Which PCI DSS version applies in 2026?

Version 4.0.1. The PCI Security Standards Council retired v4.0 on December 31, 2024, and every requirement that was future-dated in v4.0 has been mandatory since March 31, 2025. There is no transition period left for PayFacs or other service providers.

Version 4.0.1, without exception

PCI DSS v4.0 was published in March 2022 with a transition period. The PCI Security Standards Council retired v3.2.1 on March 31, 2024, published v4.0.1 in June 2024 as a clarifying revision, and retired v4.0 on December 31, 2024. The requirements that were future-dated in v4.0 became mandatory on March 31, 2025. In 2026, every assessment uses v4.0.1 and every requirement applies.

What the formerly future-dated requirements include

• Targeted risk analyses for requirements that allow flexible frequencies.
• Authenticated internal vulnerability scans.
• Management of scripts on payment pages and detection of unauthorized changes.
• Automated log review and detection of audit log failures.
• Multi-factor authentication for all access to the cardholder data environment.

For PayFacs

There is no transition left to plan around. A PayFac whose last assessment referenced v4.0 or omitted the future-dated requirements should expect its next one to cover them in full. Infrastructure providers' attestations should also reference v4.0.1; an older attestation on file is a finding waiting to happen. The responsibility matrix with each provider should state which of these requirements the provider covers and which remain with the PayFac.