Fintech & Digital Assets
PCI DSS v4: what changed for merchants and acquirers
The requirements that were "best practice" until March 2025 are now mandatory. Most of them land on payment pages, authentication and the way risk is documented.
Payment Solutions
Online and in-store payment acceptance, card issuing and payment routing for banks, acquirers, merchants and billers.
Overview
A merchant in Muscat today is asked to accept debit and credit cards, Apple Pay and Google Pay, QR codes, bank transfers and, increasingly, instalment plans. Each method arrives through a different provider with its own contract, settlement file and fee schedule. We build the acceptance and back-office layer that brings them into one checkout and one reconciliation.
For banks and acquirers we work on the other side of the transaction: merchant onboarding, SoftPOS roll-outs, card issuing programmes and the switch and HSM integration behind them. Card-data environments are designed for PCI DSS from day one, and our cybersecurity team tests them before certification.
What the service covers
| Service | What it covers | Typical components |
|---|---|---|
| Payment gateways and acquiring | Online and in-store acceptance with tokenization, 3-D Secure, smart routing and real-time reconciliation. | E-commerce, 3-D Secure, Smart routing |
| SoftPOS and smart POS | Turn phones and Android terminals into secure card and QR acceptance points for merchants of any size. | SoftPOS, Tap to Pay, QR |
| Instant and account-to-account payments | Integration with domestic instant-payment schemes, open-banking APIs and request-to-pay flows. | Instant payments, Open banking, Request to pay |
| Card issuing and processing | Virtual and physical debit, prepaid and corporate cards, with tokenized wallets and spend controls. | Virtual cards, Apple Pay / Google Pay, Spend controls |
| Payment orchestration | One integration that routes each payment to the best provider by cost, success rate and currency. | Multi-acquirer, Failover, Unified reporting |
How we deliver
Discovery and regulation
We map the product, the users, the licences required and the partners who hold them.
Architecture
A modular, API-first design that adds rails, currencies and assets without a rebuild.
Build and integrate
Platform engineering and connections to banks, schemes, exchanges, custodians and blockchains.
Secure and certify
Penetration testing, PCI and ISO controls, and audit evidence before launch.
Operate and grow
Monitoring, reconciliation, support and continuous improvement under service levels.
From our insights
-
-
Fintech & Digital Assets
ISO 20022 and the remittance counter: what exchange houses need to change
Cross-border payment messages have moved to ISO 20022. The richer data only helps if it is captured correctly at the counter and in the app.
-
Fintech & Digital Assets
Digital asset custody: hot, warm and cold, and the controls between them
Losses at exchanges and custodians rarely come from broken cryptography. They come from weak controls around keys, approvals and withdrawals.
Talk to us about Payment Solutions
Send us the details and the practice lead will reply within one business day.