From Filing Cabinet to Functional: A Practical PCI DSS Review for UK Merchants
Photo: Francisclarke, CC BY-SA 4.0, via Wikimedia Commons
For many UK merchants, PCI DSS arrives as an annual form from the acquirer, is signed by someone senior, and is then filed away until the next renewal. That approach may satisfy a deadline, but it rarely produces a compliance file that would withstand scrutiny. As payment channels multiply and terminal estates become more varied, the paperwork needs to reflect the operation rather than the other way around. A short, structured review can expose the gaps before they become a problem.
Begin with payment channels, not the questionnaire
The most common source of confusion is selecting a Self-Assessment Questionnaire, or SAQ, without first mapping how cards are actually accepted. A merchant may run a countertop terminal, a mobile unit, a virtual terminal for telephone orders, a website checkout and a pay-by-link facility. Each channel can change the applicable SAQ and the evidence the acquirer expects.
Start by listing every route by which card data enters the business. For face-to-face payments, note whether terminals are standalone, connected to an electronic point of sale system, or part of a validated point-to-point encryption estate. For card-not-present sales, distinguish between fully outsourced checkout pages, virtual terminals and mail order or telephone order processes. The PCI Security Standards Council publishes SAQ types ranging from A to D, but eligibility depends on how systems are configured, not simply on the label a provider uses. Where there is doubt, ask the acquirer to confirm the correct SAQ in writing.
Shared responsibility does not mean shared indifference
Terminal providers, payment processors and ecommerce platforms often manage significant parts of the card payment chain. That does not transfer every obligation away from the merchant. Responsibility is usually divided: the provider may secure the terminal or hosted payment page, while the merchant remains responsible for its own users, procedures, physical security and oversight of third parties.
Ask for a written summary of who does what. Who applies terminal software updates? Who manages remote support access? Who supplies the provider attestation or certificate? Who notifies whom if an incident occurs? Keep the current provider evidence with the merchant’s own records, and check that it has not expired. A provider’s compliance status is useful, but it does not cover a shared laptop used for refunds, a paper diary containing card details, or an administrator account that has never been reviewed.
The evidence gaps that matter most
A signed SAQ is only one part of the picture. In practice, the gaps that cause difficulty are often ordinary operational records. A terminal inventory may be missing serial numbers or locations. The SAQ may be signed and dated but describe a business model that no longer exists. Remote support may be permanently enabled without logs. Staff may know how to process a refund but not how to recognise a suspicious card-testing attempt.
Other frequent issues include storing paper receipts that contain full card details, failing to remove leavers from payment administration accounts, and relying on a generic incident response plan that has never been tested. If the business uses an ecommerce channel, check whether the payment page is fully hosted or partially integrated, because that affects both the SAQ and the evidence required. If an acquirer requires quarterly external vulnerability scans, confirm that the scan provider is approved and that the latest report is on file.
A ten-minute annual check-up
A practical review does not need to become a project. Set aside ten minutes and work through a short checklist.
First, reconcile every card acceptance channel with the SAQ on file. Second, confirm the SAQ version, completion date and eligibility with the acquirer. Third, update the terminal register: serial number, location, connection type, provider and encryption status. Fourth, review administrative access, including remote support arrangements and former staff. Fifth, obtain current compliance evidence from each payment provider. Sixth, check storage and retention: no sensitive authentication data should be retained, and paper receipts should be secured or destroyed under a defined process. Seventh, confirm who is responsible for patching and updates. Eighth, verify that incident response contacts and notification routes are current. Ninth, record staff training and policy sign-off. Tenth, save the evidence in one dated folder.
Make the file useful between renewals
Compliance becomes far less burdensome when it is treated as a rolling record rather than an annual scramble. Keep a simple one-page register of payment channels, SAQ type, terminal estate, provider contacts and evidence dates. Assign an owner. Set a calendar reminder ninety days before the renewal date, and a shorter quarterly prompt to check that nothing material has changed.
Merchants should also put a few direct questions to their acquirer: which SAQ applies to the current setup, whether a full SAQ or attestation of compliance is required, whether the terminal estate is validated for point-to-point encryption, what evidence is expected for shared responsibilities, and what notification timeline applies to incidents. The answers should be recorded and revisited when systems change.
PCI DSS is not primarily a test of paperwork quality. It is a test of whether controls can be demonstrated. A ten-minute review, repeated at sensible intervals, helps UK merchants keep the evidence aligned with the operation and reduces the risk of discovering a material gap only when the renewal form arrives.
