PCI DSS and crypto-asset payments: what each one covers
Status as of October 30, 2026. If you accept cards, PCI DSS is the security standard you work within. If you accept crypto-assets, there is no direct PCI equivalent: private-key management, wallet security and, depending on your model, FINTRAC and Retail Payment Activities Act (RPAA) obligations take its place. This page is general information, not legal or security advice; for your obligations, ask your card acquirer, FINTRAC, the Bank of Canada, a lawyer or a qualified security professional.
Key points
- PCI DSS applies to entities that store, process or transmit cardholder data.
- PCI DSS v4.0.1 (June 2024) is a limited revision that kept the March 31, 2025 effective date for future-dated requirements.
- Requirements 6.4.3 and 11.6.1, which deal with payment-page scripts, are among the future-dated requirements now in effect.
- There is no direct PCI equivalent for accepting crypto-assets.
- Key management, custody choices and, where applicable, FINTRAC and RPAA obligations fill that space.
PCI DSS as of 2026
PCI DSS v4.0.1 was published in June 2024 as a limited revision of v4.0. It did not change the March 31, 2025 effective date for the future-dated requirements that v4.0 introduced. Of the 64 new requirements in v4.0, 51 were future-dated, so March 31, 2025 was the date on which most of the new requirements took effect.
Two of those, 6.4.3 and 11.6.1, address scripts on payment pages. If your checkout takes cards, ask your acquirer or assessor how 6.4.3 and 11.6.1 apply to your setup; the answer depends on how your payment page is built and hosted.
In practice, that means there is no later deadline to plan around. Anyone who expected v4.0.1 to move the dates back should treat the future-dated requirements as current.
What is in scope
PCI DSS applies to entities that store, process or transmit cardholder data. Adding crypto-asset payments does not take a card-accepting business out of scope; the card side still needs to meet the standard.
A business that accepts only crypto-assets does not handle cardholder data for those payments, so PCI DSS is not the framework for them. That does not mean there is nothing to secure. It means the security work has a different shape, and no single standard tells you where it starts and stops.
Side-by-side comparison
The table compares the two at a high level. The regulatory row depends heavily on your model; see FINTRAC MSB registration and the Retail Payment Activities Act for the detail.
| Topic | Card payments (PCI DSS) | Crypto-asset payments |
|---|---|---|
| Governing framework | PCI DSS v4.0.1, an industry security standard | No direct PCI equivalent; obligations depend on the model |
| What you protect | Cardholder data you store, process or transmit | Private keys and wallet access, plus payment and customer records |
| Payment page | Future-dated requirements 6.4.3 and 11.6.1 for payment-page scripts, effective March 31, 2025 | The address, amount and asset shown to the payer; altered details can send funds elsewhere |
| If something goes wrong | Card dispute and chargeback processes exist | Payments are generally irreversible; recovery depends on the recipient |
| Regulatory overlay | PCI DSS, plus the terms of your card processing agreement | FINTRAC if your activity is an MSB service; RPAA if you are an in-scope PSP; CRA records in all cases |
| Who to ask | Your acquirer or assessor | FINTRAC, the Bank of Canada, a lawyer, a security professional |
What takes PCI's place for crypto-assets
Without a single standard, the work splits into a few areas. Which apply depends on how you accept crypto-assets, and none of them comes with a certificate at the end.
- Private-key management. Whoever controls the private keys controls the funds. Decide who can approve outgoing transfers, how keys or recovery phrases are backed up, and how access is removed when people leave. Wallet security for businesses goes further.
- Wallet separation. Consider keeping the wallet that receives payments separate from any wallet that holds larger balances, and limiting which devices can sign transfers.
- Payment page integrity. The concern behind 6.4.3 and 11.6.1, scripts on payment pages, applies just as much to a page that displays a wallet address. Payment request standards explains how amounts and addresses are encoded.
- Regulatory obligations. FINTRAC if your activity is an MSB service, the RPAA if you are an in-scope PSP, and CRA record-keeping in all cases.
Custody choices change the picture
With a self-hosted wallet, your business holds the keys and carries the security work directly. With a provider that holds keys for you, much of that work shifts to the provider, and your due diligence matters more: ask how it secures keys, whether it is registered with FINTRAC, and whether it is on the Bank of Canada's PSP registry where relevant.
Neither model removes risk; each moves it. Custody models explained compares the options in more detail.
Card payments have a dispute process. A crypto-asset sent from a compromised wallet, or to an address swapped on a tampered page, is generally gone. Put approval and access controls in place before value moves.
Questions for a crypto payment or custody provider
When a provider handles keys or payment pages for you, you cannot point to a PCI attestation to compare them. You have to ask directly, and keep the answers with your contract. Useful questions include:
- Who controls the private keys for funds you hold on my behalf, and how is access to them approved?
- How do you make sure the address and amount on a payment page or invoice cannot be altered?
- What happens if a customer sends the wrong asset, the wrong amount or uses the wrong network?
- How quickly do you notify me of a security incident, and what records will I receive?
- Are you registered with FINTRAC as a money services business, and are you on the Bank of Canada's PSP registry where that applies?
- What independent security reviews have you had, and can I see a summary?
A short checklist
If you accept both cards and crypto-assets, run both halves of this list. If you accept only one, the other half still helps you see what you are not covering.
- If you take cards, confirm your PCI DSS v4.0.1 obligations, including 6.4.3 and 11.6.1, with your acquirer or assessor.
- Write down who holds the private keys for any crypto-asset you accept.
- Set approval rules for outgoing transfers and keep the list of approvers current.
- Protect the page or invoice that shows payment details; try layouts in the payment request QR sandbox, which uses no real funds.
- Check FINTRAC and RPAA status for your own model and for your provider.
- Compare custody providers with the vendor evaluation checklist.
Questions people ask
Do I need PCI DSS compliance to accept crypto?
PCI DSS applies to cardholder data. Accepting only crypto-assets does not involve cardholder data, but if you also accept cards, PCI DSS still applies to that side.
Did PCI DSS v4.0.1 delay the future-dated requirements?
No. v4.0.1 was a limited revision and did not change the March 31, 2025 effective date.
Is there a security standard for crypto payments in Canada?
There is no direct PCI equivalent. Key management, wallet security and, depending on your model, FINTRAC and RPAA obligations take its place.
What do 6.4.3 and 11.6.1 cover?
Both are future-dated PCI DSS requirements dealing with scripts on payment pages. Ask your acquirer or assessor how they apply to your checkout.
Sources
- PCI Security Standards Council — PCI DSS v4.0.1 published
- PCI Security Standards Council — Adopting the future-dated requirements of PCI DSS v4.x
- FINTRAC — MSB registration questions
- Bank of Canada — Retail payments supervision
Reviewed October 30, 2026. Educational information only; not financial, legal, tax or investment advice. This site does not process payments or hold funds.