At-a-Glance
PCI DSS 4.0 replaced version 3.2.1 in 2024, but a batch of “future-dated” requirements were treated as optional best practices until March 31, 2025 — when they became fully mandatory. If your last compliance review happened before that date, or treated those requirements as optional, your next assessment could turn up gaps. Here’s what changed, and what to check with your processor.
Why This Matters Now
“PCI compliance” isn’t a one-time box to check — it’s a standard that gets revised, and 2026 is the year the newest revision stopped giving anyone a grace period. The future-dated requirements added under PCI DSS 4.0 became mandatory on March 31, 2025, and compliance platforms now describe 2026 as the year “we’re still catching up” stops being an acceptable answer during an assessment.
The stakes are real. Verizon’s 2026 Data Breach Investigations Report — drawing on tens of thousands of security incidents — found that vulnerability exploitation rose to 31% of initial access vectors, and third parties were involved in nearly half of all breaches. Payment data is exactly the kind of asset these attacks target.
What Actually Changed
PCI DSS 4.0.1 (a minor clarifying update to 4.0, not a new set of requirements) is now the only active version of the standard. The meaningful shift isn’t the version number — it’s that the “future-dated” requirements first introduced in 4.0 are no longer optional. These cluster around a few themes:
- Stronger authentication. Expanded multi-factor authentication requirements for anyone accessing the cardholder data environment.
- Payment page integrity. New requirements to inventory and monitor scripts running on payment pages, catching tampering or skimming attempts.
- More rigorous vulnerability management. Enhanced penetration testing and more frequent scanning expectations.
- Formalized risk analysis. Documentation requirements that make “we assessed this informally” no longer sufficient.
What This Means for Your Business
Most small and mid-size merchants don’t handle PCI compliance directly — it’s built into the POS and payment processing systems they use. But that doesn’t mean it’s automatic. It’s worth asking your processor directly:
- Is our current setup validated against the full PCI DSS 4.0.1 standard, including the requirements that became mandatory in March 2025?
- If we last completed a Self-Assessment Questionnaire (SAQ) before that date, has it been updated?
- Are we using tokenization or point-to-point encryption to reduce how much of our own system falls into PCI scope in the first place?
That last question matters more than it sounds. The less of your own environment that touches raw card data, the smaller your compliance burden — and the fewer places a breach can happen.
The Practical Takeaway
You don’t need to become a compliance expert. You need a payment partner who keeps your systems current against the standard as it evolves. If it’s been more than a year since anyone reviewed your setup against the current standard, that review is overdue.
Make Sure Your PCI Compliance Is Current
Don’t assume your payment environment is fully compliant just because it passed a previous review. Media Payments Group can help you evaluate your current payment setup, identify potential PCI DSS 4.0.1 gaps, and determine whether your technology and compliance processes are aligned with today’s requirements.
Contact Media Payments Group today to review your payment environment and stay ahead of your next compliance assessment.
FAQ
Do I need to do anything if my processor handles PCI compliance?
Ask them directly whether your setup is validated against the full 4.0.1 standard, including the requirements that became mandatory in 2025. Many merchants assume this happened automatically — confirm it did.
What’s the risk of not being compliant?
Non-compliance can mean higher fees from your processor, and in the event of a breach, significantly higher liability and potential card network penalties.
How does tokenization reduce my PCI scope?
Tokenization replaces card numbers with a non-sensitive substitute in your systems, meaning less of your environment touches actual card data — which shrinks what an assessor needs to review.