PCI DSS Certification in India: Process, Cost, Levels and Who Needs It
“PCI DSS certification” is one of the most common compliance searches from Indian businesses that take card payments. The term is slightly misleading. The PCI Security Standards Council does not certify merchants, and there is no single certificate that makes a business compliant. What exists is a validation process, set by the card networks and enforced through acquirers and payment aggregators.
This guide explains what PCI DSS compliance means in India in 2026, whether it is mandatory, how to work out your level and assessment type, what the process involves and what it typically costs.
Quick answer: PCI DSS is a card industry security standard, not an Indian law. Indian businesses become subject to it through contracts with their acquiring bank or payment aggregator, and RBI requires payment aggregators to make sure their merchants meet it. Large merchants (Level 1, over 6 million card transactions a year) need an annual on-site assessment by a Qualified Security Assessor, which vendor estimates put at Rs 10 lakh to Rs 30 lakh or more in the first year. Most small merchants using a hosted checkout validate with a short self-assessment questionnaire (SAQ A) and quarterly scans, often for well under Rs 2 lakh a year.
Which PCI DSS version applies in 2026?
PCI DSS v4.0.1 is the only active version. It was published in June 2024 as a limited revision of v4.0 with clarifications and no new or deleted requirements. Version 4.0 was retired on 31 December 2024, and the future-dated requirements introduced in v4.0 became mandatory on 31 March 2025.
In June and July 2026 the Council ran a request for comments on v4.0.1, which it described as the start of the next iteration of the standard. No new version or publication date has been announced, so assessments in 2026 are against v4.0.1.
Is there such a thing as PCI DSS certification?
Not in the way the phrase suggests. The PCI SSC writes the standards and trains assessors, but it states that it does not enforce compliance or define validation requirements. Those are set by the payment brands (Visa, Mastercard, RuPay and others) and passed to merchants through acquirers.
When an Indian business says it is “PCI DSS certified”, it usually means it holds one of these documents:
| Document | Who completes it | Used for |
|---|---|---|
| Report on Compliance (ROC) | A Qualified Security Assessor (QSA) | Level 1 merchants and service providers |
| Self-Assessment Questionnaire (SAQ) | The business itself | Smaller merchants, as allowed by the acquirer |
| Attestation of Compliance (AOC) | Signed by the business, and by the QSA where one was used | Submitted to the acquirer or aggregator as the summary of compliance |
| ASV scan report | An Approved Scanning Vendor | Quarterly external vulnerability scans |
Validation is annual. A ROC or SAQ completed in 2025 does not cover 2026.
Is PCI DSS mandatory in India?
No Indian statute requires every business to comply with PCI DSS. In practice, it applies to almost every business that accepts cards, through three routes.
- Card network rules. Visa and Mastercard require acquirers to make sure their merchants validate compliance at the right level. Acquirers write this into merchant agreements.
- RBI rules for payment aggregators. The Regulation of Payment Aggregators Directions, 2025 require aggregators to ensure that merchants’ infrastructure complies with PCI DSS and PCI SSF as applicable, to review a merchant’s PCI DSS status at onboarding, and to submit their own ROC and AOC to their IT committee.
- RBI’s card storage rules. Since 1 October 2022, no entity other than card issuers and card networks may store card-on-file data. Merchants may keep only the last four digits and the issuer name for reconciliation, and use tokens for saved cards. This removes much of the scope that PCI DSS would otherwise cover. See our guide to what card data you can store.
Separate from PCI DSS, the CERT-In Directions of April 2022 require covered organisations to report specified cyber incidents within 6 hours and keep ICT logs for 180 days in India. Many PCI DSS controls, such as logging and incident response, help meet these obligations too.
Which PCI DSS level are you?
Levels are set by annual card transaction volume per brand. Visa’s thresholds are below; Mastercard uses the same thresholds for its combined Mastercard and Maestro volume.
| Merchant level | Annual transactions | Typical validation |
|---|---|---|
| Level 1 | More than 6 million, all channels | Annual ROC by a QSA, quarterly ASV scans, AOC |
| Level 2 | 1 million to 6 million | Annual SAQ, quarterly ASV scans, AOC |
| Level 3 | 20,000 to 1 million e-commerce | Annual SAQ, quarterly ASV scans, AOC |
| Level 4 | Under 20,000 e-commerce, or up to 1 million in total | SAQ recommended; acquirer sets requirements |
Service providers, including payment aggregators, gateways and processors, have two levels. Level 1 covers more than 300,000 transactions a year and requires an annual ROC by a QSA. Level 2 covers fewer and may use an SAQ.
An acquirer or aggregator can require a higher validation level than your volume suggests, for example after a breach. Its requirement is the one that applies.
Which self-assessment questionnaire applies to your business?
The SAQ type depends on how you accept cards, not on how big you are.
| SAQ | Who it is for |
|---|---|
| A | Card-not-present merchants that fully outsource card handling, such as a redirect or fully hosted payment page |
| A-EP | E-commerce merchants whose website affects payment security, such as a direct post form |
| B | Imprint machines or standalone dial-out terminals only |
| B-IP | Standalone PTS-approved terminals connected by IP |
| C-VT | Manual entry into a web-based virtual terminal, one transaction at a time |
| C | Internet-connected payment application systems with no electronic storage |
| P2PE | Only terminals in a PCI-listed point-to-point encryption solution |
| SPoC | Card acceptance on commercial phones or tablets with a PCI-listed software PIN entry solution |
| D | All other merchants, and service providers allowed to self-assess |
Most Indian online merchants use a hosted or redirect checkout from their aggregator, which usually points to SAQ A. Since 31 March 2025, SAQ A no longer includes requirements 6.4.3 and 11.6.1 on payment page scripts. Instead, merchants must confirm their site is not susceptible to script attacks that could affect their e-commerce systems. For embedded payment forms such as iframes, the Council’s FAQ says this can be met by protecting the page or by getting written confirmation from the payment provider that its solution includes script-attack protection. In August 2026 the Council revised a related FAQ and told merchants to confirm with their acquirer how these requirements apply.
Our guides to SAQ A vs SAQ A-EP and requirements 6.4.3 and 11.6.1 cover this in detail.
Aggregators publish their own shared-responsibility guidance. For example, Razorpay’s shared responsibility model states that merchants using server-to-server integrations must remain PCI DSS compliant and share their AOC every year. Check your own aggregator’s version before choosing an integration.
What does the PCI DSS compliance process look like?
- Map your card data flow. Identify every system that stores, processes or transmits card data, or can affect its security. This sets your scope. Our guide to PCI DSS scope explains how.
- Confirm your validation path with your acquirer or aggregator: ROC or SAQ, and which SAQ.
- Run a gap assessment against the applicable requirements. Large organisations often use a QSA or consultant for this.
- Remediate gaps. This is usually the longest and most expensive stage.
- Complete testing. External ASV scans every three months, internal and external penetration tests at least every 12 months and after significant changes, and segmentation testing every 12 months (every six months for service providers).
- Complete the assessment: a QSA-led ROC, or your SAQ.
- Submit the AOC, and the ROC if required, to your acquirer or aggregator.
- Maintain controls through the year and revalidate annually.
Timelines vary with scope. Indian QSA firms and consultants quote 4 to 8 weeks for a small merchant on an SAQ path and 3 to 6 months end to end for a first Level 1 assessment, with the on-site assessment itself taking 2 to 4 weeks. Our guide to building an audit-ready PCI DSS program covers how to shorten later cycles.
How much does PCI DSS compliance cost in India?
There is no official price list. The figures below are estimates published by Indian security vendors and consultancies in 2026, and real quotes depend on scope, the number of locations and how much remediation is needed.
| Profile | Estimated first-year cost | Main cost items |
|---|---|---|
| Level 4, SAQ A | Rs 50,000 to Rs 2 lakh | ASV scans (about Rs 20,000 to Rs 60,000 a year), policy work, advisory |
| Level 4, SAQ D | Rs 3 lakh to Rs 13 lakh | Penetration testing, remediation, scans |
| Level 3 | Rs 1.5 lakh to Rs 5 lakh | SAQ support, scans, testing |
| Level 2 | Rs 3 lakh to Rs 8 lakh | SAQ or QSA support, testing, remediation |
| Level 1 | Rs 10 lakh to Rs 30 lakh or more | QSA assessment (about Rs 5 lakh to Rs 12 lakh), gap analysis, scans, penetration testing, remediation |
Two points stand out in the published estimates. First, the QSA’s fee is often not the largest cost; one QSA firm estimates that a first-time Level 1 payment aggregator may spend Rs 25 lakh to over Rs 1 crore on remediation and tooling. Second, renewal years cost less, around 60 percent of the first year in one consultancy’s Level 1 estimate, because the data flow and controls are already in place.
The cheapest way to reduce cost is to reduce scope. A merchant that never touches card data has far fewer requirements to meet than one that does.
How do you choose a QSA in India?
- Check the firm on the PCI SSC’s list of Qualified Security Assessors, and confirm it is approved for India. Check ASVs on the separate ASV list.
- Ask for references in your sector. Assessing a payment aggregator is different from assessing a retail chain.
- Get the scope of the quote in writing: whether it includes gap assessment, remediation support, penetration testing and scans, or only the assessment.
- Keep the assessor independent. A firm that designed and built your controls should not be the one assessing them.
- Ask how much of the assessment can be done remotely, and how evidence will be collected.
How can Indian merchants reduce PCI DSS scope?
- Use a redirect or fully hosted checkout so card details never reach your servers.
- Use network tokens or aggregator tokens for saved cards instead of storing card numbers, as RBI rules already require.
- Use terminals from a PCI-listed P2PE solution for in-store payments.
- Segment networks so that systems that do not need card data cannot reach those that do.
- Keep card numbers out of call recordings, chat transcripts, emails and logs. Our guide to cardholder data discovery explains how to find stray card data.
For a broader introduction, see our PCI DSS guide for small businesses.
Frequently asked questions
Is PCI DSS certification mandatory in India?
There is no Indian law that mandates it for all businesses, but card networks, acquirers and payment aggregators require it, and RBI requires aggregators to ensure their merchants comply. If you accept cards, you are expected to comply.
Who issues PCI DSS certificates?
No one issues a certificate in the formal sense. A QSA produces a Report on Compliance, or the business completes a Self-Assessment Questionnaire, and both lead to a signed Attestation of Compliance that goes to the acquirer.
How long is PCI DSS compliance valid?
Validation is annual. Quarterly ASV scans must also continue through the year.
Do I need PCI DSS if I use a payment gateway?
Yes, but the requirements may be small. A merchant using a hosted or redirect checkout usually completes SAQ A, which is far shorter than a full assessment. Your aggregator will tell you what it needs.
What is the difference between a QSA and an SAQ?
A QSA is an independent assessor approved by the PCI SSC. An SAQ is a self-assessment questionnaire the business completes itself. Level 1 merchants and service providers need a QSA; smaller merchants usually use an SAQ.
How much does PCI DSS cost for a startup in India?
A startup using a hosted checkout and SAQ A can often complete validation for under Rs 2 lakh in the first year, according to vendor estimates. Costs rise sharply if the startup stores, processes or transmits card data itself.
Can Indian merchants store card numbers if they are PCI DSS compliant?
No. RBI’s card-on-file rules apply regardless of PCI DSS status. Only card issuers and networks may store card-on-file data. Merchants use tokens instead.
Which PCI DSS version applies in 2026?
Version 4.0.1. The Council has started consulting on the next version, but no replacement has been published.