Ask a payment vendor whether they are PCI compliant and the answer will almost always be yes. A more useful question for a Business Central team is: What PCI assessment does your payment architecture put you on?
That question matters because PCI compliance is not simply a certification a vendor can hand over. The scope of your cardholder data environment is influenced by how payment information moves through your systems, and those decisions often happen long before anyone starts thinking about compliance.
Why Payment Architecture Affects PCI Scope
Every payment integration makes decisions about where card data enters an environment, where it is stored, and which systems have access to it.
A Business Central implementation might include online payments, card-present terminals, multiple entities, or several payment gateways. Each connection can expand the environment that needs to be considered as part of PCI compliance.
PCI DSS 4.0 also raised the bar for organizations that store, process, or transmit cardholder data. The PCI Security Standards Council organizes its requirements around areas including network security, cardholder data protection, vulnerability management, access control, monitoring, and information security policies.
The question is not whether those requirements matter. It is how much of your environment actually falls within their scope.
Scope Can Change the Compliance Burden
Businesses validate PCI compliance through a Self-Assessment Questionnaire (SAQ), and the appropriate questionnaire depends on the organization's payment environment.
When a merchant never handles raw card numbers because payment information is captured through a hosted payment page or iframe, the assessment can be significantly narrower. SecurityMetrics notes that some merchants may face questionnaires with roughly 30 questions, while environments that store or directly handle card data can face much more extensive assessments.
That difference can translate into a meaningful difference in time, documentation, and resources.
The architecture decision therefore happens before the questionnaire. By the time a business discovers that its payment environment creates unnecessary scope, changing it can be expensive.
Designing Payments to Reduce Scope
For Business Central users, an architecture-first approach starts by keeping raw card data out of the ERP and internal systems wherever possible.
A hosted payment page or iframe can capture card information outside the merchant's environment. The card can then be replaced with a token, allowing Business Central to store a reference rather than the actual card number.
This approach can also support recurring billing and repeat purchases without requiring the ERP to store sensitive card information.
An independent card vault provides another layer of separation. Instead of tying stored payment credentials directly to one gateway, tokenized information can remain in a purpose-built environment.
The same principle applies to card-present payments. A terminal that communicates directly with the processor can help keep card data off the organization's internal network instead of routing it through systems that would then need to be secured within the PCI environment.
Ask About Architecture, Not Just Certifications
When evaluating a payment provider, asking whether it is PCI compliant is only the starting point.
Business Central teams should also ask where card data is captured, whether raw card numbers ever enter the ERP or internal network, when tokenization occurs, and what happens to PCI scope when the business adds another entity, gateway, currency, or card-present location.
Those questions can reveal much more about the actual compliance burden than a certification badge alone.
PCI obligations do not disappear when an organization reduces its scope. Businesses still need appropriate policies, access controls, monitoring, and annual validation. But a smaller cardholder data environment means fewer systems and processes need to be brought into that effort.
Start With Your Current Payment Flow
Before selecting a new payment provider, map how card data currently moves through your environment.
Look at each gateway, entity, payment page, and card-present location. Identify where raw card numbers touch your systems and where tokenization occurs.
That map can reveal where unnecessary PCI scope exists and where a different payment architecture could reduce the burden.
Want to see what an architecture-first approach could look like in Business Central? Read the full article, .