network.

Even with a hosted payment page reducing your scope, you still have systems that interact with payment data. Your virtual terminal, your arrangement office computers and any integration between your payment gateway and your accounting or funeral management software all need protection.

Assign unique login credentials to every staff member who accesses the payment system. After all, shared logins are a PCI violation and make it impossible to trace who did what. Implement role-based access: your arrangement counselors need the ability to initiate payments, but they don’t need access to settlement reports or refund capabilities. Your bookkeeper needs settlement data but shouldn’t be able to process new transactions.

Network segmentation keeps your payment terminal and virtual terminal computer on their own network segment (or VLAN). Meanwhile, computers used for email, web browsing and general office work stay on a separate segment. As a result, this prevents malware on an office computer from reaching your payment systems. If your funeral home uses a single flat network (one Wi-Fi network for everything), this is a critical vulnerability to address.

Anti-patterns: Sharing a single login across all staff. Running payment processing on the same computer used for email and web browsing. Connecting your payment terminal to the guest Wi-Fi network. Giving every employee full administrative access to the payment portal.

Success indicators: Each user has a unique credential. Roles limit what each user can access. Payment systems are on a segmented network. You can produce an access log showing who accessed the payment system and when.

Step 4: Secure Online and Invoice-Based Payment Channels

Objective: Protect the online and remote payment methods families use, particularly emailed invoices and website payment portals, from data interception and third-party script attacks.

This step addresses a growing risk. Verizon’s 2024 Payment Security Report found that 40% of scripts identified across 7,000 large websites were present on payment pages, with an average of 18 scripts per page. Notably, each script is a potential vector for data skimming. For funeral homes offering online payment portals or emailed invoice links, this risk is real.

The most effective mitigation is using hosted payment fields provided by your gateway. The family clicks a payment link in your invoice. They enter their card information in a form served directly by your payment provider’s secure servers. As a result, your website or email system never handles the card data. This approach also simplifies your PCI self-assessment significantly.

Audit the Scripts on Your Payment Page

If you maintain a website with a payment page, audit every third-party script running on that page. Analytics trackers, chat widgets, social media pixels and font loaders all execute code that could be compromised. PCI DSS v4.0.1 requires merchants with payment pages to inventory, authorize and monitor the scripts on those pages. Remove anything non-essential.

For emailed invoices, use your payment provider’s built-in invoicing tool rather than sending card-on-file request forms via email. Email is inherently insecure for transmitting card data. Therefore, any process that involves a family emailing you their card number is a PCI violation.

Anti-patterns: Embedding a custom-built payment form on your website that captures card data directly. Running unmonitored third-party scripts on your checkout page. Accepting card numbers via email, fax, or voicemail. Using invoice templates that ask families to write card numbers into a form field.

Success indicators: Hosted payment fields capture all online and invoice payments. Your payment page runs only essential, inventoried scripts. No one transmits card data via email.

Step 5: Configure Transaction Monitoring and Chargeback Defense

Objective: Detect fraudulent transactions before they settle and defend against chargebacks that can cost you thousands on high-ticket funeral service payments.

Funeral homes also face a specific chargeback risk profile. A $12,000 charge from a grieving family member may be disputed weeks later by another family member who wasn’t present at the arrangement conference. Or someone may use a fraudulent card for a preneed contract. Because your average transaction is large, a single chargeback can represent a significant financial hit. In fact, the chargeback fee itself (typically $25 to $100) is just the beginning. You also risk losing the full transaction amount plus the cost of services already rendered.

Configure your payment gateway’s transaction monitoring tools to flag unusual patterns. For example, watch for multiple high-value transactions from the same card in a short period. Also flag transactions from locations outside your service area or card-not-present transactions above a threshold you define.

For chargeback defense, maintain thorough documentation: signed arrangement contracts, itemized invoices, delivery confirmations for merchandise and authorization records for every transaction. BAMS offers a proactive chargeback defense program with instant dispute alerts, giving you time to respond with documentation rather than absorbing the loss.

Anti-patterns: Ignoring chargeback alerts until funds are withdrawn. Failing to keep signed authorization records. Relying solely on the card network’s default fraud filters without customizing thresholds for your transaction profile.

Success indicators: You’ve configured transaction monitoring rules for your typical transaction size and frequency. You maintain a documentation file for every transaction above a defined threshold. Someone reviews chargeback alerts within 24 hours.

Step 6: Complete Your PCI Self-Assessment and Establish a Maintenance Cycle

Objective: Formally validate your compliance status and build a repeatable process for maintaining it year over year.

Once you deploy your payment stack with the architecture decisions from the previous steps, you need to complete the appropriate PCI Self-Assessment Questionnaire. Suppose you’ve used hosted payment fields and don’t store, process, or transmit cardholder data on your own systems. Then you likely qualify for SAQ A, the shortest and simplest questionnaire. Still, your payment provider should confirm which SAQ applies to your integration model.

Complete the SAQ honestly. After all, it’s not a test to pass; it’s a diagnostic tool that reveals gaps. Funeral homes commonly stumble in a few areas. For example, some lack a written information security policy or a process for updating payment system passwords. Still others skip annual staff training on data handling procedures. PCI compliance fees from your processor (typically $70 to $120 per year) should include access to compliance tools and support for completing your SAQ. If your processor charges significantly more without providing these resources, that’s a red flag.

Your Compliance Calendar

Establish a quarterly and annual maintenance cycle:

• Quarterly: Review access logs, update passwords, verify that all payment system software is patched. Run a network vulnerability scan if your SAQ requires one.
• Annually: Complete the SAQ and update your cardholder data environment map (Step 1). Then conduct staff security training and verify your payment provider’s current AOC.

Anti-patterns: Treating the SAQ as a one-time checkbox. Paying PCI compliance fees without actually completing the assessment. Assuming your payment provider’s compliance covers your obligations (it doesn’t; you each have separate responsibilities).

Success indicators: You’ve completed your SAQ and filed it with your acquiring bank or processor. You have a calendar with quarterly and annual compliance tasks. Staff have completed security awareness training within the past 12 months.

Practical Examples: How This Looks in a Funeral Home Setting

Scenario: The Two-Location Family Operation

Consider a family-owned funeral home with two locations, processing approximately 300 services per year with an average transaction of $9,500. They accept payments in person at the arrangement conference and over the phone for preneed contracts. Families who prefer to pay after services get emailed invoices.

Before restructuring, they used a standalone card terminal at each location (compliant). They also accepted card numbers over the phone by writing them on arrangement forms (non-compliant). In addition, their PDF invoices asked families to call in card details (non-compliant). Their PCI scope was broad because card data touched paper files, office phones and staff computers.

After restructuring, they deployed a hosted virtual terminal for phone payments. Staff now enter card data into the provider’s secure portal, not a paper form. They switched to emailed invoice links with hosted payment fields on the provider’s secure page. They also implemented tokenization for the 15% of families who set up payment plans on preneed contracts. As a result, their PCI scope contracted to SAQ A, their paper card-data handling dropped to zero and their quarterly compliance review takes under two hours.

Scenario: The High-Ticket Pre-Need Contract

A family purchases a $22,000 preneed funeral package, paying $5,000 upfront and $1,000 monthly for 17 months. Without tokenization, the funeral home would need to store the family’s card number for recurring charges, creating a persistent data-storage liability. With tokenization, however, the payment gateway stores the card data and issues a token. The funeral home’s billing system references the token to initiate each monthly charge without ever possessing the actual card number. If the funeral home’s systems are breached, the tokens are useless to attackers.

Common Mistakes and Pitfalls

Assuming your terminal vendor handles everything. Of course, your card terminal provider is responsible for the terminal’s PCI certification. You are responsible for how you use it, how your network is configured and how your staff handles card data outside the terminal.

Ignoring phone payments. Many funeral homes process a significant portion of payments over the phone. If staff write card numbers on paper or enter them into non-compliant systems, you have a PCI gap regardless of how secure your in-person terminal is.

Confusing your provider’s compliance with your own. Your payment gateway and merchant account provider must be PCI compliant. But their compliance doesn’t satisfy your obligations. You have a separate, independent requirement to complete your own SAQ and maintain your own security controls.

Overlooking state-specific regulations. Funeral home payment workflows may involve trust account requirements, preneed contract regulations and consumer protection rules. These interact with your payment processing in ways that don’t apply to retail businesses. Consult your state funeral board’s requirements alongside PCI standards.

Treating compliance as a one-time project. PCI compliance is a continuous process. Systems change, staff turn over, threats evolve. The funeral home that was fully compliant last year may have gaps today if they haven’t maintained their controls.

What to Do Next

Start with Step 1. Map every point where card data enters your business. You can complete this single exercise in an afternoon. It will reveal your actual compliance posture more clearly than any vendor pitch or compliance checklist. From there, evaluate whether your current payment gateway and merchant account support the architecture decisions outlined in Step 2.

Your current setup may require you to handle raw card data in ways that expand your PCI scope unnecessarily. If so, explore providers who offer hosted payment capture, tokenization and dedicated account management to help you through the transition. The goal isn’t perfection on day one. It’s a clear, documented path toward a payment system that protects your families’ data and satisfies your compliance obligations. That lets you focus on the work that actually matters.

Revisit this guide quarterly as a reference. Compliance isn’t a destination; it’s a rhythm. Each cycle gets easier as your documentation matures and your team builds familiarity with the process.

Frequently Asked Questions

What is a payment stack and why is it important for funeral homes?

A payment stack is the complete set of tools involved in accepting, processing and settling payments. For a funeral home, this typically includes a payment gateway, merchant account, card terminal, virtual terminal for phone payments and an online payment portal. Each component must be PCI compliant individually and you must secure the connections between them. A well-designed payment stack reduces your compliance burden, protects family payment data and ensures funds settle quickly enough to cover your operational costs.

How can funeral homes ensure PCI compliance when processing phone payments?

Phone payments are one of the most common compliance gaps in funeral homes. The solution is a PCI-compliant virtual terminal provided by your payment gateway. Staff enter card data directly into the provider’s secure web portal rather than writing it on paper or typing it into a local spreadsheet. This keeps raw card data off your systems entirely. Never ask families to leave card numbers on voicemail and never transmit card data via email or fax.

Do funeral homes need to complete a PCI Self-Assessment Questionnaire?

Yes. Every business that accepts card payments must validate PCI compliance, regardless of size. Most funeral homes are Level 4 merchants based on transaction volume. If you use hosted payment fields and don’t store or process card data on your own systems, you likely qualify for SAQ A, which is the simplest questionnaire. Your merchant account provider should help you determine which SAQ applies and provide tools to complete it.

What PCI compliance fees should a funeral home expect to pay?

Legitimate PCI compliance fees typically range from $70 to $120 per year and should include access to a compliance portal, SAQ completion tools and support resources. Your processor may charge significantly more without providing these services. Or you may be paying a fee but have never completed a self-assessment. Either one is a sign your current arrangement needs scrutiny.

Is tokenization necessary for funeral homes that offer payment plans?

We strongly recommend tokenization for any funeral home that stores payment methods on file for recurring billing, preneed contracts, or installment plans. Without it, you’re storing raw card data in your systems. That dramatically increases your PCI scope and your liability in the event of a breach. With tokenization, your payment provider stores the card data and gives you a token that has no value if stolen.

How does choosing the right payment gateway affect PCI compliance difficulty?

Your payment gateway choice is the single biggest factor in determining how complex your PCI compliance will be. A gateway that offers hosted payment fields, tokenization and a PCI-compliant virtual terminal can reduce your self-assessment from hundreds of questions to a few dozen. A gateway that requires direct API integration or stores card data on your servers adds work. You’ll need to manage network segmentation, intrusion detection, encryption key management and quarterly vulnerability scans.

Sources

South Carolina Legislature: 2023-2024 Bill 4116, Funeral Contracts

Visa: Biannual Threats Report, Fall 2024

Recorded Future: Annual Payment Fraud Intelligence Report 2024

PCI Security Standards Council: Just Published, PCI DSS v4.0.1

PCI Security Standards Council: The Verizon 2024 Payment Security Report