Fintech & Digital Assets
ISO 20022 and the remittance counter: what exchange houses need to change
Cross-border payment messages have moved to ISO 20022. The richer data only helps if it is captured correctly at the counter and in the app.
Fintech & Digital Assets
PCI DSS v4: what changed for merchants and acquirers
The requirements that were "best practice" until March 2025 are now mandatory. Most of them land on payment pages, authentication and the way risk is documented.
PCI DSS version 4 was published in 2022 with a long runway: dozens of new requirements were marked as future-dated and only became mandatory on 31 March 2025. Many organisations passed their first v4 assessment before that date and are now meeting the full standard for the first time.
Payment pages are now in scope in a new way
Card skimming no longer needs access to a server. A malicious script loaded into a checkout page can copy card details as the customer types. Two requirements deal with this directly:
- every script on a payment page must be inventoried, authorised and checked for integrity;
- a change- and tamper-detection mechanism must alert on unauthorised changes to the page and its HTTP headers.
For merchants who host their own checkout, this usually means a content security policy, subresource integrity and a monitoring tool. For merchants using an embedded payment form, it means confirming with the provider what is covered and what is not.
Authentication and access
Multi-factor authentication is now required for all access into the cardholder data environment, not only remote and administrative access. Passwords for application and system accounts must be managed and rotated, and the default minimum length for user passwords is now twelve characters.
Risk you have to write down
Version 4 lets organisations set the frequency of some activities themselves, such as how often to review logs or change certain credentials, but only on the basis of a documented targeted risk analysis. Assessors will ask to see it. The same applies to the customised approach, which allows alternative controls if you can show they meet the objective.
Other changes worth noting
- automated mechanisms to review audit logs;
- authenticated internal vulnerability scans;
- protection against phishing for staff;
- an annual confirmation of PCI DSS scope.
Where to start
Map every payment flow end to end, including the scripts and third parties involved, and confirm the scope before buying tools. Most of the new effort sits in a few places, and a clear data-flow diagram is the fastest way to find them. Our payments team designs card environments for PCI DSS from the start, and our cybersecurity team tests them before the assessment.
