PCI Compliance in United Kingdom

PCI DSS is not a UK law but is mandated by card brands through acquiring bank contracts. The FCA also expects regulated payment institutions to maintain robust security controls consistent with PCI DSS. Non-compliance can result in card scheme fines, higher interchange rates, and FCA supervisory scrutiny.

UK GDPR (retained EU law, amended by the Data Protection Act 2018) requires organisations to protect personal data including cardholder information. While PCI DSS satisfies many UK GDPR technical security requirements, UK GDPR adds data subject rights, lawful basis requirements, and data transfer restrictions that PCI does not address.

Strong Customer Authentication (SCA) under the Payment Services Regulations 2017 requires two-factor authentication for online card transactions. SCA implementation (3DS2) is complementary to PCI DSS — PCI governs the security of cardholder data environments while SCA governs the authentication process. 3DS2 implementations must themselves be PCI compliant.

UK organisations average £140,000 (approximately $177,000 USD) annually for PCI compliance. Small UK merchants using SAQ-A typically spend £12,000–£40,000; large Level 1 merchants and payment service providers can spend £300,000 or more annually.