PCI DSS Requirements by Region: What Changes by Card Brand and Country

Executive Summary: PCI DSS Requirements by Region in Short

You open a second market, and the new acquirer asks which PCI DSS level you sit at "in the region." It sounds like a country question. It is really a question about who sets the rules, because the answer changes depending on whether you mean the standard, the card brand or the law.

The PCI DSS requirements by region do not change. There is one standard, the same twelve requirements under version 4.0.1, wherever a card is accepted. What changes is how you prove it (each card brand runs its own validation program, enforced through your acquirer), what relief you can claim, what a miss costs, and which local laws sit on top.

One boundary up front. This guide is not the merchant level threshold table and not the list of the twelve requirements. For thresholds and SAQ types, see our guide to PCI DSS compliance levels. For the requirements themselves, see PCI DSS compliance requirements. This piece covers what differs by card brand and by market.

By the end, you will be able to name which layer varies, quote the regional rules that exist in writing (Mastercard's hybrid terminal thresholds, Visa's per-country counting, Amex's fee ladder), and walk into an acquirer call with five questions. This is general information, not legal advice.

Here's what's ahead:

• Why the twelve requirements are identical everywhere, and who actually decides what applies to you
• The three layers that do change, and how six card brands set their own programs
• The regional rules inside those programs, including Mastercard's 95 and 75 percent hybrid terminal tests
• A region-by-region walkthrough from North America to Asia Pacific, including what we could not find
• Local laws, fees by brand, and a plan for multi-market merchants

Why PCI DSS Requirements by Region Are the Same Everywhere, on Paper

PCI DSS is a single global standard published by the PCI Security Standards Council, and no country, card brand or acquirer gets its own version of the twelve requirements.

The current version is PCI DSS 4.0.1, published in June 2024. Version 3.2.1 was retired on 31 March 2024, and the future-dated requirements in 4.0.1 became mandatory on 31 March 2025. For what each requirement asks of you, our guide to PCI DSS compliance requirements goes requirement by requirement.

Who Decides What Applies to You: the PCI SSC, Card Brands and Acquirers

The Council describes itself as "a global forum," founded by American Express, Discover, JCB International, MasterCard and Visa Inc. It writes the standard. It does not enforce it. In PCI SSC FAQ 1212, the Council says it does not enforce compliance or define validation reporting, and that the payment brands run those programs.

Visa's own page says the same thing from the other side: the Council owns and maintains the standard, "however, Visa manages all data security compliance enforcement and validation initiatives."

So there are three actors, and each one does a different job.

That is the whole mechanism. The standard comes from one place, and everything that feels regional arrives through the brands, the acquirer or a regulator.

Does PCI DSS Apply Outside the US?

Yes, and the trigger is accepting the brand's cards, not where your company sits. Visa counts a merchant's volume "in one country or with one acquirer per year." American Express publishes the same level table in its data security policies for India, the UK, Australia and Canada. I compared the April 2026 editions side by side, and the tables are identical.

The reverse surprise matters just as much. A US-only merchant has no special exemption. The US is one market with its own relief programs: Mastercard's Risk-based Approach, for instance, is open only to merchants "located outside of the U.S. Region."

PCI DSS Requirements by Region: The Three Layers That Do Change

Everything that varies by region falls into one of three layers, and only the first never moves.

The sections below take layer two, then layer three. What does that change in practice? Mostly the paperwork you hand your acquirer, and occasionally where your data is allowed to live.

PCI DSS Requirements by Card Brand: Six Brands, Six Rulebooks

PCI DSS requirements by card brand come down to two questions: who sets your level, and what you file. Four. That is how many merchant levels American Express publishes, with a Level 4 line at fewer than 10,000 transactions a year, while Discover shows three and JCB two. The card brand you are looking at decides how many boxes you can land in.

Sources: Visa's Account Information Security page and Discover's merchant level page (read October 2026), Mastercard's Security Rules and Procedures, Merchant Edition of 4 August 2026, American Express's April 2026 data security policies, and JCB's Data Security Program page.

For UnionPay, PCI SSC FAQ 1561 confirms it is a Participating Payment Brand included in the PCI DSS documents, and says the impact on an assessment is set by the brands, so you contact your acquirer or the brand.

Visa, Mastercard and Discover: Where the Levels Line Up

The three align more than they differ. Mastercard defers its Level 2 and Level 3 criteria to Visa's, and counts any merchant that meets Visa's Level 1 criteria as Level 1. Discover adds a Level 1 for any merchant that another brand or acquirer treats as Level 1.

The consequence is plain: the highest level triggered by any brand governs, and one brand's decision can pull you up at the others. Mastercard can also place a merchant at Level 1 "in its sole discretion," which may include one with a confirmed account data compromise.

For the full threshold table and SAQ types, use our PCI DSS compliance levels guide. This article does not repeat it.

American Express, JCB and UnionPay: Where the Levels Break Away

American Express publishes four merchant levels: 2.5 million or more transactions (Level 1), 50,000 to fewer than 2.5 million (Level 2), 10,000 to fewer than 50,000 (Level 3), and fewer than 10,000 (Level 4). It also has two service provider levels.

Level 1 merchants must submit a Report on Compliance attestation. Level 2 merchants must submit an SAQ attestation unless they submit a Report on Compliance. Level 1 and Level 2 merchants and all service providers must join Amex's compliance program.

JCB splits merchants into two bands. At one million or more JCB transactions a year you run a quarterly security scan and a yearly on-site review by a QSA. Below that, you complete a yearly self-assessment and a quarterly scan. JCB's page adds a line most readers miss: where a country's own laws or industry standards address PCI DSS, they prevail over JCB's program.

UnionPay is covered in the PCI documents but sets its own program. Ask your acquirer which UnionPay requirements they apply to you.

PCI DSS Compliance by Region: Rules Built Into the Card Brand Programs

Most of what people call "regional PCI rules" is not in PCI DSS at all. It sits inside the brand programs, and a few of those rules are written down with real numbers. This section quotes them, with edition dates, so you can weigh them against what your acquirer tells you.

How Card Brands Count Volume by Country and Acquirer

Brands count volume differently, and the differences decide your level:

• Visa measures the corporate entity's total Visa volume over 12 months, counted "in one country or with one acquirer per year." Volume from independently owned locations, such as franchisees, may be excluded if the corporate entity does not process it.
• American Express rolls volume up to the highest Amex merchant account level, and franchisors include franchisee volume.
• Mastercard gives the acquirer up to one year to bring a merchant to a new level after it moves between levels. That is a grace period for the acquirer, so do not read it as a promise to you.

The practical result: one company can hold different levels in different countries, or at different acquirers.

There is one more regional rule, and it comes from the schemes rather than PCI DSS. The card schemes apply an "area of use" principle, so acquirers and merchants in the same area work together. Adyen's help centre gives an example: Europe-based acquirers can only provide acquiring services for Europe-based merchants, and breaches may bring scheme non-compliance cases and assessments.

Mastercard's Hybrid Terminal Thresholds in PCI DSS Requirements by Region

This is the clearest written regional difference in any card brand document I found. Mastercard's Risk-based Approach is open to a qualifying Level 1 or Level 2 merchant "located outside of the U.S. Region." It cuts validation down to the first two of six milestones in the PCI Prioritized Approach.

The conditions come with a regional percentage. For hybrid terminals (think chip-capable card readers), the tests in Mastercard's Security Rules and Procedures, Merchant Edition of 4 August 2026 are:

• Europe Region: at least 95 percent of the merchant's annual card-present Mastercard and Maestro transactions on hybrid POS terminals
• Asia/Pacific, Canada, Latin America and the Caribbean, and Middle East/Africa Regions: at least 75 percent

The other conditions apply everywhere. The merchant stores no sensitive authentication data, keeps card-not-present and face-to-face environments fully segregated, has had no account data compromise event in the last three years, and runs an incident response plan it tests every year.

Only the Risk-based Approach uses a regional split. The exemption and incentive programs below apply the same test everywhere:

The Compliance and Validation Exemption Program is new. Mastercard announced it in March 2025, and it exempts an eligible Level 3 or 4 merchant from complying with PCI DSS and validating to Mastercard. Treat that as a Mastercard-only relief. Your acquirer, your other card brands and any law that applies to you are separate questions.

Two cautions apply to all of these. A merchant that does not qualify must keep validating annually. And your acquirer may still ask for evidence, because Mastercard's own text says merchants must keep complying with PCI DSS regardless of whether annual validation is required.

PCI DSS Requirements by Region: A Walkthrough From North America to Asia Pacific

Here is the honesty rule for this section: where no region-specific PCI rule exists in writing, it says so rather than filling the space. Several regions get that treatment.

PCI DSS in North America: US and Canada

PCI DSS in North America has no separate US version of the standard. What exists is a set of relief programs and state laws. Mastercard's Risk-based Approach excludes the U.S. Region, American Express's STEP requires contactless for U.S. merchants, and Visa's Technology Innovation Program sets a 75 percent test. Three states also attach their own liability or compliance rules to card data, which the local laws section covers.

Canada sits in Mastercard's 75 percent hybrid group. American Express's Canada policy carries the same four-level table as every other market. I found no Canada-specific PCI DSS requirement in a brand document or a regulator text, and I would not trust a page that claims one without citing it.

PCI DSS in Europe: Hybrid Terminals, PSD2 and GDPR

Europe has the strictest regional number I found: Mastercard's 95 percent hybrid terminal test for the Risk-based Approach. The "area of use" principle also keeps acquiring inside the region.

Two European laws share a checkout with PCI DSS and replace none of it. PSD2 (Directive (EU) 2015/2366) and its strong customer authentication standard, Commission Delegated Regulation (EU) 2018/389, govern how a payer is authenticated. PCI DSS governs how card data is protected. One does not stand in for the other.

GDPR sits on top for personal data in your cardholder environment. For the privacy layer, see our guides to GDPR compliance and the list of GDPR countries. No PCI control automatically satisfies a GDPR duty, and the reverse is just as true.

For the UK, I found no UK-specific PCI DSS rule in a brand document or regulator text. American Express's UK policy uses the same level table as its other markets.

PCI DSS in Asia Pacific: Japan, India and Australia

PCI DSS in Asia Pacific is mostly brand programs plus local law.

• Japan. The amended Installment Sales Act took effect on 1 June 2018. A merchant selling to consumers with credit cards becomes a "Business Operator Handling Credit Card Number" and must take necessary and appropriate measures against leakage, loss or damage, and respond to incidents, according to law firm Anderson Mori & Tomotsune. The Act does not name PCI DSS.
• India. The Reserve Bank of India's circular of 6 April 2018 on storage of payment system data is the most concrete local rule in the region. The local laws section covers it in detail.
• Singapore. McDermott Will & Schulte reports that the Monetary Authority of Singapore includes guidance to follow PCI DSS as a benchmark for financial institutions. That is guidance, so it is not a mandate.
• Australia. American Express's Australia policy carries the same table as every other market, and Mastercard's 75 percent hybrid test covers the Asia/Pacific Region. I found no Australia-specific PCI DSS rule. If your acquirer asserts one, ask for the document.

PCI DSS Requirements by Country in Latin America, the Middle East and Africa

For Latin America, the written regional rules I could verify are Mastercard's 75 percent hybrid terminal test and a line in American Express's fee table: its non-compliance fees are "not applicable in Argentina." I found no Brazil-specific PCI DSS rule.

For the Middle East and Africa, Mastercard's 75 percent test applies. Saudi Arabia is the notable regulator-driven case. McDermott Will & Schulte (July 2025) reports that the Saudi Central Bank's Cyber Security Framework mandates PCI DSS compliance for member organisations.

PCI DSS Local Laws: What Sits on Top of PCI DSS Requirements by Region

PCI DSS compliance is not legal compliance, and legal compliance is not PCI DSS. One is a contract enforced through the card brands. The other is a statute. These PCI DSS local laws sit outside the brand programs entirely.

The India rule has the most operational bite. Under the RBI circular, the entire payment data is stored in systems located only in India. Processing abroad is allowed if the data is deleted abroad and brought back to India within one business day or 24 hours, whichever is earlier, and a copy of the domestic component of a cross-border transaction may be stored abroad. It reaches RBI-authorised payment system providers, banks, and the service providers and gateways they engage.

Three US states show a different pattern:

• Minnesota. Minn. Stat. 325E.64 bars retaining the card security code, the PIN verification code number or the full contents of any track of magnetic stripe data after authorization, and makes a violating entity (or its service provider) that suffers a breach reimburse issuing financial institutions.
• Washington. RCW 19.255.020 lets a financial institution recover reissuance costs from a business that failed to take reasonable care, and gives a safe harbor to one that was "certified compliant" with PCI DSS, validated by an annual assessment no more than one year before the breach.
• Nevada. A 2010 advisory from law firm Hunton reports that its law requires "data collectors" that accept payment cards and do business in the state to comply with PCI DSS. I did not re-read the current statute, so confirm the text with counsel.

The European picture is also moving. The Council of the EU published final compromise texts for PSD3 and a Payment Services Regulation on 23 April 2026, according to law firm Arthur Cox, but adoption and publication in the Official Journal were still to come. PSD2 and its authentication standard remain the rules to plan against until then.

PCI DSS Non-Compliance Fees: What Each Card Brand Can Charge

USD 200,000. That is the ceiling Mastercard's rules set for a fourth noncompliance violation in one calendar year at Level 1 and Level 2. These PCI DSS non-compliance fees are ladders and ceilings that brands publish, so read these numbers as the most a brand's rules allow, and never as an average.

Two details change how the American Express numbers read. They are assessed in local currency equivalents, and they are "not applicable in Argentina." American Express also requires notice of a data incident within 72 hours of discovery.

Visa's row is the one to understand. The assessment goes to the issuer or acquirer, and Visa tells them not to say Visa imposed it on the merchant. Your contract with your acquirer decides whether and how that cost reaches you, which is why the agreement matters more than the brand headline.

Planning PCI DSS Requirements by Region as a Multi-Market Merchant

Turn the map into a plan. For most teams that means six steps, and the first three are an afternoon of emails.

1. List every acquirer and processor by country. Include the ones a platform provider holds on your behalf.
2. Confirm which brands and which volumes each one counts. Ask for the legal entity as well.
3. Map your highest level across brands. The highest one triggered by any brand governs.
4. Check which relief programs you can claim. Look at Mastercard's Risk-based Approach, Validation Exemption Program and Compliance and Validation Exemption Program, Visa's Technology Innovation Program, and Amex's STEP, and whether a regional percentage applies.
5. List the local laws that touch card data in each market. Use the table above as a starting point.
6. Write the answers into one document. Date it, because brand rules change.

Five Questions to Ask Every Acquirer About PCI DSS Requirements by Region

1. "Which level have you assigned us, and on which volume and which entity?" A good answer names the brand, the period and the legal entity counted.
2. "Which validation documents do you accept for that level?" The answer should name Report on Compliance, SAQ or a relief program attestation.
3. "Do you apply a regional hybrid terminal threshold or any local program?" Mastercard's 95 and 75 percent tests are the example to cite.
4. "What fees or assessments apply if we miss a deadline, and in what currency?" Ask for the clause in the merchant agreement.
5. "Which local rules do you expect us to follow beyond PCI DSS?" A good acquirer can name them.

One Evidence Set, Several Proofs

The twelve requirements are the same everywhere, so you can build one control set and package it differently per acquirer. The brand programs ask for different documents: a Report on Compliance attestation, an SAQ attestation, a relief program attestation, network scans.

Build the evidence once. Then, for each acquirer, assemble the version their program asks for. Do not assume one acquirer will accept another's document, and do not assume that a relief program granted by one brand is recognised by another.

Mistakes With PCI DSS Requirements by Region

These are easy to make, and most come from treating a brand or local rule as if it were the standard.

• Assuming a country has its own PCI DSS version. There is one standard. Anyone selling a "country edition" is selling the standard with a local cover.
• Treating the PCI SSC as the enforcer. The Council does not enforce compliance. Brands and acquirers do, by contract.
• Reading one brand's level as the level for every brand. American Express's ladder starts at 10,000 transactions and JCB's split is at one million.
• Assuming a US relief program applies abroad, or the reverse. Mastercard's Risk-based Approach excludes the U.S. Region, and its hybrid terminal tests differ between Europe and the rest of the world.
• Stopping at PCI DSS when a local law attaches. India's RBI storage rule and EU strong customer authentication are separate from PCI DSS and are not satisfied by it.
• Quoting a brand rule from an old edition. Mastercard's current Merchant Edition is dated 4 August 2026. Check the date of any rule you rely on, and confirm it with your acquirer.

How ComplyJet Fits When Cards Cross Borders

ComplyJet supports PCI DSS alongside 25+ other frameworks, and works from the single evidence set described above: the same access control, logging, vendor and policy evidence feeds each framework. We do not replace the acquirer conversation, and we do not map to PSD2, the RBI storage circular, Japan's Installment Sales Act or any regional card brand program. Your acquirer and local counsel decide those.

If you are comparing tools for the PCI work itself, our guide to the best PCI compliance software covers the options. For a working checklist, see our PCI DSS compliance checklist.

FAQs

Do PCI DSS requirements differ by country?

No. The twelve requirements in PCI DSS 4.0.1 are the same in every country. What differs is how you validate compliance through each card brand's program and acquirer, and which local laws also apply. A country-specific rule is a brand or legal rule, not a different version of the standard.

Is PCI DSS a global standard?

Yes. The PCI Security Standards Council publishes one standard, and card brands apply it worldwide through their own programs. Each brand sets its own merchant levels and relief programs, which is where regional differences appear. It also applies outside the US, as the earlier section on that question explains: the trigger is accepting the brand's cards, not where you are based.

Is PCI DSS required by law?

In most places, no. PCI DSS is enforced by contract through card brands and acquirers. Some jurisdictions add a legal hook: Washington gives a safe harbor to businesses with a current annual PCI DSS assessment, Minnesota regulates card data retention, and the Saudi Central Bank's framework mandates PCI DSS for its member organisations.

Who enforces PCI DSS in Europe?

Card brands and acquirers, as elsewhere. The PCI SSC does not enforce the standard. The scheme "area of use" principle also means acquirers in Europe serve Europe-based merchants. Separately, PSD2's authentication rules are supervised by the national regulators that oversee payment service providers.

Do I need separate PCI DSS compliance in each country?

Not separate compliance, but possibly separate proof. The controls are the same, yet each acquirer may assign a level, ask for documents and apply a relief program on its own terms. Build one control set, then package the evidence per acquirer.

Are PCI DSS requirements by region different for small merchants?

The twelve requirements are the same for small merchants, but validation is lighter. Mastercard does not require Level 4 merchants to validate to Mastercard, JCB's lower band completes a yearly self-assessment, and Mastercard's Compliance and Validation Exemption Program is open to eligible Level 3 and 4 merchants. Your acquirer may still ask for evidence.

Related Reading

• PCI DSS compliance levels: the merchant level thresholds and SAQ types
• PCI DSS compliance requirements: the twelve requirements under 4.0.1
• PCI DSS compliance: the PCI DSS overview
• PCI DSS compliance checklist: a working checklist
• GDPR compliance: the European privacy layer
• GDPR countries: EU and EEA member and adequacy lists