PCI-DSS for Fintech & Payments

Does using Stripe eliminate PCI scope?

Hosted payment pages or Stripe Elements can reduce scope to SAQ-A. Iframes and direct card capture push you into broader SAQs — you still have PCI obligations either way.

What's changed in PCI-DSS 4.0?

Targeted risk analysis, expanded MFA, customized approach options, and stronger e-commerce script controls.

What's my PCI level?

Level 1: >6M transactions/year. Level 2: 1M–6M. Level 3: 20k–1M e-commerce. Level 4: everything else. Each brand (Visa, MC, etc.) publishes its own thresholds.

Does using Stripe eliminate PCI scope?

Using a hosted payment page or Stripe Elements can reduce scope to SAQ-A, but you still have PCI obligations. Iframes and direct card capture push you into broader SAQs.

SOC 2 or PCI first?

If you handle cardholder data — PCI is non-negotiable. If your buyers are enterprises — SOC 2 unblocks revenue. Most fintechs pursue both in parallel.

Does Scarlet Risk replace a specialized AML vendor?

For SMB-scale operations, it covers the governance and diligence layer. For high-volume transaction monitoring you'll want a specialized vendor alongside Scarlet Risk.