April 23, 2026 · 8 min read · pcidss.ae

PCI DSS Certification in UAE 2026 - Complete Guide for Merchants & Banks

Q: "What is PCI DSS certification and who needs it in UAE?"

"PCI DSS (Payment Card Industry Data Security Standard) certification is required for any UAE organization storing, processing, or transmitting cardholder data. This includes merchants accepting card payments (retail, hospitality, e-commerce), payment service providers, banks processing cards, fintechs with card rails, hospitality operators, service providers handling cardholder data for clients, and call centres taking card-not-present payments. Certification level (SAQ vs RoC) depends on annual transaction volume."

Q: "What are PCI DSS merchant levels?"

"Four merchant levels based on annual Visa/Mastercard transactions: Level 1 (over 6M transactions - requires full Report on Compliance audit by QSA), Level 2 (1M-6M - annual RoC or SAQ depending on card scheme), Level 3 (20K-1M e-commerce - annual SAQ), Level 4 (less than 20K - annual SAQ plus quarterly scanning). Service providers have separate levels. UAE banks and large payment institutions are Level 1; most mid-size merchants are Level 2 or 3."

Q: "How long does PCI DSS certification take in UAE?"

"Timeline depends on current state and scope. Well-prepared organization with existing security controls: 3-6 months from kickoff to certification. Organization with significant gaps: 6-12 months including remediation. Specific phases: gap analysis (4-6 weeks), remediation (2-6 months), pre-audit or SAQ validation (2-4 weeks), QSA audit for RoC path (3-6 weeks), ongoing compliance maintenance. First-time certification typically takes longer; annual recertification is faster."

Q: "How much does PCI DSS certification cost in UAE?"

"Varies significantly by scope and merchant level. Small Level 4 merchant doing SAQ A: AED 15,000-40,000 for consultancy support. Level 2-3 SAQ B or C: AED 50,000-150,000. Level 1 RoC audit: AED 300,000-800,000+ for QSA audit fees, plus AED 200,000-500,000 for remediation consulting. Banking Level 1 with complex CDE: AED 1,000,000+. Segmentation testing, penetration testing, and vulnerability scanning add AED 50,000-300,000 annually depending on scope."

Q: "What's the difference between SAQ and RoC?"

"SAQ (Self-Assessment Questionnaire) is a self-attestation available to merchants below Level 1 thresholds. Multiple SAQ types (A, A-EP, B, B-IP, C, C-VT, D, P2PE) apply based on how cardholder data is handled. RoC (Report on Compliance) is a full audit by a Qualified Security Assessor (QSA) - required for Level 1 merchants and service providers. Both demonstrate PCI DSS compliance; RoC is substantially more rigorous and expensive. UAE CBUAE-licensed banks typically need RoC regardless of transaction volume."

Q: "Does CBUAE require PCI DSS certification?"

"CBUAE Information Security standards and Retail Payment Services and Card Schemes Regulation require UAE-licensed card-handling institutions to maintain PCI DSS compliance. Banks, payment service providers, and stored-value facility issuers must demonstrate compliance as part of their supervisory obligations. CBUAE examinations cross-reference PCI DSS compliance evidence with broader cyber risk management requirements. PCI DSS compliance alone does not satisfy all CBUAE requirements - broader CBUAE cyber risk framework applies too."

Complete guide to PCI DSS certification in UAE in 2026. Merchant levels, SAQ vs RoC, QSA selection, timeline, cost, CBUAE alignment, and the 12 PCI DSS requirements explained for UAE businesses.

PCI DSS certification in UAE is the baseline requirement for any organization handling card payment data. Whether you’re a small merchant using card readers, a mid-size e-commerce operation, a fintech building payment rails, or a bank processing millions of transactions - PCI DSS compliance is non-negotiable for continued card acceptance.

This guide covers the full PCI DSS certification journey for UAE organizations in 2026: who needs it, what level applies, what it costs, how long it takes, and how to structure the programme for success on the first audit.

What PCI DSS Actually Is

PCI DSS (Payment Card Industry Data Security Standard) is an information security standard developed by the PCI Security Standards Council - a joint effort of Visa, Mastercard, American Express, Discover, and JCB. It defines security requirements for any organization that stores, processes, or transmits cardholder data.

The current version is PCI DSS v4.0 (replacing v3.2.1), with v4.0.1 issued in mid-2024 as minor revision. Future-dated requirements in v4.0.1 become mandatory in 2025-2026 windows.

The standard organizes into 12 requirements across six control domains:

Build and Maintain Secure Networks (Requirements 1-2) - firewalls, default passwords
Protect Cardholder Data (Requirements 3-4) - storage and transmission encryption
Maintain a Vulnerability Management Programme (Requirements 5-6) - anti-malware, secure development
Implement Strong Access Controls (Requirements 7-9) - access restriction, authentication, physical access
Regularly Monitor and Test Networks (Requirements 10-11) - logging, testing, penetration testing
Maintain an Information Security Policy (Requirement 12) - governance

Each of the 12 has multiple sub-requirements. The full v4.0 standard runs over 400 pages.

Who Is Subject to PCI DSS in UAE

UAE entities requiring PCI DSS compliance:

Merchants

Any UAE organization accepting card payments directly:

Retailers (physical stores, e-commerce)
Restaurants, hotels, hospitality operators
Service businesses taking card payments
Healthcare providers billing patients with cards
Educational institutions taking card tuition payments
Real estate operators taking card-based deposits/rent
Tourism and travel operators
Anyone processing card transactions

Service Providers

Organizations providing services that store, process, or transmit cardholder data on behalf of others:

Payment service providers (PSPs)
Payment processors
Hosting providers with card-handling clients
Cloud infrastructure providers serving card-handling customers
Call centres taking card payments
Document shredding services handling card-bearing documents

Issuers and Acquirers

UAE-licensed banks
Card-issuing institutions
Acquirer processors

Fintechs with card rails

Any UAE fintech with card components - payment cards, stored-value cards, corporate cards, debit card integration - faces PCI DSS obligations.

PCI DSS Merchant Levels

Your obligations depend on annual card transaction volume:

Level 1 - Over 6 million transactions annually

Full Report on Compliance (RoC) audited by Qualified Security Assessor (QSA)
Annual on-site audit
Quarterly vulnerability scanning by Approved Scanning Vendor (ASV)
Annual penetration testing
Specific to large merchants and all service providers at scale

Typical UAE Level 1 merchants: major hotel chains, large retail groups, telecom operators, airlines.

Level 2 - 1 million to 6 million transactions

Annual SAQ or RoC depending on card scheme and acquirer requirements
Quarterly ASV scanning
Annual penetration testing
Some UAE banks may push Level 2 merchants to RoC path

Level 3 - 20,000 to 1 million e-commerce transactions

Annual SAQ
Quarterly ASV scanning
Specific SAQ type based on card handling architecture

Level 4 - Under 20,000 e-commerce, or up to 1M other

Annual SAQ
Quarterly ASV scanning
Least stringent but still mandatory

Service Provider levels

Level 1 service provider: 300,000+ transactions annually - full RoC
Level 2 service provider: Under 300,000 annually - annual SAQ D for service providers

SAQ Types - Picking the Right One

If you qualify for Self-Assessment Questionnaire (SAQ), the specific type depends on how you handle card data:

SAQ A - Card-not-present merchants, all payment processing fully outsourced (e.g., redirect to PSP)
SAQ A-EP - E-commerce merchants with partial outsourcing (payment page loads PSP directly but merchant controls some elements)
SAQ B - Merchants with imprint machines or standalone dial-out terminals only
SAQ B-IP - Merchants with standalone IP-connected terminals only
SAQ C - Merchants with payment application connected to the internet
SAQ C-VT - Merchants using virtual terminal only
SAQ D - All others (includes service providers) - the longest questionnaire
SAQ P2PE - Merchants using PCI-listed P2PE (point-to-point encryption) solution

Choosing the right SAQ matters - wrong SAQ means either over-compliance (unnecessary burden) or under-compliance (certification invalid).

The 12 PCI DSS Requirements Explained

1. Install and maintain network security controls

Firewalls and routers configured to protect the Cardholder Data Environment (CDE). Network diagrams current. Documented rationale for services and ports.

2. Apply secure configurations

No vendor default passwords or security parameters. Hardening standards for all system components. Encrypted admin access.

3. Protect stored account data

Minimize storage. Strong cryptography for stored cardholder data. Masking PAN (Primary Account Number) when displayed. No sensitive authentication data after authorization.

4. Protect cardholder data with strong cryptography during transmission over open, public networks

Strong cryptography (TLS 1.2+) for all cardholder data transmission over public networks. No wireless for CDE transmission without strong controls.

5. Protect all systems and networks from malicious software

Anti-malware on all systems commonly affected. Anti-malware actively running. Anti-phishing mechanisms.

6. Develop and maintain secure systems and software

Security vulnerabilities tracked and addressed. Secure SDLC. Code reviews. Web application firewalls for public-facing web applications (or equivalent). Change management. Production and non-production environment separation.

7. Restrict access to system components and cardholder data by business need to know

Access control systems enforce least privilege. Default deny. Privileged access justified and documented.

8. Identify users and authenticate access to system components

Unique user IDs. MFA for admin access, remote access, and any non-console CDE access. Strong password requirements.

9. Restrict physical access to cardholder data

Facility access controls. Badging. Visitor authorization. Media handling. Device tracking. Destruction of obsolete media.

10. Log and monitor all access to system components and cardholder data

Audit trails. Log review. Time synchronization. Log retention (1 year minimum, 3 months immediately available).

11. Test security of systems and networks regularly

Quarterly vulnerability scanning (ASV for external, internal can be self). Annual penetration testing (Requirement 11.4 - see PCI DSS penetration testing guide). Segmentation testing (annually or semi-annually for Level 1 service providers). Change detection.

12. Support information security with organizational policies and programs

Information security policy. Risk assessment. User awareness. Incident response. Third-party management. Vendor responsibility allocation.

UAE-Specific Considerations

CBUAE alignment

UAE-licensed banks and payment institutions maintain PCI DSS compliance alongside CBUAE Information Security standards. The two frameworks overlap but aren’t identical - PCI DSS is CDE-focused; CBUAE is institution-wide.

SWIFT CSP

Banks participating in SWIFT also maintain Customer Security Programme (CSP) compliance. SWIFT CSP has specific penetration testing and red teaming expectations that CBUAE examinations cross-reference. See our SWIFT CSP CBUAE Compliance guide.

Data residency

UAE PDPL and sector-specific regulations may restrict where cardholder data can be stored or processed. PCI DSS doesn’t mandate data residency; local UAE regulations do. Scope design must accommodate both.

UAE-specific QSAs

Not all QSAs have UAE experience. QSA selection should consider UAE regulatory familiarity, Arabic-language support if needed, and on-site audit logistics within the UAE. Big Four, large specialist QSA firms, and some regional specialists serve the UAE market.

Tokenization as scope reduction

For many UAE merchants, implementing payment tokenization is the fastest path to PCI DSS scope reduction. Tokenized CDE is smaller CDE. Smaller CDE is cheaper to protect and audit. Our payment tokenization guide explains the approach.

Getting to Certification

Phase 1 - Scope definition

Identify every system, process, person, and third party that stores, processes, or transmits cardholder data. Boundary of the CDE. Systems connected to or impacting CDE. Out-of-scope rationale.

Phase 2 - Gap analysis

Against the 12 requirements, identify current state vs required state. Our gap analysis service produces prioritized remediation roadmap.

Phase 3 - Remediation

Address gaps. Implement controls. Often the longest phase. Our remediation planning service sequences work for fastest path to certification.

Phase 4 - Testing

Vulnerability scanning. Penetration testing. Segmentation testing. Internal and external ASV scans. Documentation preparation.

Phase 5 - Validation

SAQ completion with evidence, or QSA engagement and on-site audit for RoC path. Our QSA readiness service prepares you to pass on first audit.

Phase 6 - Ongoing compliance

PCI DSS is not a one-time exercise. Continuous compliance requires: quarterly ASV scanning, annual testing, change-triggered testing, ongoing security awareness training, incident response readiness, and annual re-certification.

Common UAE PCI DSS Mistakes

Under-scoping CDE - missing systems that touch cardholder data
Over-scoping CDE - including systems that shouldn’t be in scope, inflating cost
Wrong SAQ type - invalid self-assessment
Inadequate segmentation - claiming segmentation without proper controls or testing
Quarterly scanning lapses - missing quarterly ASV scans invalidates compliance
Retest evidence missing - finding “remediated” without independent validation
Third-party management gaps - material service providers not covered
Insufficient incident response testing - untested playbooks fail under pressure

How pcidss.ae Supports UAE Certification

Our engagement types:

PCI DSS Gap Analysis - scoped assessment with prioritized remediation roadmap
SAQ Assistance - right SAQ selection and completion support
QSA Readiness - prepare for first-time audit success
Remediation Planning - sequencing remediation for fastest path
Payment Tokenization - scope reduction through tokenization
SWIFT CSP & CBUAE Compliance - combined scope for banking clients

PCI DSS Compliance for UAE Merchants - merchant-focused deep dive
PCI DSS for Fintechs - fintech-specific considerations
QSA Readiness Checklist - pre-audit preparation
SAQ Types Explained - picking the right self-assessment
Payment Tokenization & PCI Scope - scope reduction strategy
SWIFT CSP & CBUAE Compliance - banking-specific

Common Questions

Frequently Asked Questions

What is PCI DSS certification and who needs it in UAE?

PCI DSS (Payment Card Industry Data Security Standard) certification is required for any UAE organization storing, processing, or transmitting cardholder data. This includes merchants accepting card payments (retail, hospitality, e-commerce), payment service providers, banks processing cards, fintechs with card rails, hospitality operators, service providers handling cardholder data for clients, and call centres taking card-not-present payments. Certification level (SAQ vs RoC) depends on annual transaction volume.

What are PCI DSS merchant levels?

Four merchant levels based on annual Visa/Mastercard transactions: Level 1 (over 6M transactions - requires full Report on Compliance audit by QSA), Level 2 (1M-6M - annual RoC or SAQ depending on card scheme), Level 3 (20K-1M e-commerce - annual SAQ), Level 4 (less than 20K - annual SAQ plus quarterly scanning). Service providers have separate levels. UAE banks and large payment institutions are Level 1; most mid-size merchants are Level 2 or 3.

How long does PCI DSS certification take in UAE?

Timeline depends on current state and scope. Well-prepared organization with existing security controls: 3-6 months from kickoff to certification. Organization with significant gaps: 6-12 months including remediation. Specific phases: gap analysis (4-6 weeks), remediation (2-6 months), pre-audit or SAQ validation (2-4 weeks), QSA audit for RoC path (3-6 weeks), ongoing compliance maintenance. First-time certification typically takes longer; annual recertification is faster.

How much does PCI DSS certification cost in UAE?

Varies significantly by scope and merchant level. Small Level 4 merchant doing SAQ A: AED 15,000-40,000 for consultancy support. Level 2-3 SAQ B or C: AED 50,000-150,000. Level 1 RoC audit: AED 300,000-800,000+ for QSA audit fees, plus AED 200,000-500,000 for remediation consulting. Banking Level 1 with complex CDE: AED 1,000,000+. Segmentation testing, penetration testing, and vulnerability scanning add AED 50,000-300,000 annually depending on scope.

What's the difference between SAQ and RoC?

SAQ (Self-Assessment Questionnaire) is a self-attestation available to merchants below Level 1 thresholds. Multiple SAQ types (A, A-EP, B, B-IP, C, C-VT, D, P2PE) apply based on how cardholder data is handled. RoC (Report on Compliance) is a full audit by a Qualified Security Assessor (QSA) - required for Level 1 merchants and service providers. Both demonstrate PCI DSS compliance; RoC is substantially more rigorous and expensive. UAE CBUAE-licensed banks typically need RoC regardless of transaction volume.

Does CBUAE require PCI DSS certification?

CBUAE Information Security standards and Retail Payment Services and Card Schemes Regulation require UAE-licensed card-handling institutions to maintain PCI DSS compliance. Banks, payment service providers, and stored-value facility issuers must demonstrate compliance as part of their supervisory obligations. CBUAE examinations cross-reference PCI DSS compliance evidence with broader cyber risk management requirements. PCI DSS compliance alone does not satisfy all CBUAE requirements - broader CBUAE cyber risk framework applies too.

Start Your PCI DSS Journey

Book a free 30-minute compliance discovery call with our PCI DSS specialists in Dubai. We assess your current posture and identify the fastest path to compliance - actionable findings in days.

Talk to an Expert