Question 1

What is PCI DSS v4.0 and who must comply?

Accepted Answer

PCI DSS v4.0 is the latest version of the Payment Card Industry Data Security Standard, published by the PCI Security Standards Council in March 2022 and fully mandatory from 31 March 2025. It applies to every organisation that stores, processes, or transmits cardholder data — issuers, acquirers, processors, gateways, and merchants. Compared to v3.2.1 it introduces the "customised approach" to controls, adds 64 new requirements (53 of them future-dated to March 2025), and formalises continuous validation rather than annual point-in-time audit posture. Two of the most operationally significant additions are Requirements 6.4.3 and 11.6.1, which require integrity monitoring of all third-party scripts on payment pages, affecting every public-facing checkout flow.

Question 2

How does Strong Customer Authentication (SCA) under PSD2 affect card-not-present payments?

Accepted Answer

SCA, introduced under PSD2 and fully enforced in the UK from 14 March 2022, requires two-factor authentication for in-scope electronic payments. For card-not-present transactions it is implemented through 3-D Secure 2.x, which exchanges 100+ data points between merchant, gateway, acquirer, and issuer to enable risk-based and frictionless authentication. SCA exemptions — transaction risk analysis (TRA), low-value, recurring, and merchant-initiated — are central to commercial conversion. Getting the exemption strategy wrong can cut authorisation rates by several percentage points.

Question 3

What is the difference between card issuing and card acquiring?

Accepted Answer

Card issuing is the business of providing payment cards (debit, credit, prepaid, virtual) to end cardholders — covering credit decisioning, BIN management, card production, and lifecycle servicing. Card acquiring is the business of enabling merchants to accept card payments — provisioning POS terminals or eCommerce gateways, processing authorisation and settlement, managing chargebacks, and remitting funds. Issuers and acquirers sit on opposite sides of every transaction, connected through the card networks (Visa, Mastercard, UnionPay).

Question 4

What is 3-D Secure 2.x and why does it matter for fraud and conversion?

Accepted Answer

3-D Secure 2.x is the protocol used to authenticate cardholders during online transactions, replacing the older 3DS 1.0. It supports frictionless authentication based on device and behavioural data, mobile-native flows (in-app SDK, biometric prompts), and richer risk signals shared with issuers. For merchants and acquirers it is both a fraud control and a commercial lever: under PSD2, a successful 3DS 2.x authentication shifts liability from merchant to issuer for in-scope transactions.

Question 5

What is tokenisation and how does it relate to PCI scope?

Accepted Answer

Tokenisation replaces the primary account number (PAN) with a non-sensitive token that has no value outside the system that issued it. Properly implemented, tokenisation removes systems from PCI DSS scope because they never store or process PAN data in the clear. The card networks operate their own tokenisation services — Visa Token Service (VTS) and Mastercard Digital Enablement Service (MDES) — which underpin Apple Pay, Google Pay, and click-to-pay flows. Tokenisation is also central to stored credentials, recurring billing, and merchant-initiated transactions.

Question 6

What does it take to integrate with Visa and Mastercard as a card issuer?

Accepted Answer

Direct issuer integration with Visa and Mastercard requires becoming a principal network member or operating under a BIN sponsor, completing network certification testing (VCMS for Visa, MTF for Mastercard), implementing the relevant message specifications (ISO 8583 historically, ISO 20022 increasingly), and meeting connectivity and resilience requirements. End-to-end issuer onboarding typically runs 9–18 months for a principal member and 3–9 months under a BIN sponsor, depending on scope, geography, and the issuer's existing platform.

Question 7

What is the difference between authorisation, clearing, and settlement?

Accepted Answer

Authorisation is the real-time approval of a transaction at the point of payment — the issuer confirms funds and risk posture and the merchant receives an approval code. Clearing is the post-transaction exchange of transaction records between acquirer and issuer through the network's clearing system, typically in batches. Settlement is the actual movement of funds: the issuer pays the network, the network pays the acquirer, and the acquirer pays the merchant, net of interchange and scheme fees. Authorisation completes in milliseconds; clearing and settlement run on T+1 or T+2 cycles, with funds availability governed by network and acquirer agreements.

Question 8

How do real-time fraud detection systems work for card payments?

Accepted Answer

Real-time card-fraud detection systems score each transaction against learned fraud patterns inside the authorisation window — typically under 100 milliseconds end-to-end. Modern systems combine rules engines (for explicit policy and regulatory controls), supervised machine-learning models trained on historical fraud labels, unsupervised anomaly detection, and graph analytics for ring detection. Inputs span transaction attributes, device fingerprints, behavioural biometrics, merchant category risk, and 3DS data points. Outputs feed back into network-level controls, issuer step-up authentication, and case management.

Card Payments

Industry Challenges

Our Solutions

Card payments by the numbers

Global

UK Debit Cards (UK Finance, Jan 2026)

UK Credit Cards (UK Finance, Jan 2026)

Frequently asked questions about card payments

Services We Provide

Solution Design

Custom Rust Development

IT Audit

Relevant Expertise

Let's solve your Card Payments challenges