PCI-DSS Data Security

The Payment Card Industry Data Security Standard (PCI-DSS) sets requirements for merchants to securely handle card payments. This is essential for protecting privacy, preventing fraud and data breaches, and aims to provide protection for sensitive information throughout the card payment lifecycle — from card acceptance to payment processing.

PCI compliance is the result of the Payment Card Industry Data Security Standard jointly implemented by the PCI Security Standards Council and the five major card networks (VISA, Mastercard, Discover, American Express, and JCB). These standards help ensure consistency in cardholder protection measures globally.

Before understanding the PCI-DSS compliance levels you must adhere to, you need to determine your compliance "level" based on the following criteria. Note that the data below is based on the past 52 weeks.

Source: Visa PCI DSS Compliance

Any merchant that accepts card payments (credit or debit) and/or transmits cardholder information must comply with PCI standards and meet the necessary requirements. The specific requirements depend on various factors, including the nature of the organization and the volume and scale of transactions.

KCARDS INC customers with online payment products need to ensure they meet the relevant PCI-DSS compliance requirements. You can refer to the guide below.

Note: If you are a Level 1 merchant and use online payments other than Get Paid/Pay by Link, the following are required:

• A Report on Compliance written by a Qualified Security Assessor or by an internal auditor (with company executive signature)
• Submission of Attestation of Compliance (AOC) form
• Quarterly scans by an Approved Scanning Vendor (ASV)

If you determine that you need to comply with PCI-DSS, KCARDS INC can guide you through the process. If you have completed PCI-DSS forms within the past 12 months, you can provide them to KCARDS INC.

Based on the list above, you can determine which forms you need to fill out. You can download the documents below:

• SAQ A — Word Document
• SAQ A-EP — Word Document
• Attestation of Compliance (AOC)
  • SAQ A - Word Document
  • SAQ A-EP - PDF Document

Card networks may determine "non-compliance" and impose substantial fines. If you fail to correct your PCI-DSS non-compliance within each quarter, fines may double.

Potential consequences of non-compliance:

• Substantial fines (accumulating quarterly)
• Suspension or termination of payment services
• Reputational damage and loss of customer trust
• GDPR violation risks (EU regions)