Scale the volume. Not the cardholder data environment.
Payment companies grow faster than their compliance scope can be redrawn. We design scope deliberately, prove it with testing before your QSA arrives and keep it small as volume climbs.
What is at stake.
- 01
Validation level
Volume growth turns a self-assessment into a full Report on Compliance.
- 02
Partner due diligence
Banks and enterprise merchants ask for SOC 2, test letters and evidence of secure development.
- 03
Fraud & takeover
Every new rail and API brings a new way to abuse credentials and refunds.
Where the exposure actually sits.
- R1
Scope creep
Shared identity, logging and CI/CD quietly pull systems into scope.
- R2
E-commerce skimming
Compromised scripts capture card data before tokenization.
- R3
API abuse
Broken authorization, replayable webhooks and weak merchant onboarding.
- R4
Key management
HSMs and key ceremonies that work on paper but not in production.
The rules that shape the work.
The instruments that set the bar in this sector, and what each one demands.
PCI DSS v4.0.1
Global (card brands)The only active version. Requirements future-dated to 31 March 2025, including 6.4.3 and 11.6.1, now apply.
PCI PIN, P2PE, 3DS and SSF
Global (card brands)Separate PCI SSC programs, each with its own assessor qualification.
PSD2 and the incoming PSR / PSD3
EUSCA remains under PSD2. PSR/PSD3 was politically agreed in November 2025, with formal adoption pending.
DORA
EUPayment and e-money institutions have been in scope since 17 January 2025.
How we respond.
Each engagement is scoped to your regulator, your deadline and the evidence your assessor will ask for.
A payment facilitator preparing its first Report on Compliance.
Growth had pulled a shared Kubernetes cluster, the identity provider and logging into scope. We traced card-data flows, moved tokenization to the edge and tested segmentation before the assessment window opened.
Questions clients ask us.
When do we need a Report on Compliance instead of an SAQ?
Card brands and your acquirer set validation levels, mainly by transaction volume and entity type. We confirm your level with your acquirer and plan the validation that matches it.
Do SAQ A merchants still need to manage payment-page scripts?
The January 2025 SAQ A revision replaced 6.4.3 and 11.6.1 with an eligibility criterion about script attacks. Meeting it still needs a defensible basis, so a script inventory remains good practice.
Who signs our ROC?
An independent PCI SSC-listed QSA company. MarkTillson does the work that decides the outcome: scoping, remediation, segmentation testing and evidence, then we sit beside you through fieldwork and coordinate your quarterly ASV scans.
Talk to a practitioner who knows your sector.
Tell us what you are preparing for. A senior practitioner who has done this work will reply within one business day.