Understanding PCI DSS 4.0: What You Need to Know About the New Requirements

A few weeks ago, we talked about PCI-DSS and explaining what it is and why it is important. As a reminder, the Payment Card Industry Data Security Standard (PCI DSS) is an essential set of guidelines designed to help businesses protect payment card data. If you accept, store, process, or transmit cardholder information, PCI DSS compliance is not optional.

Today, we want to take you a bit further and discuss the new version of the PCI DSS – version 4.0 – whose final deadline is approaching in a few months. Introduced in 2022, this update replaced the previous version (3.2.1) and brought key changes that affect all payment actors.

1. More Flexibility for Businesses

One of the main goals of PCI DSS 4.0 is to provide more flexibility in how businesses can meet security requirements. In previous versions, there were often very prescriptive requirements. Version 4.0 introduces the “Customized Approach” for security, giving businesses more freedom to implement their own security controls as long as they meet the core intent of protecting cardholder data.

This approach gives companies the ability to choose the security controls that fit best with their operations. However, it also requires a deeper understanding of security measures to ensure compliance. Acquirers will need to work closely with merchants to make sure these flexible solutions are implemented without compromising security.

2. Stronger Authentication Requirements

Cybersecurity threats have evolved, and PCI-DSS 4.0 reflects the need for stronger protections against attacks like phishing and unauthorized access. The new version emphasizes stronger authentication, particularly for systems that handle sensitive card data.

Key changes include:

Multi-factor authentication (MFA) is now required for all access to the cardholder data environment, not just for administrative access.

More rigorous password policies, including stricter rules for how passwords are created, stored, and managed.

What is MFA?

Multi-factor Authentication (MFA) is a security measure that enhances the protection of online accounts by requiring multiple forms of verification before granting access. Unlike traditional password-only systems, MFA introduces an additional layer by combining something the user knows (like a password) with something they have (such as a code sent to a mobile device), and identity (biometric data like a fingerprint). This dual-step verification process significantly reduces the risk of unauthorized access, as compromising both factors is substantially more difficult for cyber attackers, thereby strengthening overall account security.

Acquirers, PSPs and merchants need to update their authentication practices. Merchants may need to upgrade systems to meet the MFA requirements, while providers must ensure merchants comply to prevent breaches.

3. Greater Focus on Continuous Compliance with the new PCI

Previously, PCI DSS assessments were often conducted as annual snapshots. PCI DSS 4.0 places a stronger focus on continuous security monitoring, encouraging businesses to treat security as an ongoing process rather than a one-time event.

Instead of an annual rush to pass PCI-DSS audits, security should be integrated as a continuous practice. Acquirers and PSPs will need to assist merchants in implementing year-round security monitoring.

Friends paying bill with smartphones at restaurant

4. PCI-DSS Four emphasis on Risk-Based Approaches

PCI-DSS 4.0 encourages businesses to adopt a risk-based approach, focusing on the most vulnerable areas to attacks. This includes maintaining well-configured firewalls, protecting against application vulnerabilities, and managing third-party risks as examples. Different businesses have different risk profiles, so security measures should be tailored accordingly.

Again, payment service providers will need to support merchants in identifying and addressing their highest-risk areas. Merchants should focus their security efforts on protecting the parts of their operations that handle the most sensitive cardholder data.

5. Updated Requirements for Encryption and Data Protection

The new version also includes updated encryption standards and additional requirements for protecting stored cardholder data. Encryption is key to preventing sensitive data exposure during a breach.

Merchants may need to upgrade their systems or software to meet the new encryption standards. Providers should help merchants ensure encryption practices align with PCI DSS 4.0 requirements.

6. Impact on Traveler security

Both Dynamic Currency Conversion (DCC) and Tax Free Shopping (TFS) services involve handling sensitive cardholder data, often across multiple systems and providers. With PCI DSS 4.0’s enhanced security measures, these operations face additional compliance responsibilities.

Black man in yellow T shirt paying with his phone in the store

Stronger data encryption

is required during DCC and TFS transactions, making it necessary for merchants and providers to update their systems to secure cardholder data.

Multi-Factor Authentication (MFA)

must be applied to all access points that handle payment data, impacting how merchants, acquirers, and third-party providers secure their operations.

Black-girl-paying-with-her-credit-card-in-the-cashier

Continuous compliance

becomes more critical, especially since both services often rely on third-party systems. Merchants and acquirers will need to ensure that all parties handling cardholder data are maintaining ongoing security monitoring.

These changes mean that merchants offering DCC or TFS will need to invest in updated technology and security practices, while providers must help monitor and ensure compliance across these more complex transactions. By partnering with us, you can rely on our expertise to manage these requirements seamlessly. We handle the necessary updates, implement robust security measures, and ensure comprehensive compliance, so you can focus on growing your business with confidence.

7. Implementation Timelines

PCI-DSS 4.0 was introduced in 2022, but the previous version (3.2.1) remained valid until March 31, 2024. Since April 1, 2024, PCI-DSS 4.0 is the only valid version, and organizations now need to demonstrate compliance with the baseline requirements of version 4.0.

Regarding more stringent controls, including advanced security measures such as stricter logging mechanisms, enhanced controls for detecting anomalies, and improvements to certain encryption and monitoring standards, businesses have an additional year, until March 31, 2025, to implement them.

The new version of the Payment Card Industry Data Security Standard is a major update aimed at strengthening data security in an evolving digital landscape. With more flexibility, stronger authentication requirements, and a shift toward continuous compliance, businesses need to act now to ensure they meet the new standards.

All stakeholders must collaborate to safeguard cardholder data, particularly in more complex transactions like DCC and TFS. As the final deadline approaches, staying ahead of these changes is crucial to avoid security breaches and protect both businesses and customers form growing cyber threats.

In September, Global Blue successfully completed the PCI DSS audit for Tax Free Shopping and Dynamic Currency Conversion services, making the company fully compliant with the 4.0 version. This accomplishment reflects our commitment to upholding high security standards.

We strive to provide our partners and customers with reliable services, ensuring they can trust us to protect the interests of all stakeholders. As we continue to enhance our security practices, we remain dedicated to delivering secure solutions that meet the highest industry standards.