PCI DSS v4.0 for Small Businesses: What’s Due by March 31, 2025

KEY TAKEAWAYS

• PCI DSS v4.0 is live and future‑dated controls are now mandatory; scope includes even “hosted checkout” merchants.
• Choose the correct SAQ (A, A‑EP, C‑VT, B‑IP, P2PE) for your setup and reduce scope with tokenization/P2PE.
• Finish essentials: MFA for admins, logging/retention, script integrity for e‑commerce, patch cadence, and clear roles/diagrams.

Summary

PCI DSS v4.0 replaced v3.2.1 on March 31, 2024. Many of the 64 “new” requirements were labeled “future‑dated” and become mandatory after March 31, 2025. A limited‑revision v4.0.1 (June 2024) clarified language but did not add new requirements. If you store, process, or transmit card data—even via a hosted checkout—you’re in scope. 

What changed and when

1. March 31, 2024: v3.2.1 retired; assessments now on v4.x. 
2. March 31, 2025: 51 future‑dated v4.0 requirements move from “best practice” to mandatory (varies by merchant type/service provider). 
3. v4.0.1 (June 2024): Clarifications/formatting; no additional or deleted requirements. 
4. New SAQs for v4.0.1 were published (Oct 2024). 

What this means for SMBs (examples—not legal advice)

If you use a standalone IP‑connected EMV terminal with no storage, your SAQ may resemble B‑IP or P2PE (if using a validated P2PE solution). If you key via a web‑based virtual terminal, you’re likely in SAQ C‑VT. If you host parts of your e‑commerce payment page (scripts/iframes), you may be in SAQ A‑EP; fully‑outsourced hosted checkout can fit SAQ A. Confirm using the current SAQ guidance. 

Ten focus items to complete before March 31, 2025

1. Roles and responsibilities documented for each control family (v4 requirement).

2. Annual scope confirmation and network diagrams including segmentation and CDE data flows.

3. MFA for admin access and remote access; strengthen auth per v4.

4. Harden scripts and e‑commerce pages (integrity controls, change detection).

5. Build/patch cadence aligned to vulnerability management SLAs; authenticated internal scans.

6. Logging and monitoring with tamper resistance and retention; review procedures.

7. Incident response tabletop including third‑party PSP/gateway contacts.

8. For e‑commerce, reduce scope via network tokenization and hosted fields when possible.

9. If you rely on vendors (POS, gateways, MSPs), capture their AOC/attestations and versions.

10. Use PCI’s Prioritized Approach Tool (v4.0.1) to stage work in business‑friendly tranches.

How your providers can help

• Clover review — validated devices, semi‑integrated flows, P2PE options to shrink scope (still need policies, training, and SAQ).
• Leaders Merchant Services review — PCI portal, SAQ help, and gateway settings (tokenization, 3‑D Secure) for CNP.
• Stax review — e‑commerce tools, tokenized vault, and recurring billing with PCI‑aware workflows.
• Payment Depot review — interchange‑plus pricing plus PCI support; confirm SAQ fit by environment.
• Merchant One review — small‑business onboarding and PCI program; check SAQ mapping and scan requirements.
• Worldpay review — enterprise‑grade tokenization, recurring, and fraud tools with documented PCI materials.
• Swipe4Free review — ensure surcharging/dual‑pricing apps maintain EMV/P2PE posture and do not break SAQ assumptions.

Sources

PCI SSC announcement on v3.2.1 retirement and v4 timing. 

PCI SSC blog: 51 future‑dated requirements due March 31, 2025; v4.0.1 context. 

PCI Document Library (v4.0.1, Quick Reference Guide, Prioritized Approach). 

SAQs for v4.0.1 bulletin (Oct 2024).