How do venues keep card payments secure and PCI DSS compliant?

What is PCI DSS, and does it apply to us?

The Payment Card Industry Data Security Standard (PCI DSS) is the security standard for any business that stores, processes or transmits card data. If your venue takes card payments, it applies to you, whatever your size.

Version 4.0.1 was published in June 2024, and version 4.0 was retired on 31 December 2024, leaving 4.0.1 as the only active version. The 51 "future-dated" requirements in version 4 became mandatory on 31 March 2025 (PCI Security Standards Council).

How you prove compliance is set by your acquirer, the bank or payment provider that processes your card payments. For most venues, that's an annual self-assessment questionnaire (SAQ). Which SAQ you complete depends on how your payments are set up, and a simpler setup means a shorter questionnaire.

Why network separation matters most

PCI DSS applies to every system that handles card data and every system connected to it. If your tills share one open ("flat") network with guest WiFi, office PCs and CCTV, all of those can fall into scope, meaning they have to meet the standard too. The PCI Security Standards Council doesn't require network segmentation, but it strongly recommends it, because it's the most effective way to reduce scope, cost and risk.

In practice, that means:

• A dedicated network for tills, EPOS and card terminals
• A firewall between the payment network and everything else, allowing only the traffic payments need
• Guest WiFi completely isolated from payments
• The separation tested regularly, as PCI DSS requires where segmentation is used to reduce scope

Card terminals and EPOS: the basics

• Use terminals from your payment provider and keep them on its supported list
• Consider point-to-point encryption (P2PE). A validated P2PE solution encrypts card data inside the terminal and can greatly reduce what you need to evidence. Ask your payment provider
• Change default passwords on EPOS, routers and back-office systems
• Give every member of staff their own login on the EPOS, not a shared code
• Keep software updated on tills, terminals and the back office
• Check terminals for tampering, especially at busy, unattended or temporary points of sale
• Keep a list of every device that takes payments and where it is

How does the PSTN switch-off affect card machines?

Some older card machines still dial out over an analogue phone line. So can intruder and fire alarms, lift emergency phones and door entry. The UK's analogue network closes on 31 January 2027.

Openreach confirmed in September 2026 that lines still on the old network will move to a temporary "emergency voice access" service, from £35 a month per line wholesale (retail prices will be higher), and that migrations with broadband attached won't start until mid-April 2027. Around 350,000 business premises still hadn't moved, and Openreach named payment terminals, alarms and lift emergency phones as particular risks (ISPreview, 24 September 2026).

Emergency voice access is a stopgap. Move card machines to an internet (IP) or mobile (SIM) connection now, and check each alarm and lift line with its supplier.