Payments & settlement Travel technology glossary

PCI DSSPayment Card Industry Data Security Standard

Also called PCI compliancePCI DSS v4.0.1Payment Card Industry Data Security Standard

Definition

PCI DSS (Payment Card Industry Data Security Standard) is the global security standard for any business that stores, processes or transmits payment card data. For travel agencies and booking platforms it governs how card details taken for flights, hotels and fees are handled, and IATA requires accredited agents selling through BSP by card to show compliance.

What PCI DSS means

PCI DSS is maintained by the PCI Security Standards Council (PCI SSC), founded in 2006 by American Express, Discover, JCB, Mastercard and Visa. The Council writes the standard but does not enforce it. Whether a business must comply, and how it proves it, is decided by the payment brands and acquiring banks that run compliance programmes.

The current version is PCI DSS v4.0.1, published in June 2024 as a limited revision of v4.0 with no added or deleted requirements. Version 4.0 was retired on 31 December 2024, and the future-dated requirements introduced in v4.0 became mandatory on 31 March 2025. In June 2026 the Council opened a request for comments on v4.0.1 as it began work on the next iteration, so agencies should expect a further revision.

Travel sellers fall in scope because they routinely handle card data: customer cards for airline tickets, card details passed to hotels, virtual cards for suppliers and cards stored in a PNR or profile. IATA states that airlines asked it to make the BSP card sales channel compliant, so accredited agents must provide evidence of PCI DSS compliance through the IATA Customer Portal. Agencies that take no card payments can declare that instead.

How PCI DSS works

Compliance is an annual cycle of scoping, controls and validation rather than a one-off certificate.

  1. Map card data flowsIdentify every place card data enters, travels or is stored: booking engine, call centre, GDS PNRs, email, back office and supplier channels. This defines the cardholder data environment.
  2. Reduce scopeUse hosted payment pages, tokenisation and a PCI-validated payment provider so that fewer systems ever touch full card numbers, which shrinks the area to secure and assess.
  3. Choose the validation routeMerchants with lower volumes usually complete a Self-Assessment Questionnaire (SAQ) matched to how they accept cards, while larger merchants and service providers may need an on-site assessment.
  4. Apply the controlsImplement the relevant requirements, such as access control, multi-factor authentication, logging, vulnerability scanning and payment page script management.
  5. Submit evidenceSign an Attestation of Compliance and share it with the acquirer, the payment brand or, for BSP card sales, IATA. Repeat the cycle every year or after major changes.

PCI DSS in practice

Illustrative example: a small agency that only takes customer cards through a payment link fully hosted by a PCI-compliant provider may qualify for SAQ A, the shortest questionnaire. Since January 2025 SAQ A merchants with websites must also confirm that their site is not exposed to script attacks that could affect their e-commerce systems.

A booking platform that renders its own card form and passes data to a gateway, or that stores cards in a PNR for later ticketing, has a much wider scope and is likely to need a longer SAQ or a full assessment. The PCI SSC lists other questionnaires for specific set-ups, such as SAQ C-VT for agents keying cards into a web-based virtual terminal. In each case the acquirer confirms which route applies.

Who uses it

IATA-accredited travel agenciesProvide evidence of PCI DSS compliance to IATA to keep using the customer card form of payment for BSP ticket sales.
OTAs and B2B booking platformsDesign checkout, card storage and supplier payment flows to limit card data exposure and pass their annual validation.
Travel technology providersAct as service providers to agencies and validate their own compliance, since clients rely on their attestation.
Hotels and suppliersHandle card and virtual card details received from intermediaries in a way that keeps their own systems compliant.

Advantages and limitations

Advantages

  • A shared baseline of controls lowers the risk of card data breaches and fraud losses.
  • Compliance evidence is often required to keep accepting cards and, for IATA agents, to sell BSP tickets by card.
  • Scope reduction work, such as tokenisation, usually simplifies systems and future audits.
  • A clear attestation reassures airlines, acquirers and corporate clients during supplier checks.

Limitations

  • Validation must be repeated every year, which costs time and money for small agencies.
  • Card data in GDS remarks, emails and call recordings is easy to overlook and can widen scope.
  • Compliance at a point in time does not guarantee security between assessments.
  • Requirements and SAQ rules change between versions, so teams must track Council updates.

Frequently asked questions about PCI DSS

What is the current version of PCI DSS?

PCI DSS v4.0.1, published by the PCI Security Standards Council in June 2024, is the only active version. It replaced v4.0, which retired on 31 December 2024. The Council opened a request for comments on v4.0.1 in June 2026 to shape the next revision, but no newer version had been published at the time of writing.

Do IATA travel agents need to be PCI DSS compliant?

Yes, if they accept card payments for BSP ticket sales. IATA says airlines asked it to make the BSP card sales channel compliant, so accredited agents must submit evidence of PCI DSS compliance through the IATA Customer Portal. Agents that do not take cards can declare that instead of providing compliance documents.

Which SAQ does a travel agency need?

It depends on how the agency accepts cards. A business that fully outsources card handling to a validated provider may use SAQ A, and one keying cards into a web-based virtual terminal may use SAQ C-VT. SAQ D covers merchants that fit none of the shorter questionnaires. The acquiring bank or payment brand confirms which applies.

Can a travel agency store credit card numbers in a PNR?

Card numbers can be held in booking systems for ticketing, but any system that stores them becomes part of the cardholder data environment and must meet PCI DSS controls such as protecting stored data, restricting access and logging activity. Many agencies use tokenisation or hosted payment services so that full card numbers are not stored in PNRs or profiles at all.

Who enforces PCI DSS compliance?

Not the PCI Security Standards Council. The Council writes and maintains the standard, while compliance programmes are run by the payment brands and by acquiring banks, who decide which businesses must validate and how. For BSP card sales, IATA also sets its own requirement that accredited agents provide evidence of compliance.

Run your agency on one booking platform

ReservationHub's Subscription Cloud Edition gives agencies GDS, NDC and low-cost content, B2B and B2C sales, and back office in one hosted platform.

See the SaaS platform

Sources and further reading

  1. PCI SSC — Just published: PCI DSS v4.0.1 (June 2024)
  2. PCI SSC — Important updates for merchants validating to SAQ A
  3. PCI SSC — Request for comments: PCI DSS v4.0.1 (June 2026)
  4. PCI SSC — About us
  5. PCI SSC — What is the intent of the SAQ eligibility criteria?
  6. PCI SSC — Understanding the SAQs for PCI DSS
  7. IATA — PCI DSS for travel agents
  8. Travel News (South Africa) — Agents hazy about PCI DSS requirement (2017)