PCI DSS And The Card Schemes: What Payments Rules Say About Cryptography And Quantum

Card payments are the one area where the same cryptography rules apply in every region. PCI DSS, the Payment Card Industry Data Security Standard, is not a law. It binds merchants and service providers through their contracts with card brands and acquirers, which is why this group labels it Binding (contractual). A merchant in Dubai and a processor in Frankfurt are assessed against the same requirements.

This article explains which PCI DSS requirements touch cryptography, how they relate to post-quantum planning, and what the card industry has said about quantum computing as of October 2026. The detailed reading of requirement 12.3.3 belongs to Cryptography Compliance; here the aim is the global payments picture. It is general information, not legal advice.

The Version In Force

PCI DSS v4.0.1 was published in June 2024 as a limited revision of v4.0, which was retired at the end of 2024. Requirements that v4.0 marked as future-dated became mandatory on 31 March 2025.¹² Several of those are the ones that matter for cryptography.

From 3 June to 20 July 2026, PCI SSC ran a request for comments on v4.0.1. The instructions asked whether any requirements need attention because of AI and mobile; they did not include a quantum question.³ It was a consultation (Draft in this group’s labels), not a change to any requirement.

The Requirements That Touch Cryptography

Five individual requirements, plus the 3.7 key management series, cover how card data is protected with cryptography. The summaries below describe the official v4.0.1 text in this article’s own words.²

Requirement 3.5.1 says stored card numbers must be unreadable wherever they sit. The permitted methods are a one-way hash of the whole card number based on strong cryptography, truncation (where a hash may not stand in for the removed digits), index tokens, or strong cryptography backed by key management. If an environment holds hashed and truncated copies of the same number, or copies truncated in different ways, extra controls must stop anyone combining them to rebuild it. Requirement 3.6.1 calls for working procedures that stop the keys guarding stored account data from being exposed or misused, for example by keeping the number of key custodians to a minimum. Requirements 3.7.1 to 3.7.8 cover those keys across their life, from generation, distribution and storage to change at the end of their cryptoperiod and retirement or replacement, and 3.7.9 adds a duty for service providers that share keys with customers. Where staff perform manual cleartext key operations, requirement 3.7.6 calls for split knowledge and dual control, so no single person holds a complete key.

Requirement 4.2.1 covers card numbers sent over open, public networks. Strong cryptography must protect them and only trusted keys and certificates may be accepted. The protocol must be set up so that insecure versions, algorithms, key sizes and implementations are neither used nor available as a fallback, and the encryption strength must suit the method in use. Its bullet on confirming that certificates are valid and not expired or revoked was a best practice until 31 March 2025. Requirement 4.2.1.1 asks for an inventory of the trusted keys and certificates used to protect card numbers in transit, and was also a best practice until that date. Requirement 12.3.3 expects entities to keep documentation of their cipher suites and protocols and revisit it at least once every 12 months. It has three parts: a current list showing what each one does and where it runs, an active watch on whether each is still safe to use, and a written plan for reacting to cryptographic weaknesses the entity can see coming. Any cipher suite or protocol used to meet a PCI DSS requirement is in scope.

From Requirements To Quantum Tasks

Read together, these requirements already ask for most of what a post-quantum programme needs in its early phases. The table maps each one to the migration step it supports.

The 12.3.3 documentation is a natural place to record a post-quantum plan. Because the review repeats every 12 months, the plan is covered by each annual assessment, whether by an assessor or by self-assessment, which gives PCI-scoped organisations a regular checkpoint that most guidance-based regimes lack. The inventory article shows how the same inventory serves DORA, SAMA and the UAE National Encryption Policy.

What The Card Industry Has Said About Quantum

EMVCo, which manages the EMV chip specifications, has published two position statements on quantum computing and chip cryptography. Its explainer page, an interview with its security working group, was first posted on 3 June 2025 and later updated to point to a second position statement dated 24 August 2026. EMVCo does not expect quantum computing to threaten EMV infrastructure before at least 2040. It says harvest now, decrypt later is not relevant to chip card authentication, notes that AES has been in the EMV specifications since 2010, and identifies the offline RSA and elliptic curve mechanisms as the parts that would be vulnerable.⁴ This is an industry position, labelled here as an Announcement.

EMVCo’s view and the harvest now, decrypt later concern are about different things. Chip authentication happens in the moment, so a recording is of little later use. Card data sent over TLS under requirement 4.2.1 is different: if the session keys were agreed with RSA or elliptic curve methods, a recording could be decrypted later. The harvest now, decrypt later article explains why. Keep the two cases apart when reading vendor claims.

PCI SSC’s own blog published an educational interview on preparing for post-quantum cryptography in September 2026, with no change to requirements.⁵ Mastercard has published a research white paper on migration to post-quantum cryptography, which is the company’s own research rather than a scheme rule.⁶ This review found no official quantum readiness statement from Visa or American Express as of October 2026.

The Date That Matters Now

There is no quantum deadline in payments. The relevant date is the one that has already passed: since 31 March 2025, the inventory, monitoring and documented plan in 12.3.3 have been required, along with the 4.2.1.1 inventory of trusted keys and certificates. That documentation is a natural place to record a post-quantum plan, and each annual review is a chance to update it.