PCI DSS v4.0.1 is the current version of the card data security standard, and all of its requirements now apply to PayFacs, PSPs and other service providers handling cardholder data. For a PayFac, compliance means continuous security validation, payment page script controls, authenticated scans, stronger authentication and a documented scope, much of which a white-label payment infrastructure can carry.
The transition period is over: requirements that were "best practice" until 2025 are now mandatory in every assessment. This article, updated in October 2026, explains what PCI DSS v4.0 is and who it applies to, what changed from v3.2.1, which requirements became mandatory and when, how PayFacs should adapt authentication, scanning and testing, how to reduce compliance scope, and what to do beyond compliance.
What is PCI DSS v4.0 and who does it apply to?
The Payment Card Industry Data Security Standard is set by the PCI Security Standards Council, founded by the major card schemes. It applies to every entity that stores, processes or transmits cardholder data, or can affect its security: merchants, and service providers such as PayFacs, PSPs, processors and hosting providers.
Version 4.0 was published in March 2022. Version 4.0.1, a limited revision with clarifications and no new requirements, was published in June 2024, and according to the PCI Security Standards Council, v4.0 was retired on December 31, 2024, leaving v4.0.1 as the only active version.
What changed from PCI DSS v3.2.1 to v4.0 for PayFacs?
Three shifts matter most. Security becomes continuous rather than annual, with more requirements for ongoing monitoring and defined review frequencies. Organizations can use a customized approach to meet a requirement's objective with their own controls, provided they document and test them. And many frequencies are set through a targeted risk analysis instead of fixed intervals.
For a PayFac, which onboards and supervises many sub-merchants, the standard also raises expectations on how responsibilities are split and documented between the PayFac, its providers and its merchants.
Which v4.0 requirements became mandatory and when?
Requirements introduced as "future-dated" in v4.0 became mandatory on March 31, 2025. Among those most relevant to PayFacs:
- Payment page scripts: an inventory and authorization of every script on payment pages, with integrity controls (requirement 6.4.3).
- Change and tamper detection on payment pages (requirement 11.6.1).
- Authenticated internal vulnerability scans (requirement 11.3.1.2).
- Multi-factor authentication for all access into the cardholder data environment (requirement 8.4.2).
- Passwords of at least 12 characters (requirement 8.3.6).
- Targeted risk analyses to justify the frequency of controls (requirement 12.3.1).
Password rotation every 90 days is no longer a blanket rule: it applies only when a password is the single authentication factor (requirement 8.3.9).
How should a PayFac adapt authentication, scanning and pentesting?
Move access to the cardholder data environment to multi-factor authentication everywhere, including for administrators and third parties, and review service accounts. Configure internal scans with credentials, which requires dedicated scan accounts and care in environments that contain production data.
Penetration testing should cover segmentation controls at the frequency required for service providers, and the customized approach can be used where a PayFac's architecture, such as zero-trust access, meets objectives differently. Involving the CISO and CTO early avoids discovering gaps at assessment time.
How can a PayFac reduce its PCI DSS scope with a white-label payment infrastructure?
By keeping card data out of its own systems. When card details are captured in hosted fields or a hosted checkout, stored in a certified vault and replaced by tokens, the PayFac's own environment never handles full card numbers, and much of the standard's scope moves to its infrastructure provider.
On NORBr, card capture, vaulting and tokenization run on a platform validated as a PCI DSS service provider by a Qualified Security Assessor and listed on the Visa Global Registry of Service Providers. Platform operations and security and Scheme Ready describe the controls the platform carries for operators.
What should PayFacs do beyond compliance?
Treat PCI DSS as a minimum. The same controls that satisfy assessors, such as script monitoring, strong authentication and continuous testing, also reduce fraud and protect the merchants a PayFac onboards. Merchant-facing security, such as clear sub-merchant responsibilities and document review and compliance during onboarding, completes the picture.
Security also sells: PayFacs that can show their compliance posture win the trust of larger merchants and partners. The build or buy article covers what compliance costs when the platform is built in-house.
_%2520a%2520game%2520changer%2520for%2520digital%2520transactions_-Cover.webp){kind=spacer}
