We use essential cookies to run this site. Analytics & marketing cookies load only with your consent — see our Cookie Policy and Privacy Policy.

Talk to an expert
PCI SSC-qualified QSA Company

PCI DSS assessment for payment gateways

Payment gateways route card transactions between merchants, acquirers and networks, so they sit squarely in scope for PCI DSS — and, because they touch other parties’ card flows, acquirers almost always require Level 1 (an on-site Report on Compliance). CyberSigma is a PCI SSC-listed QSA Company that assesses gateways end to end on PCI DSS v4.0.1: scoping and CDE reduction, gap assessment, remediation support, the on-site QSA assessment, and the signed RoC and AoC your partners and RBI PA-PG authorisation require.

Get a free gateway readiness snapshot →Book a 20-minute QSA call
Who needs it

Who this is for

Payment gateways and technology providers routing card transactions, whether standalone or embedded in an aggregator, who must evidence PCI DSS to acquirers, networks and RBI under the PA-PG framework.

Scope & regulation

Scope and rules

Scope is the CDE — transaction routing, tokenisation, key management, logging and any card-data touchpoint. RBI PA-PG guidelines require PCI DSS compliance for authorisation; PCI DSS v4.0.1 applies, enforced by acquirers and Visa/Mastercard/RuPay(NPCI)/Amex.

Timeline & cost

Timeline and cost

Timeline
First-time Level 1: three to six months (scoping, remediation, on-site RoC/AoC).
Cost factors
CDE size after reduction, first-time vs repeat, remediation/tooling, and recurring ASV/pentest.
Deliverables

What you receive

Gap assessment
Control-by-control findings and remediation roadmap.
RoC / AoC
The signed forms partners and RBI PA-PG authorisation require.
Common failures

Where gateways fail

  • Key-management and cryptography gaps in the routing layer
  • MFA not enforced for CDE access (v4.0.1)
  • Logging/retention gaps across the transaction path
  • Under-scoped CDE that unravels on evidence sampling
Proof

See how we’ve done it before

Relevant case study
How a routing platform reduced scope and reached a clean RoC for PA-PG. Read case studies →
Redacted sample deliverable
Inspect a redacted gap report first. Request a redacted sample →

Not sure how close you are to a clean ROC?

Get a free PCI DSS v4.0.1 readiness snapshot from a listed QSA — share your work email and we map your gaps and scope before the assessment.

PCI DSS for payment gateways — FAQs

Do payment gateways need Level 1?

Almost always. Because gateways route other parties’ card data, acquirers typically require Level 1 — an on-site assessment and Report on Compliance — regardless of your own volume.

Is PCI DSS mandatory for RBI PA-PG authorisation?

Yes. RBI’s PA-PG guidelines require PCI DSS compliance, evidenced by the official PCI SSC AoC/RoC, as a precondition for authorisation.

Talk to a listed QSA about your gateway

We map your routing CDE, right-size scope and give you the fastest path to a clean RoC/AoC. Reply within four business hours.

Book a 20-minute QSA call →

Ready to discuss your PCI DSS for payment gateways requirement?

CERT-In empanelled · PCI QSA authorised — a senior consultant responds within 4 business hours. Free, no obligation.