PCI DSS v4.0 is the current version of the Payment Card Industry Data Security Standard, maintained by the PCI Security Standards Council, with the clarifying v4.0.1 release as the version organisations now assess against. Since 31 March 2025 all of its requirements, including the future-dated ones, have been mandatory. Any UAE merchant, payment service provider, acquirer or hosting company that stores, processes or transmits cardholder data must comply, regardless of size. This guide explains the 12 requirements, what changed from v3.2.1, how validation works and a checklist to get a UAE organisation ready.
Key Takeaways
- PCI DSS v4.0.1 is the only active version; v3.2.1 was retired on 31 March 2024 and all v4.0 future-dated requirements became mandatory on 31 March 2025.
- The 12 requirements are unchanged in structure, but v4.0 added multi-factor authentication for all access to the cardholder data environment, targeted risk analyses, payment-page script controls and a customised approach option.
- Validation depends on your merchant or service provider level: a Self-Assessment Questionnaire for most small merchants, a Report on Compliance by a QSA for Level 1.
- Scope reduction through network segmentation and tokenisation is the fastest way to cut cost and effort.
- UAE banks and payment firms must align PCI DSS with CBUAE requirements; the two overlap heavily but are not identical.
Who Must Comply With PCI DSS in the UAE?
PCI DSS is a contractual standard enforced through the card brands and your acquiring bank, not a UAE federal law. If your organisation accepts Visa, Mastercard, American Express or other branded cards, or provides services that touch card data, your acquirer or partner will require evidence of compliance. That includes e-commerce retailers, hotels, airlines, telecoms, fintechs, payment gateways, call centres and any hosting or managed service provider in the card data flow.
Licensed financial institutions also answer to the Central Bank of the UAE. Our guide to CBUAE cybersecurity requirements explains how those obligations sit alongside PCI DSS.
The 12 PCI DSS Requirements
- 1. Install and maintain network security controls such as firewalls and segmentation.
- 2. Apply secure configurations to all system components; no vendor defaults.
- 3. Protect stored account data through retention limits, encryption, truncation or tokenisation.
- 4. Protect cardholder data with strong cryptography during transmission over open networks.
- 5. Protect all systems and networks from malicious software.
- 6. Develop and maintain secure systems and software, including patching and secure coding.
- 7. Restrict access to system components and cardholder data by business need to know.
- 8. Identify users and authenticate access, including MFA for all access into the cardholder data environment.
- 9. Restrict physical access to cardholder data.
- 10. Log and monitor all access to system components and cardholder data.
- 11. Test the security of systems and networks regularly, including vulnerability scans and penetration testing.
- 12. Support information security with organisational policies, risk assessments and awareness programmes.
What Changed in PCI DSS v4.0
Multi-factor authentication everywhere in the CDE. MFA is now required for all access to the cardholder data environment, not just remote and administrative access.
Targeted risk analyses. Several requirements let you set the frequency of a control based on a documented risk analysis rather than a fixed period.
Customised approach. Organisations can meet a requirement’s objective with a different control, provided a QSA validates it. This suits mature environments with modern architectures.
Payment page protection. Requirements 6.4.3 and 11.6.1 require inventories and integrity monitoring of scripts on payment pages and change-and-tamper detection, a direct response to web skimming attacks.
Stronger authentication and logging. Passwords must be at least 12 characters, automated log reviews are required, and roles and responsibilities must be documented for every requirement.
Continuous compliance. v4.0 expects security to be business-as-usual, with controls operating and evidenced all year rather than only at assessment time.
Validation: SAQ, ROC and Merchant Levels
Validation depends on transaction volume and how you handle card data. Level 1 merchants processing more than six million transactions a year, and most service providers, need an annual on-site assessment by a Qualified Security Assessor producing a Report on Compliance and an Attestation of Compliance. Smaller merchants complete a Self-Assessment Questionnaire; the SAQ type depends on how cards are accepted, from SAQ A for fully outsourced e-commerce to SAQ D for everything else. Quarterly external vulnerability scans by an Approved Scanning Vendor are required for most merchants, and annual penetration testing is required for anyone with an in-scope network. Our guide to penetration testing costs in the UAE covers what PCI-scoped tests involve.
PCI DSS Compliance Checklist for UAE Organisations
- Map every system, person and third party that stores, processes or transmits card data, including call recordings and email.
- Reduce scope: segment the cardholder data environment, tokenise stored PANs and use hosted payment pages or iFrames where possible.
- Confirm your merchant level and SAQ type with your acquirer in writing.
- Enforce MFA for all CDE access and 12-character passwords; align with our IAM best practices for the UAE.
- Deploy centralised logging with daily automated review and 12-month retention; a managed SOC can operate this.
- Run quarterly ASV scans, internal vulnerability scans and annual penetration tests, with segmentation testing every six months for service providers.
- Implement payment-page script inventories and tamper detection for e-commerce.
- Complete targeted risk analyses for the requirements that allow them and document the frequencies chosen.
- Document roles, policies and an incident response plan that includes card brand notification; see our incident response planning guide.
- Assess third parties in the card data flow and obtain their Attestations of Compliance; our third-party risk management guide explains the process.
- Train staff annually and on hire, and keep the evidence.
PCI DSS and ISO 27001 Together
Many UAE organisations already hold or are pursuing ISO 27001. The two frameworks overlap on access control, logging, vulnerability management and policy, so an ISMS reduces PCI effort considerably, but PCI DSS is more prescriptive: it specifies exact controls, frequencies and evidence. Treat PCI DSS as a mandatory control set inside the ISMS rather than a separate programme. Our SOC 2 versus ISO 27001 comparison shows how assurance frameworks stack.
Frequently Asked Questions
Is PCI DSS mandatory in the UAE?
PCI DSS is a contractual requirement enforced by the card brands through acquiring banks and payment partners, so any UAE organisation that accepts or handles branded card payments must comply. Financial institutions are additionally supervised by the Central Bank of the UAE.
What is the current version of PCI DSS?
PCI DSS v4.0.1, a limited revision of v4.0 that clarifies wording without changing requirements. All v4.0 requirements, including the previously future-dated ones, have been mandatory since 31 March 2025.
What is the difference between an SAQ and a ROC?
A Self-Assessment Questionnaire is completed by eligible smaller merchants to attest to their own compliance. A Report on Compliance is produced by a Qualified Security Assessor after an on-site assessment and is required for Level 1 merchants and most service providers.
Does PCI DSS require penetration testing?
Yes. Requirement 11 requires internal and external penetration testing at least annually and after significant changes, plus segmentation testing where segmentation is used to reduce scope. Quarterly external scans by an Approved Scanning Vendor are also required.
How long does PCI DSS compliance take?
A small merchant with outsourced payments can validate in a few weeks. A service provider or Level 1 merchant typically needs three to nine months to reduce scope, implement controls and complete a QSA assessment.
Can we store card numbers if we encrypt them?
Storage of the primary account number is permitted only where there is a documented business need, with strong encryption, key management, retention limits and masking. Sensitive authentication data such as the CVV and full track data may never be stored after authorisation. Tokenisation is usually the better option.
Talk to a UAE Cybersecurity Team
Cybersecurity MEA supports PCI DSS readiness, scope reduction, gap assessments and the annual testing cycle through our regulatory compliance consulting, penetration testing and managed vulnerability scanning. See how we secure banking and payment organisations or request a PCI DSS gap assessment.