Guide

PCI DSS compliance for UK venues and attractions

Updated 30 October 2026 · Warren Doyle, VenueOra Ticketing Limited

PCI DSS applies to every venue that takes card payments, from a soft play centre with one card machine to a stadium with hundreds of tills. What changes with size and set-up is not whether the standard applies but how the venue validates against it: a short self-assessment questionnaire for most, a full assessment by a qualified assessor for the largest, and a scope that shrinks sharply when card data goes straight to the acquiring partner and never touches tills, kiosks or lockers.

What PCI DSS is, who sets it, and who sets your level

The Payment Card Industry Data Security Standard is maintained by the PCI Security Standards Council, founded in 2006 by American Express, Discover, JCB International, Mastercard and Visa. The Council develops and maintains the standards but does not monitor implementation; that is left to the card schemes and acquirers that run compliance programmes. The standard is a baseline of technical and operational requirements designed to protect payment account data, intended for every entity that stores, processes or transmits cardholder data or sensitive authentication data, or that could affect the security of the environment where that data lives. The current version is PCI DSS v4.0.1, published on 11 June 2024; v4.0 was retired on 31 December 2024 and the future-dated requirements became effective on 31 March 2025. The self-assessment questionnaires for v4.0.1 followed on 15 October 2024.

Merchant levels are not set by the Council. Its FAQ says the standard applies regardless of size or transaction volume and that whether a small merchant must validate is determined by the individual payment brands. Visa’s published levels run from Level 1, more than six million Visa transactions a year across all channels, validated by an annual Report on Compliance from a Qualified Security Assessor, quarterly network scans by an Approved Scanning Vendor and an Attestation of Compliance; through Level 2, one to six million, validated by an annual SAQ, quarterly scans and an attestation; to the smaller merchants whose validation requirements are set by the acquirer. Visa merged its former Levels 3 and 4 into a single Level 3 on 25 April 2024 without changing the underlying requirements. Mastercard publishes its own thresholds. A venue learns its level from its acquirer, and for most independent venues that means an annual SAQ.

The SAQ a venue typically meets

Each SAQ carries eligibility criteria, and the Council’s bulletin asks merchants to confirm they meet them all and to check with the body they submit to. The ones venues meet:

SAQ	Who it is for	Typical venue channel
A	Card-not-present merchants whose account data functions are completely outsourced to PCI DSS compliant third parties, keeping at most paper receipts. Not for face-to-face channels. v4.0.1 added a criterion that an embedded payment page is protected against script attacks.	Online tickets through a hosted checkout or redirect
A-EP	E-commerce merchants whose website does not receive account data but controls how customers are redirected or affects the security of the payment page.	Online tickets where the venue’s own site scripts the payment page
B	Imprint machines or standalone dial-out terminals on a phone line, not connected to any other system or the internet.	Legacy terminals
B-IP	Standalone PCI-listed PTS point-of-interaction devices with an IP connection to the processor, not connected to other systems in the venue; excludes secure card readers (SCR and SCRP).	Card machines at bars and gates
P2PE	Account data entered only on terminals from a validated, PCI-listed point-to-point encryption arrangement, with the P2PE Instruction Manual controls in place and no clear-text account data on any venue system.	Terminals, kiosks and unattended devices
D	Any merchant that does not meet another SAQ, including one whose own software handles card numbers.	Everything else

None of these applies to service providers, who complete SAQ D for service providers or a full assessment.

How scope shrinks when card data never touches the venue

Outsourcing does not switch PCI DSS off. The Council’s FAQ on fully outsourced merchants says many requirements may not apply directly to the merchant’s environment but that this does not remove the merchant’s responsibility to ensure account data is properly protected by the third party. SAQ A makes the same point as a criterion: the merchant has reviewed its providers’ Attestations of Compliance and confirmed they cover the services used.

What outsourcing changes is scope. The Council’s scoping guidance starts from the cardholder data environment, adds every system with connectivity to it, and treats a system as out of scope only when it has no access to that environment and controls give reasonable assurance it cannot be used to reach it. Segmentation is not a PCI DSS requirement but is strongly recommended as a method that may reduce the scope of the assessment, and where it is used the controls are tested at least annually. VenueOra’s payments run on that principle: card data goes to a PCI DSS Level 1 acquiring partner and never to venue hardware or VenueOra-hosted code, so card data never touches your tills, kiosks or lockers. The till, the kiosk screen and the locker controller sit outside the cardholder data environment because they never see a card number; the certified terminal and the acquirer’s systems carry it, with tokenisation and 3-D Secure 2 as standard.

What the venue still does each year

Four things recur. The venue confirms its level and the SAQ it is eligible for with the acquirer. It completes that SAQ and signs the Attestation of Compliance, and runs quarterly external vulnerability scans by an Approved Scanning Vendor where the SAQ or the acquirer requires them. It reviews the Attestations of Compliance of the providers it relies on. And it keeps the practices the terminal-based SAQs include: physical checks of card machines for tampering or substitution, a rule that nobody writes a card number down or keys one into a till, paper receipts stored and destroyed under a policy, and where card machines share a network with anything else, segregation of that network from guest Wi-Fi, ePOS and back office, which SAQ B-IP notes can be achieved via network segmentation.

Common venue scenarios

A festival bar with standalone card machines on a 4G or Wi-Fi connection sits in SAQ B-IP or, where the acquirer’s terminals are part of a listed P2PE arrangement, SAQ P2PE, provided the terminals connect only to the processor and sit apart from the production network and public Wi-Fi. A self-ordering kiosk with a certified card terminal embedded in it is the same channel as a card machine provided the kiosk software never handles the card number; a kiosk that reads cards through its own application is an SAQ D merchant. An unattended locker takes payment through a certified Android or SoftPOS terminal embedded in the kiosk, with card data going to the acquiring partner; under LockVault’s revenue-share model the venue provides the pitch and footfall while LockVault funds, installs and runs the lockers, as the guide on what lockers as a service includes sets out. Online ticket sales through a hosted checkout or full redirect are SAQ A; a checkout where the venue’s own page scripts or embeds the payment form is SAQ A-EP, and the v4.0.1 criterion on script attacks applies to the embedded form. The guide to cashless festivals and arenas in 2026 covers wristband and Tap to Pay channels in the same terms.

What VenueOra does here

The compliance overview describes how card data, personal data and age checks move through the platform; for arenas and stadiums, ticket and locker payments sit on the VenueOra order record, bar and merchandise card payments on Posso tills are processed by VenueOra on the Posso platform, and in every case card data goes to the Level 1 acquiring partner through certified terminals and hosted checkout. Where a venue also scans ID at the door, the guide on the data controller when a nightclub scans ID covers the personal data side. The PCI SSC and Visa documents cited are those in force as of October 2026; the acquirer decides a venue’s level and SAQ.

This page describes how VenueOra’s products handle card data, personal data and age checks. It is not legal advice. Your premises licence conditions and your own data protection assessment take precedence.

Sources

FAQ

Questions venues ask

Does PCI DSS apply to a small venue with one card machine?

Yes. The PCI Security Standards Council says the standard applies to all entities involved in payment processing regardless of size or transaction volume. What varies is validation: whether a small merchant has to validate, and how, is decided by the card schemes and the acquirer, and for most venues it is an annual self-assessment questionnaire. The acquirer confirms the level and the questionnaire that applies.

Which PCI merchant level is a typical UK attraction or venue?

Usually the lowest. Visa's levels start at more than six million Visa transactions a year for Level 1 and one to six million for Level 2; everything below that falls into Visa's consolidated Level 3, where validation requirements are set by the acquirer, and most independent venues sit there. Mastercard publishes its own thresholds. The acquirer's letter states the level, and the venue does not calculate it alone.

Which SAQ does a venue complete for PCI DSS compliance in the UK?

It depends on how card data moves. Standalone PCI-listed terminals on an IP connection point to SAQ B-IP, terminals in a validated P2PE arrangement to SAQ P2PE, a hosted or redirected online checkout to SAQ A, and a checkout the venue's own page scripts to SAQ A-EP. A venue whose own software handles card numbers completes SAQ D. Each questionnaire has eligibility criteria the merchant confirms with its acquirer before starting.

If card data never touches our tills, are we out of scope?

Not entirely. The Council's FAQ says outsourcing does not remove the merchant's responsibility to ensure its providers protect account data, and SAQ A requires the merchant to have reviewed the providers' Attestations of Compliance. What shrinks is the environment under assessment: tills, kiosk screens and locker controllers that never see a card number sit outside the cardholder data environment, leaving the terminals, the network they use and the venue's policies in scope.

Does PCI DSS compliance need to be renewed every year?

Yes. Validation is annual: the self-assessment questionnaire is completed and the Attestation of Compliance signed each year, quarterly external scans by an Approved Scanning Vendor run where the questionnaire or acquirer requires them, and provider attestations are reviewed. The acquirer sets the timetable. Between validations the standard still applies, so terminal checks, staff practices and network segregation continue through the year rather than being revisited once.

Does using VenueOra make a venue PCI DSS compliant?

No product does that. VenueOra routes card data to a PCI DSS Level 1 acquiring partner so that it never touches the venue's tills, kiosks or lockers, which keeps those systems outside the cardholder data environment and usually points the venue to a shorter questionnaire. The venue still confirms its level with its acquirer, completes its own questionnaire and attestation each year, reviews provider attestations and keeps its terminal and network practices in place.

See VenueOra on your own venue

Tell us what your venue sells and we will walk you through the guest record, the gate and the till with your own numbers.

Book a demo More guides