Skip to content

PCI compliance

Last updated: 13th January 2022

What is PCI and why it is important?

Any organization involved with the processing, transmission, or storage of card data must comply with the Payment Card Industry Data Security Standards (PCI DSS).

Checkout Technology Ltd, a company within the group, is certified for PCI DSS as a Level 1 Service Provider, which is the highest standard set by the payment card industry to ensure that credit card data is processed, stored or transmitted in a secure environment.

Who is responsible for PCI DSS compliance?

PCI compliance is a shared responsibility between your business and So, when accepting payments, it is essential that you do so in a PCI-compliant manner. The complexity of this depends on your integration methods, but the simplest way is never to see or access your customers' card data. Here are our tips:

What are the requirements?

There are four levels of PCI compliance that merchants are organized under, based upon their card transaction count over a 12-month period. The PCI level in combination with the integration method will determine the compliance requirements for each merchant. If you have any question concerning your PCI obligations please feel free to send an email to

PCI levelTransactions processed / yearKey requirements


  • More than 6 million Visa, MasterCard (combined with Maestro) or Discover transactions.
  • More than 2.5 million American Express transactions.
  • More than 1 million JCB transactions.
  • Any merchant who has had a data incident.
  • Any merchant identified as Level one by one of the schemes.


  • 1 to 6 million Visa, MasterCard (combined with Maestro) or Discover transactions.
  • 50,000 to 2.5 million American Express transactions.
  • Annual self-assessment using the applicable PCI DSS Self-Assessment Questionnaire (SAQ).
  • Quarterly network scan by an Approved Scan Vendor (ASV) where applicable.


  • 20,000 to 1 million Visa, MasterCard (combined with Maestro) or Discover transactions.
  • Less than 50,000 American Express transactions.


  • Less than 20,000 Visa e-commerce transactions and/or process up to 1 million transactions.
  • Every other merchant for MasterCard/Maestro, Diners and Discover, JCB.

What happens if my level changes?

If you reach Level 1 (more than 6 million transactions), we will identify this and contact you to make sure you can provide the relevant documentation and stay compliant.

What documentation do I need to provide to attest of my compliance level with PCI DSS requirements?

The PCI requirements for the different type of integration methods are as follows:

Integration methodDocuments required

Frames or Hosted Payments Page or Payment Links

Your SAQ A (which we will prepare for you).

Full card details API - using your own integration platform

Your SAQ D.

Full card details API with a third-party service provider

Please contact your Customer Success manager.