PCI DSS v4.0.1 for gambling operators

PCI DSS is the card industry's security standard for anyone who stores, processes or transmits payment card data. It is enforced through contracts with acquirers and card brands rather than law. The current version is v4.0.1, and the 51 requirements that were future-dated under v4.0 have applied since 31 March 2025.

By Martin Huml · Published October 24, 2026

Scope

Operators and suppliers that store, process or transmit card data

Sources checked

October 24, 2026

Next review

January 24, 2027

What PCI DSS is, and is not

The Payment Card Industry Data Security Standard is published by the PCI Security Standards Council. It applies to organizations that store, process or transmit cardholder data, and is enforced contractually through card brands and acquirers. It is not law, but losing the ability to accept cards is a strong incentive.

Key dates

Reducing scope

Most gambling operators reduce their PCI DSS burden by keeping card data out of their own systems: hosted payment pages or fields from a PCI-compliant payment provider, and tokens instead of card numbers. Scope still includes the pages that load the payment form and any system that could affect it, so the website's own security matters. Your acquirer will tell you which validation, such as a self-assessment questionnaire or an on-site assessment, applies to you.

How PCI DSS fits with gambling regulators

The UK Gambling Commission's testing strategy says audits against other standards, such as PCI DSS, may meet some of the RTS security audit requirements, but the RTS audit must still cover all RTS security elements. In the US, state security assessments sit alongside PCI DSS rather than replacing it. Our Great Britain and United States pages cover those audits.

Questions about PCI DSS for gambling