PCI DSS v4.0 compliance is mandatory for any business that stores, processes, or transmits cardholder data, and the standard's final set of future-dated requirements became enforceable on 31 March 2025. There's no v3.2.1 fallback left — PCI SSC retired it on 31 March 2024, and every Report on Compliance (ROC) or Self-Assessment Questionnaire (SAQ) submitted in 2026 is scored against the full v4.0 standard.
Why this matters
PCI SSC gave businesses a two-year runway between publishing v4.0 in 2022 and retiring v3.2.1 in 2024, then a further year before the toughest new controls became mandatory in 2025. That runway is gone. Fail a requirement in 2026 and you're not just re-doing paperwork — your acquiring bank can suspend your ability to process card payments until you close the gap.
Most teams researching PCI DSS compliance software are trying to solve exactly this problem: evidence collection that used to take weeks now needs to run continuously, not once a year before the audit.
How to prepare for PCI DSS v4.0 compliance
Preparation follows the same six-step sequence regardless of company size:
- Confirm your merchant level and SAQ type with your acquirer — this determines how much of the standard you need to formally validate.
- Run a gap analysis against all 12 PCI DSS requirements, not just the ones that changed in v4.0.
- Close out the previously future-dated controls — these have been mandatory since 31 March 2025 and are the most common cause of failed assessments in 2026.
- Complete a targeted risk analysis for every requirement where you use the customized approach instead of the defined approach.
- Test network segmentation and run the required penetration testing for payment card environments to confirm your cardholder data environment is actually isolated.
- Automate evidence collection ahead of your ROC or SAQ submission so proof of each control is ready on demand, not assembled the week before the audit.
Skip step 3 and you fail on a technicality even if your security posture is otherwise solid. Skip step 6 and you'll spend more time producing evidence than fixing anything.
Merchant Level 1: over 6 million transactions a year
Level 1 merchants process the highest transaction volume and face the strictest validation: an annual on-site assessment by a Qualified Security Assessor (QSA) and quarterly network scans. Verdict: budget for a QSA-led assessment, not a self-assessment.
Merchant Level 2: 1 million to 6 million transactions a year
Level 2 typically allows an SAQ completed by internal staff, though some acquirers still require a QSA depending on card brand rules. Verdict: confirm directly with your acquirer before assuming self-assessment is enough.
Merchant Level 3: 20,000 to 1 million e-commerce transactions a year
Level 3 merchants usually qualify for a self-assessment questionnaire, but scope still covers every system that touches cardholder data, including third-party payment plugins. Verdict: map your data flow before you pick an SAQ type.
Merchant Level 4: under 20,000 e-commerce transactions a year
Level 4 merchants get the lightest validation burden but carry the same underlying security requirements as Level 1. Verdict: don't mistake a lighter validation path for a lighter security bar.
Why PCI DSS v4.0 preparation varies by business
How much work v4.0 adds to your 2026 roadmap depends on a handful of factors:
- Whether you store cardholder data or only pass it through a hosted payment page — storage adds significant scope.
- Your existing SAQ type — SAQ A environments face far less work than SAQ D.
- Cloud vs on-premise infrastructure — cloud environments need documented shared-responsibility mapping with your provider.
- Whether multi-factor authentication already covers all access to the cardholder data environment, not just admin accounts.
- How mature your evidence trail already is — teams still collecting evidence manually lose the most time closing v4.0 gaps.
- Whether you've adopted the customized approach for any requirement, which triggers the targeted risk analysis obligation.
Manual evidence collection is the single biggest reason PCI DSS v4.0 compliance projects run late. OneClickComply automates evidence collection across frameworks, so the same proof you gather for Cyber Essentials or ISO 27001 doesn't have to be rebuilt from scratch for a PCI audit — see how it applies to automating evidence collection for audits.
Automate your compliance evidence
Stop rebuilding audit evidence from scratch every cycle.
What's new in PCI DSS v4.0 compared to v3.2.1?
PCI DSS v4.0, first published in 2022, adds requirements for multi-factor authentication on all access to the cardholder data environment, targeted risk analyses for customized controls, and stricter password and encryption standards. Most of these were future-dated and only became mandatory on 31 March 2025, which is why many businesses are only now dealing with them in full in 2026.
Is PCI DSS v4.0 mandatory now in 2026?
Yes — PCI DSS v4.0 is fully mandatory in 2026, with no active fallback to v3.2.1, which was retired on 31 March 2024. Every assessment submitted this year is measured against the complete v4.0 standard, including the requirements that were future-dated at launch.
Do I need a Qualified Security Assessor for PCI DSS v4.0?
Whether you need a QSA depends on your merchant level: Level 1 merchants require an annual QSA-led assessment, while Levels 2 through 4 often qualify for a self-assessment questionnaire. Card brand rules and your acquirer's own policy can override the general thresholds, so confirm directly before assuming which path applies.
Frequently asked questions
One last thing
The control most compliance teams underestimate isn't a new technical requirement — it's the targeted risk analysis obligation tied to the customized approach. If you're using any customized control instead of the defined approach anywhere in your PCI DSS v4.0 compliance programme in 2026, that analysis has to be documented and kept current, not written once and filed away.