Compliance and certification, planned from day one
We help issuers, acquirers, processors and terminal makers prepare for PCI, EMVCo, card network and 3-D Secure requirements, designing compliance into the architecture so assessments and approvals run to plan.
What our clients are up against
Standards that keep evolving
Payment Card Industry Data Security Standard (PCI DSS) requirements introduced in v4.0 became mandatory in March 2025, and EMVCo and card network rules update on their own cycles.
Scope that grows quietly
As platforms add channels, vendors and cloud services, the systems in scope for each assessment tend to grow with them.
Approvals on the launch path
A new card product, terminal or wallet often can't go live until network and EMVCo approvals are complete.
How we cover Compliance & Certification
PCI DSS and data security
Reduce scope and prepare clear evidence for your assessment.
- PCI DSS v4.0.1 gap assessments and remediation roadmaps
- Readiness for the requirements mandatory since March 2025
- Scope reduction through tokenization and network segmentation
- Targeted risk analyses and customized approach documentation
- PCI DSS for issuing, acquiring and tokenization platforms
- Evidence preparation for your Qualified Security Assessor (QSA)
Device and PIN security
Prepare terminals, PIN processing and keys for PCI review, including acceptance on commercial off-the-shelf (COTS) devices such as phones.
- PCI PIN Transaction Security (PTS) device approval preparation
- PCI Software-based PIN Entry on COTS (SPoC) readiness
- PCI Mobile Payments on COTS (MPoC) readiness
- PCI PIN Security requirements for PIN processing and keys
- TR-31 key block adoption and key ceremony documentation
- Hardware Security Module (HSM) controls and evidence
EMVCo and card network certification
Bring cards, terminals and platforms through each approval step.
- EMVCo Level 1, Level 2 and Level 3 certification preparation
- Card scheme compliance for Visa, Mastercard, Amex and Discover
- Issuer, acquirer and processor network certification testing
- Terminal and transit validator certification and testing
- NFC mobile payments and wallet certification
- Transit standards compliance, including ITSO and CIPURSE
Authentication and regulation
Meet authentication rules while keeping checkout smooth for cardholders.
- 3-D Secure (3DS) Access Control Server (ACS) integration
- Strong Customer Authentication (SCA) compliance and exemption strategy
- Risk-based authentication and adaptive controls
- Open banking and the revised Payment Services Directive (PSD2)
Ways to work with us
Certification readiness
Gap assessments, remediation plans, test preparation and evidence packs ahead of each assessment or approval.
Architecture review
An independent review that shows where design choices can reduce compliance scope and effort.
Program advisory
A senior advisor who keeps compliance, certification and launch timelines aligned across your teams and vendors.
Build your team's capability
These modules build on our existing acquiring, issuing, terminal and fraud programs and can be combined into one compliance curriculum.
Request informationModules (some proposed)
- PCI DSS Compliance for Acquirers
- PCI DSS Issuer Compliance Training
- PCI DSS Compliance for Tokenization
- PCI PTS and PCI SPoC Certification Workshop
- 3-D Secure and SCA Integration
- Transit Validator Certification and Testing
- PCI DSS v4.0.1 Readiness WorkshopProposed
- EMVCo and Card Network Certification PlanningProposed
Services, case studies and tools
Do you perform PCI DSS assessments?
Your formal assessment is performed by a QSA or, where eligible, completed through a Self-Assessment Questionnaire (SAQ). Our role is preparation: we help you reduce scope, close gaps, document controls and assemble evidence, so your assessor reviews a well-prepared environment and your team knows what to expect.
What changed with PCI DSS v4.0.1?
PCI DSS v4.0 introduced the customized approach, targeted risk analyses and new requirements such as multi-factor authentication for all access to cardholder data environments and controls on payment page scripts. Version 4.0.1 clarified the wording, and the future-dated requirements became mandatory on March 31, 2025. We help you confirm each one is implemented and evidenced.
Can you help us certify with the card networks?
Yes. We help issuers, acquirers and processors prepare for Visa, Mastercard, Amex and Discover certification: interpreting requirements, preparing test cases and host configuration, and analyzing results during testing. The networks and their accredited partners grant the approvals; we help you arrive ready.
How does 3-D Secure relate to Strong Customer Authentication?
3-D Secure is the most widely used way for card issuers to apply SCA to online payments. It shares rich transaction data so issuers can approve low-risk purchases without a challenge and ask for extra verification only when needed. We help issuers integrate an ACS and design exemption and risk-based authentication strategies.
Let's plan your next assessment together
Talk to a senior consultant about your compliance and certification roadmap.