What compliance scope stays with an operator that builds its own platform?

All of it. An in-house platform needs its own PCI DSS Level 1 assessment, penetration tests, audits and the controls to pass them, renewed every year, plus GDPR and local regulations in each market. Each new provider or payment method then adds its own certification, and that budget recurs for as long as the platform runs.

All of it

An operator that builds its own platform is a service provider under PCI DSS, with its own cardholder data environment. It needs a Level 1 assessment by a Qualified Security Assessor every year, quarterly external scans, internal scans, annual penetration tests, segmentation tests every six months, and the controls across network, encryption, access, logging and development to pass them. Then GDPR and local data rules in each market, and scheme compliance programs.

What recurs

• The annual assessment and the work to prepare it.
• Scheme releases twice a year, each with compliance impacts.
• New PCI DSS versions, with new requirements to implement.
• Each new provider or payment method, which adds its own certification.

The budget nobody plans

Operators that build usually budget the initial development and underestimate the recurring compliance cost: security staff, assessors, tooling, and the engineering time taken from features. That cost runs for as long as the platform runs. On white-label infrastructure, the card data environment is the provider's, validated once for all operators, and the operator's own scope shrinks to its systems and staff. The compliance budget becomes a line in the subscription rather than a team.