The version in force
Which version of PCI DSS is current? On November 12, 2026 the council’s document library listed version 4.0.1. The council published it in June 2024 as a limited revision of version 4.0, which dates from March 2022, and said on its blog that the update had “no additional or deleted requirements.”
Version 4.0 was retired on December 31, 2024. The new requirements that 4.0 introduced took effect on March 31, 2025, a date the revision left unchanged.
How tokenization changes the audit
The council’s 2011 tokenization guidance says storing tokens instead of card numbers can reduce the amount of card data in a business, and so the work of meeting PCI DSS. Tokens do not end the obligation. They may simplify validation “by reducing the number of system components” to which the requirements apply.
There are two conditions. The business has to confirm that the card number cannot be retrieved from any system removed from scope, and any system that can turn a token back into a card number must still be protected under the standard. The card data vault that links tokens to numbers, the guidance adds, “often presents the most attractive target for attackers.”
Merchants that outsource all card data handling to validated third parties can use Self-Assessment Questionnaire A, or SAQ A. In January 2025 the council changed it, removing requirements 6.4.3 and 11.6.1 on payment-page scripts. In their place came an eligibility criterion, effective March 31, 2025, under which the merchant confirms its site “is not susceptible to attacks from scripts.”
Who has to prove what
The council writes the standard but does not police it. On November 12, 2026, card network Visa’s compliance page sorted merchants by their yearly Visa transactions.
| Visa merchant level | Yearly Visa transactions | What the merchant files each year |
|---|---|---|
| Level 1 | Over 6 million across all channels, or named Level 1 by any Visa region | Report on Compliance by a Qualified Security Assessor, plus an Attestation of Compliance |
| Level 2 | 1 million to 6 million across all channels | Self-Assessment Questionnaire |
| Level 3 | Fewer than 1 million ecommerce transactions | Self-Assessment Questionnaire |
The same page says compliance is required of every entity that stores, processes or transmits Visa card data, which covers a crypto exchange’s card checkout as much as a clothing store’s. Acquirers, the banks behind each merchant account, must make sure their merchants validate at the right level.
When a merchant falls short, Visa can charge the acquirer or issuer what it calls a non-compliance assessment. That bank pays it, and Visa’s rules bar it from telling the merchant that Visa imposed the charge.
The common mistake
PCI DSS is often taken for a law with a regulator behind it. The council’s About page answers that directly, saying “we do not monitor the implementation of standards.” Whether a business must comply or validate, it says, is up to the payment brands, acquirers and others that run compliance programs.
Its merchant page adds that each of the five founding brands runs its own program. If you accept cards, ask your acquirer which questionnaire applies to you, and check whether your payment tokens really keep card numbers off your servers.