Payments glossary
PCI DSS
PCI DSS (Payment Card Industry Data Security Standard) is the card industry's global security standard for any organisation that stores, processes or transmits cardholder data. Compliance is validated at levels, with Level 1 - independently assessed each year - the most stringent.
What PCI DSS covers
The Payment Card Industry Data Security Standard is the card schemes' unified security rulebook for anyone who touches cardholder data, maintained by the PCI Security Standards Council that the major schemes founded. Its requirements span secure network design, encryption of stored and transmitted card data, access control, vulnerability management, monitoring and testing, and security governance. It is enforced through the commercial chain: acquirers require compliance from merchants, and a breach while non-compliant brings fines and liability on top of the damage itself.
Levels and validation
Compliance is validated at levels tied to role and transaction volume. For service providers - gateways, facilitators, processors - Level 1 is the highest level, demanding an annual on-site assessment by a Qualified Security Assessor rather than a self-assessment questionnaire. African Payment Solutions, the operator of LekkaPay, is a PCI DSS Level 1 compliant service provider. Merchants range from Level 1 for the highest-volume businesses down to Level 4, where a self-assessment questionnaire suffices.
Reducing your scope
The most effective PCI DSS strategy for most merchants is to have as little of it as possible: if card data never touches your systems, most of the standard's requirements fall on your provider instead. A hosted checkout page and tokenisation achieve exactly that - card numbers go straight from the customer to LekkaPay's certified environment, and the merchant's compliance obligation shrinks to a short self-assessment.
Frequently asked questions
What are the PCI DSS compliance levels?
Levels reflect role and transaction volume. For service providers, Level 1 is the highest level of the standard and requires an annual on-site assessment by a Qualified Security Assessor rather than self-assessment. Merchants are graded from Level 1 (the highest-volume businesses, also independently assessed) down to Level 4, validated by self-assessment questionnaire.
Does a small business need to comply with PCI DSS?
Yes - every organisation that stores, processes or transmits cardholder data is in scope, regardless of size. In practice, small merchants comply by keeping card data out of their systems entirely: a hosted checkout or tokenised integration reduces the obligation to a short self-assessment questionnaire.
Is LekkaPay PCI DSS compliant?
Yes. African Payment Solutions, the company that operates LekkaPay, is a PCI DSS Level 1 compliant service provider - the highest level of the standard, validated by annual independent assessment. Merchants using LekkaPay's hosted checkout or tokenisation keep card data off their own systems.
Last updated:
Payments without the jargon.
One integration, every way Africa pays - we'll handle the acronyms.