PCI DSS Compliance Guide: Rules, SAQs & HK Merchant Steps

If your business accepts, processes, stores, or transmits card payment data in any form, PCI DSS already applies to you — regardless of size, and regardless of whether you're a solo online seller or a large retailer.

This isn't a Hong Kong law, but it's enforced just as firmly, through your merchant agreement with your acquiring bank or payment processor.

This guide won't just define PCI DSS. It'll walk you through confirming it applies to you, finding your merchant level, working out which compliance questionnaire fits your business, and what actually changed in the current version that took effect in 2025.

What Is PCI DSS?

PCI DSS stands for Payment Card Industry Data Security Standard — a set of security requirements created by the major card networks (Visa, Mastercard, American Express, Discover, and JCB) to protect cardholder data. It's administered by the PCI Security Standards Council, a body those card networks jointly established.

Who Actually Enforces It in Hong Kong

PCI DSS isn't Hong Kong legislation — it's a contractual requirement, built into your merchant agreement with whichever bank or payment processor lets you accept cards. HSBC, Bank of China (Hong Kong), Standard Chartered, and every other acquiring bank in the city require merchants to comply as a condition of processing card payments.

The HKMA doesn't administer PCI DSS directly, but it does endorse a Code of Practice for Payment Card Scheme Operators that oversees how card schemes operate locally, reinforcing the same security expectations from the regulatory side.

In practice, this means both your bank and the broader regulatory environment expect the same thing: your cardholder data has to be handled securely.

The Current Version

PCI DSS v4.0.1 became the only active version on 31 March 2025, replacing the older v3.2.1. If your business hasn't reviewed its compliance setup since before that date, it's worth assuming something has changed, covered later in this guide.

3 Terms People Mix Up: Compliance, Validation, and Certification

These 3 words get used interchangeably, but they describe different things, and mixing them up causes real confusion.

• Compliance is the ongoing, day-to-day state of actually meeting the 12 requirements — it's a continuous practice, not a document you file once.
  
• Validation is the formal act of proving that compliance to your acquiring bank, usually by completing and submitting the correct SAQ every 12 months.
  
• Certification, strictly speaking, applies to the small minority of large merchants who need a full on-site audit by a Qualified Security Assessor — most SMEs never reach this tier.
  

A business can be technically compliant day-to-day while still failing to validate it on time, and vice versa — which is why both the practice and the paperwork matter separately.

How to Become PCI DSS Compliant

Here's the practical path from "does this apply to me" to fully compliant and staying that way.

Step 1: Confirm PCI DSS Applies to You

For almost every business reading this, the answer is yes — but it's worth being precise about why.

PCI DSS applies if you accept, process, store, or transmit cardholder data in any form, including businesses that fully outsource their checkout to a third party like Stripe or a hosted payment gateway. Outsourcing reduces how much you need to do, but it doesn't remove your obligation entirely.

Step 2: Find Your Merchant Level

Card networks sort merchants into 4 levels based on annual transaction volume, and your level determines how you need to validate compliance.

[Table:1]

Most Hong Kong SMEs fall into Level 4. This is the lightest validation tier, but it's worth confirming your actual numbers with your acquiring bank rather than assuming, since crossing a threshold changes what's required of you.

Step 3: Identify the Right Self-Assessment Questionnaire

Once you know your level, the next practical step is figuring out which SAQ (Self-Assessment Questionnaire) type matches how your business actually handles card data.

• SAQ A applies if you've fully outsourced your checkout to a third-party provider and never see or touch raw card numbers — the lightest questionnaire, with the fewest requirements to work through.
  
• SAQ A-EP applies if your website influences the payment page (even via an iframe or redirect you control) without directly handling card data yourself.
  
• SAQ B or B-IP applies to businesses using standalone card terminals not connected to other systems, common for smaller physical retail setups.
  
• SAQ D is the most extensive, applying to merchants who store, process, or transmit cardholder data directly within their own systems.
  

Your payment gateway or acquiring bank can usually tell you exactly which SAQ applies, since they already know how your integration is set up. Getting this step right matters — completing the wrong SAQ either leaves gaps or creates unnecessary extra work.

The gateway you choose has a direct effect on your compliance burden. Hosted solutions like Shopify Payments or a well-integrated payment gateway generally keep you in SAQ A territory, while custom-built checkout flows tend to push businesses toward the more demanding SAQ A-EP or SAQ D categories.

Step 4: Work Through the 12 Core Requirements

PCI DSS is built around 12 requirements, grouped under 6 broader objectives. Here's what they actually cover.

• Install and maintain a firewall to protect cardholder data from unauthorised network access.
  
• Never use vendor-supplied default passwords or other default security settings on any system.
  
• Protect stored cardholder data, using encryption and strict data retention limits.
  
• Encrypt cardholder data during transmission across open or public networks.
  
• Use and regularly update antivirus and anti-malware protection on all relevant systems.
  
• Develop and maintain secure systems and applications, patching known vulnerabilities promptly.
  
• Restrict access to cardholder data to only those employees who genuinely need it for their role.
  
• Assign a unique ID to every person with system access, so actions can always be traced to an individual.
  
• Restrict physical access to cardholder data, covering both paper records and physical devices.
  
• Track and monitor all access to network resources and cardholder data.
  
• Test security systems and processes regularly, including vulnerability scans and penetration testing where applicable.
  
• Maintain an information security policy that's actively followed, not just written and filed away.
  

For most Level 4 businesses using a hosted checkout, many of these requirements are largely handled by your payment provider already. The SAQ A questionnaire reflects this — it's short precisely because outsourcing removes most of the infrastructure-level burden from your business directly.

Step 5: Know What Changed in v4.0.1

If your business has been treating PCI DSS as a one-time setup from years ago, the current version introduced changes worth checking against.

• Passwords must now be at least 12 characters, up from the previous minimum of 7, and must combine letters and numbers.
  
• Password rotation every 3 months is required unless multi-factor authentication is in use, giving businesses a real incentive to adopt MFA rather than just cycling passwords.
  
• Hard-coded passwords in scripts, files, or custom code are no longer allowed, closing off a common but risky shortcut in custom-built systems.
  
• Script management and tamper-detection on payment pages became mandatory on 31 March 2025 (Requirements 6.4.3 and 11.6.1), specifically targeting attacks that inject malicious code into checkout pages.
  

Using a fully hosted checkout page rather than an embedded iframe is 1 practical way to sidestep some of these newer requirements entirely, since the payment page itself sits outside your own infrastructure.

Step 6: Submit and Maintain Compliance

Getting compliant isn't a single event — it's followed by an ongoing annual cycle.

• Complete your SAQ honestly, addressing every applicable requirement rather than treating it as a formality.
  
• Run quarterly vulnerability scans through an Approved Scanning Vendor if your level or SAQ type requires it.
  
• Sign and submit your Attestation of Compliance (AoC) to your acquiring bank, a formal declaration that your business meets the standard.
  
• Set a reminder for renewal. Compliance must be revalidated annually, so treating it as a recurring calendar item avoids scrambling to catch up months later.
  

What Happens If You're Not Compliant

Non-compliance isn't just a theoretical risk — it has direct financial consequences that show up quickly.

• Monthly non-compliance fees. Some processors quietly charge USD 19 to USD 99 a month until compliance is confirmed, a fee many merchants don't even realise they're paying.
  
• Card network fines. Following a breach, Visa and Mastercard can fine your acquiring bank between USD 5,000 and USD 100,000 a month until the issue is resolved — a cost that gets passed straight to you.
  
• Liability for fraud losses. If a breach occurs while you're non-compliant, your business can be held liable for resulting fraudulent transactions and the cost of reissuing affected cards.
  
• Loss of card acceptance entirely. In serious cases, card networks can revoke your ability to accept card payments altogether.
  

Check your monthly processing statement for a "PCI non-compliance fee" line item. It's a common, easy-to-miss charge that disappears the moment your SAQ is confirmed as complete.

Why This Matters Beyond the Fines

The fines and fees are only part of the picture. Industry data breach cost estimates run into the millions of dollars once you factor in forensic investigation, customer notification, card reissuance, and lost business following a publicised breach — figures that dwarf the cost of basic compliance for almost any SME.

For a small or mid-sized Hong Kong business, reputational damage from a breach can be more lasting than any single fine. Customers who lose trust in how their card data was handled don't always come back, even after the technical issue is resolved.

PCI DSS vs Other Compliance Obligations

Hong Kong businesses often juggle several compliance frameworks at once, and it's worth being clear about how PCI DSS relates to the others.

PCI DSS is specific to card payment data — it doesn't replace or cover your obligations under Hong Kong's Personal Data (Privacy) Ordinance (PDPO), which applies more broadly to any personal data your business holds, card-related or not. A business can be fully PCI DSS compliant while still having separate PDPO obligations to meet.

It's also distinct from broader security certifications like ISO 27001. ISO 27001 covers an organisation's information security management system as a whole, while PCI DSS is narrowly focused on cardholder data specifically. Some businesses pursue both, but completing 1 doesn't automatically satisfy the other.

Common Mistakes Hong Kong Businesses Make

A handful of avoidable errors account for most PCI DSS problems.

• Assuming a hosted checkout means no obligations at all. Outsourcing reduces scope significantly, but doesn't eliminate your responsibility to complete the appropriate SAQ.
  
• Treating compliance as a 1-time task. PCI DSS requires annual revalidation, and security controls need to be maintained continuously, not just checked once.
  
• Not knowing which SAQ actually applies. Completing the wrong questionnaire can leave real gaps uncovered while creating unnecessary paperwork elsewhere.
  
• Ignoring the v4.0.1 password and script-management changes. Businesses that haven't reviewed their setup since before March 2025 may already be out of step with current requirements.
  
• Never checking for the monthly non-compliance fee. This quietly recurring charge is 1 of the easiest compliance costs to eliminate once noticed.
  

Reducing Your PCI DSS Scope: The Easiest Path for Most Hong Kong SMEs

For the majority of small and mid-sized Hong Kong businesses, the practical goal isn't building an in-house compliance programme from scratch — it's reducing your PCI DSS scope as much as possible.

"Scope" refers to how many of your own systems come into contact with cardholder data. The fewer systems that touch card data directly, the fewer of the 12 requirements apply to your own infrastructure, and the lighter your SAQ becomes.

Using a reputable, fully hosted payment gateway or checkout provider keeps you in the lightest SAQ category, since you never directly handle raw card data on your own systems. This shifts the bulk of the infrastructure-level burden onto a provider whose whole business depends on getting it right.

That effectively minimises your scope by design, rather than requiring extra security work on your own end.

A Worked Example

Consider a Hong Kong fashion retailer running both a Shopify store and a small physical shop. Online, checkout is fully hosted by the platform's own payment system, which qualifies the business for SAQ A — a short questionnaire covering basic security hygiene, since card data never touches their own servers.

In-store, the business uses a standalone card terminal provided directly by its acquiring bank, which isn't connected to its other systems. That qualifies for SAQ B, a separate but equally short questionnaire — meaning the business completes 2 straightforward assessments each year rather than 1 complex one covering everything.

For businesses comparing gateway options before making this kind of setup decision, our guide on Stripe vs PayPal breaks down how the 2 most common choices differ for Hong Kong SMEs.

For businesses managing the wider picture of payment security alongside card acceptance, our guide on online payment security covers the broader practices worth layering on top of PCI DSS compliance itself.

Why Hong Kong Businesses Choose Aspire

Payment security is 1 part of running a trustworthy business — Aspire helps take care of the rest of your financial operations.

💱 FX spreads from 0.18%, up to 3x cheaper than traditional banks. This applies across 130+ countries and 40+ currencies through Aspire's multi-currency account. It's useful for anything from paying overseas suppliers to settling international payments without losing margin to markup.

💰 1.2% unlimited cashback applies on every corporate card transaction, with no monthly cap. It kicks in automatically on eligible spend, with no minimum threshold to hit first. Over time, it quietly turns routine business spend into working capital.

🌐 Local transfer network, not multi-hop SWIFT chains, is how Aspire routes most payments. This means faster settlement and fewer intermediary fees eating into your payment before it reaches the recipient. It also reduces the chance of funds being held up for review at a correspondent bank along the way.

💸 Fixed USD 8 inbound SWIFT fee, tracked end-to-end with SWIFT GPI, applies when SWIFT is the right rail for your payment. There are no surprise deductions from correspondent banks along the way, so the amount you're quoted is the amount that arrives. You can also download payment confirmation instantly from the app, without calling the bank.

⚡ Approved in as little as 1 business day, with no branch visits and no paperwork stacks. Applications are completed entirely online, from document upload to approval. There's no waiting weeks on a relationship manager to call you back.

Open a free multi-currency business account built for Hong Kong SMEs, or explore how Aspire's corporate card fits into your day-to-day spend.

Frequently Asked Questions

What merchant level applies to most Hong Kong small businesses?

Most fall into Level 4, covering businesses processing fewer than 20,000 e-commerce transactions or under 1 million total transactions annually, though it's worth confirming with your acquiring bank.

What happens if I don't complete my PCI DSS compliance?

You may face a recurring monthly non-compliance fee from your processor, and in the event of a breach, card networks can impose much larger fines and even revoke your ability to accept card payments.

How often do I need to renew my PCI DSS compliance?

Annually. Most businesses also need quarterly vulnerability scans if their SAQ type requires it, on top of the yearly self-assessment or on-site audit.

Can my acquiring bank tell me which SAQ I need to complete?

Yes. Your acquiring bank or payment gateway already knows how your integration is set up and can confirm the correct SAQ type for your specific business.

Do I need separate PCI DSS compliance for online and in-store sales?

Often yes, if the 2 channels use different systems. A business with a hosted online checkout and a separate standalone card terminal typically completes 2 different SAQ types, 1 for each channel.

Is there a cost to becoming PCI DSS compliant?

For most Level 4 businesses using a hosted checkout, completing the SAQ itself is free. Costs mainly arise if you need quarterly vulnerability scans, a consultant's help, or upgrades to outdated systems that fail current requirements.