Payment Gateway
PCIComplianceHubLast updated
A service that passes transaction data from a merchant e-commerce site or point-of-sale system through to a payment processor. Gateways often provide hosted payment pages, iframes or tokenization, which can substantially reduce a merchant cardholder data environment and change which Self-Assessment Questionnaire applies. Using a gateway does not remove the obligation to comply; it changes the scope of what must be assessed.
Applies to. No PCI DSS v4.0.1 requirement names a payment gateway; under the standard it is a third-party service provider that transmits or processes account data for the merchant, so Requirement 12 asks the merchant to list it, hold a written agreement with it, confirm its PCI DSS status each year and record which requirements each side owns. How the merchant connects to the gateway sets the merchant's own scope: under the SAQ Instructions a full redirect or a gateway-hosted iframe supports SAQ A, a merchant page that embeds the gateway's fields or posts card data straight to it points to SAQ A-EP, and a merchant whose own systems touch the card data before it reaches the gateway is on SAQ D. The gateway's compliance is its own as a service provider, evidenced by its AOC, and does not stand in for the merchant's.