PA-DSS

What PA-DSS is

PA-DSS, short for Payment Application Data Security Standard, was a PCI security standard for payment application software. It set security requirements for developers and integrators whose applications stored, processed, or transmitted cardholder data during authorization or settlement. The standard focused on commercial applications sold, distributed, or licensed to other businesses.

Its purpose was to reduce vulnerabilities in payment software and help protect sensitive payment data. Requirements addressed issues such as protecting stored cardholder data, logging application activity, securing remote access and updates, and preventing storage of prohibited data such as full magnetic-stripe data and card security codes.

PA-DSS has been retired since October 28, 2022. An old listing is not current software validation.

PA-DSS is retired

PCI SSC retired PA-DSS on October 28, 2022. The replacement is the PCI Software Security Framework, or SSF, which includes the Secure Software Standard for payment software and the Secure Software Lifecycle Standard for software vendors’ development practices.

PA-DSS applications are expired. The PCI SSC listing places them under “Acceptable Only for Pre-Existing Deployments.” That label reflects a limited status for existing installations, not current validation for a new deployment. The SSF also expanded eligibility beyond the types of payment applications covered by PA-DSS, including software used for functions such as fraud monitoring and cardholder authentication.

What it means for your business

PA-DSS was aimed at software vendors and developers, not a separate merchant certification. Using validated payment software can support your efforts to meet PCI DSS requirements, but a PA-DSS listing does not certify your business as PCI DSS compliant. Your own PCI DSS obligations depend on how your business accepts, processes, and handles cardholder data.

If your point-of-sale or payment application is old, identify its name and version and search the PCI SSC listing. A PA-DSS listing marked “Acceptable Only for Pre-Existing Deployments” is not evidence that the product has current validation. For a current product, look for validation under the PCI Secure Software Program.

What it means for your costs

PA-DSS is a security standard, not an interchange rate, network assessment, or processing fee. The research materials do not identify a PA-DSS fee charged to merchants or a standard PA-DSS line on a processing statement. A charge described as a PCI or compliance fee is a separate billing item, not the PA-DSS standard itself.

The practical cost risk is using payment software that is no longer supported or validated, which can complicate security work and PCI DSS assessment. The PA-DSS retirement itself does not set a deadline or fee for your business. If you are unsure whether a specific product is acceptable for your setup, ask your acquirer or the payment brands which software validation and merchant requirements apply.

What you can actually change

1. 01
   Identify your software. Record the name and version of each payment application used at checkout, online, or in back-office payment workflows.
2. 02
   Check its current status. Search the PCI SSC listing. Treat a PA-DSS entry marked “Acceptable Only for Pre-Existing Deployments” as expired, not current validation.
3. 03
   Confirm your requirements. Ask your acquirer or the payment brands which validated software and merchant PCI DSS requirements apply to your specific setup.

Frequently asked questions