Comprehensive Embedded Payment Security: PCI DSS 4 Compliance

The Payment Card Industry Data Security Standards, more commonly known as PCI DSS, are the minimum standards set for data security by a consortium of financial institutions under the umbrella of the Payment Card Industry Security Standards Council (PCI SSC). The goal of the organisation, established by Mastercard, Visa, American Express, Discover and JCB, is to standardise security around payments data to ensure consumers, banks, and organisations are assured of solid protection.

Compliance with PCI DSS is complex and time-consuming. It requires that a company go through extensive compliance processes across more than 300 security controls and criteria that are mapped out across more than 1,800 pages of documentation. This is why it’s considered an achievement to get compliance - an achievement that gives a business a solid security stamp of approval.

And, it has recently changed.

PCI DSS has undergone several iterations since it was first released and the most recent version is PCI DSS Version 4. This takes all the high-end security and compliance expectations laid out in PCI DSS V3.2.1 and adds even more to ensure that systems are better designed to address emerging threats and technologies. As of March 31, 2024, PCI DSS V3.2.1 will be replaced by V4, and companies must implement all required amends by March 31, 2025, to remain compliant.

What’s the difference between PCI DSS V3.2.1 and V4?

The PCI DSS has released a comprehensive summary of changes between the two versions that you can read right here, but the upshot is the following:

• The changes are designed to help companies stay ahead of increasingly sophisticated cyber-threats.
• Version 4 is focused on the process of continuous security, which is far more agile and capable of addressing the changing security threat landscape.
• The most notable change is that companies aiming for PCI DSS 4 compliance can follow a Customised Approach.
• New requirements are included in the documentation around reporting, transparency, and assigned roles and responsibilities.
• More support for payment technology innovation that allows for increased flexibility and more options for companies to achieve their security objectives.
• Improvements to verification methods and procedures to ensure reporting and verification are more in-depth.

Why PCI DSS Version 4 Is Critical for Security

The number of documented changes within PCI DSS V4 take companies that have invested in compliance into an even more rigorous and agile security posture. The document covering just the explanation around the changes is 36 pages long, so while it is not a complete re-imagining of PCI DSS, it is a comprehensive shift that raises the security bar significantly.

Some of the standout security steps that make this an absolutely essential security move for organisations operating in this space are its focus on NIST Password Guidance, the partnership with Europay, Mastercard and Visa to implement a 3DS Core Security Standard and more rigorous password requirements. These all tie into more robust identity and access management (IAM) capabilities to mitigate fraud and threats around cardholder and payments data.

Why Use PCI DSS?

Why should companies working with embedded finance pay attention to PCI DSS V4? The short answer is security, but the longer answer is that it has become critical for customer data to have rigorous protections. These ensure that companies comply with multiple regulations and legislations currently governing the management of customer data - regulations and legislations that are evolving at pace with the environment - and that they can also offer their customers ongoing peace of mind.

Any other reasons? Why yes, the most important are:

• The new standards outlined in PCI DSS V4 shine a spotlight on previously overlooked security vulnerabilities and areas that are often the cause of successful incidents and breaches.
• The robust authentication standards and the opening of new ways of managing authentication within compliance expectations emphasise the importance of access control and management within this sector.
• Cardholder data has to be encrypted throughout every transaction and process, be it in motion or at rest, which means that it is secured throughout and potentially bypasses the risk of malicious code becoming embedded in networks or data.
• Regular security assessments mean that companies are constantly checking, evolving and adapting their security protocols and awareness which then has the knock-on effect of ensuring that security is thorough throughout.

Security By Design

Even though the deadline for compliance with PCI DSS V4 is only mandatory as of 31 March 2024, UNIPaaS has already completed its certification and achieved full compliance. This is a critical investment into our embedded finance solution and the ongoing security of our services and our customers.

Why? Because every one of the essential factors now revised and revisited by this new certification level is relevant now, today. The threats that ignited this change are here, right now. The security vulnerabilities that could result in fraud, a breach or serious financial loss are happening, right now. Investing in meeting these fresh and relevant PCI DSS V4 requirements puts us ahead of the security game and ensures we are prioritising the security expectations of our customers.

We know that financial services and solutions will always be a tasty snack for cybercrime organisations and that by investing in the latest standards and security expectations from trusted organisations such as PCI SSC, we are doing our best to stay ahead of the security game.   

Authentic Security

PCI DSS V4 is bolstering the UNIPaaS offering, which already prioritises security across every touchpoint throughout the integration, development and execution processes. We offer Strong Customer Authentication through 3DS; automated Know Your Customer (KYC), Know Your Business (KYB) and Anti-Money Laundering (AML) checks; PSD2 compliance; and robust anti-fraud and anti-money laundering prevention tools. In short, we put security at the forefront of our business, so you can rest assured that your embedded payment solution from UNIPaaS is not just exceptional at its job. It’s solid and secure on every level.

Find out more about how you can trust us to give you maximum security with minimal worry, thanks to our security commitments right here.