Payment Processing Compliance for Startups

Purpose

This recipe produces a complete payment processing compliance implementation — covering PCI DSS level determination and SAQ completion, payment provider selection and integration, cross-border regulatory compliance (PSD2/SCA for EU, money transmitter licensing for US), and KYC/AML program setup. The output is a production-ready payment system that passes PCI compliance validation, handles multi-region transactions legally, and scales without accumulating regulatory debt. [src1]

Prerequisites

• Legal entity formed — incorporated business with EIN/tax ID and business bank account
• Business model documented — clear description of what is sold, who pays, and how funds flow (direct sale vs. marketplace)
• Target market list — countries where you will accept payments, with expected volume per region
• Financial projections — expected annual transaction count and average order value (determines PCI compliance level)
• Technical environment — web application or platform where payment integration will be deployed
• Legal counsel access — attorney familiar with fintech/payments for license applications (recommended for marketplace or fintech models)

Constraints

• PCI DSS 4.0.1 became mandatory March 31, 2025. All 12 requirements plus 47 new sub-requirements apply. Non-compliance penalties are $5,000-$100,000/month from card brands. [src1]
• If your startup touches customer cardholder data directly, you are a service provider subject to SAQ D or full ROC — not the simpler SAQ A. Use hosted payment forms to avoid this. [src2]
• Marketplace and platform models where you facilitate payments may trigger money transmitter licensing in 40+ US states. Processing time averages 6-12 months per state. [src5]
• PSD2 Strong Customer Authentication (SCA) is mandatory for EU/EEA transactions over EUR 30. Transactions failing SCA will be declined by issuing banks. [src3]
• BSA/AML program required if you qualify as a Money Services Business (MSB) under FinCEN — includes CDD, transaction monitoring, SAR filing, and 5-year record retention. [src4]
• PSD3, expected 2026-2027, will extend liability for fraud to technical service providers including digital wallet operators. [src7]

Tool Selection Decision

Which path?
├── Ecommerce startup (selling own products) AND US or US+EU
│   └── PATH A: Stripe Checkout — hosted redirect, SAQ A, fastest setup
├── SaaS with subscriptions AND any market
│   └── PATH B: Stripe Elements + Billing — embedded payment form, SAQ A, recurring billing
├── Marketplace/platform (facilitating payments between parties)
│   └── PATH C: Stripe Connect — platform payments, KYC handled by Stripe, MTL exemption possible
└── Fintech or custom payment flow (holding/transmitting funds)
    └── PATH D: Adyen + custom compliance — dedicated merchant account, full PCI program, MTL required

Execution Flow

Step 1: Determine Your PCI DSS Compliance Level

Duration: 30 minutes · Tool: PCI SSC documentation

Identify your compliance level based on projected annual card transaction volume. This determines whether you need an SAQ or a full QSA audit. [src6]

PCI DSS Merchant Levels:
Level 1: > 6 million transactions/year   → Full QSA audit (ROC), $15K-$50K+/yr
Level 2: 1-6 million transactions/year   → Annual SAQ + quarterly ASV scans
Level 3: 20K-1M e-commerce txn/year      → Annual SAQ + quarterly ASV scans
Level 4: < 20K e-commerce txn/year       → Annual SAQ (ASV recommended)

Most startups: Level 3 or Level 4

SAQ Type Selection:
SAQ A:   Card data fully outsourced (Stripe Checkout/Elements) → 29 requirements
SAQ A-EP: Partial outsourcing (your server controls page)      → 139 requirements
SAQ D:   All other / service providers                         → 260+ requirements

Verify: Projected volume maps to a specific level and integration approach maps to a specific SAQ type. · If failed: If volume is uncertain, assume Level 3 and SAQ A.

Step 2: Set Up Payment Provider and PCI-Compliant Integration

Duration: 1-3 days · Tool: Stripe (Path A/B/C) or Adyen (Path D)

For most startups, Stripe with Checkout or Elements provides the fastest path to PCI-compliant payment acceptance. Hosted payment fields ensure cardholder data never touches your servers. [src8]

PATH A — Stripe Checkout (Redirect):
1. Create Stripe account at https://dashboard.stripe.com/register
2. Complete business verification (EIN, business address, bank account)
3. Integrate Stripe Checkout (server-side session creation)
4. Enable 3D Secure for EU transactions (automatic with Stripe Radar)
5. Configure webhook endpoint for payment confirmations

PATH B — Stripe Elements (Embedded):
1-2. Same as above
3. Add Stripe.js to payment page (loads from Stripe CDN)
4. Mount Payment Element with appearance customization
5. Set up CSP headers: frame-src https://js.stripe.com; script-src https://js.stripe.com;

PATH C — Stripe Connect (Marketplace):
1-2. Same as above
3. Apply for Stripe Connect (platform account)
4. Set up connected account onboarding flow
5. Stripe handles KYC/AML for connected accounts

PATH D — Adyen (Custom/Fintech):
1. Apply at https://www.adyen.com/ (underwriting: 1-4 weeks)
2. Integrate Adyen Drop-in or API
3. Implement full PCI DSS program (SAQ D: 260+ requirements)

Verify: Process a test transaction end-to-end in sandbox mode. · If failed: If Stripe verification stalls, check business information matches state registration exactly.

Step 3: Complete PCI DSS Self-Assessment

Duration: 1-5 days (SAQ A) or 2-8 weeks (SAQ D) · Tool: PCI SSC SAQ forms or compliance platform

Complete the applicable SAQ and implement all required controls. SAQ A has 29 requirements focusing on access controls, vendor management, and policy documentation. [src1]

SAQ A Key Requirements (PCI DSS 4.0.1):
Req 2: Secure default configurations — change all default passwords
Req 6: Secure systems — CSP headers for iframe; patched systems
Req 7: Restrict access — need-to-know on payment dashboards
Req 8: Authentication — MFA, 12-char passwords, lockout after 10 failures
Req 11: Security testing — quarterly ASV scans ($100-$500/quarter)
Req 12: Security policies — documented policies, annual training, IR plan

Verify: All SAQ questions answered “Yes” or justified “N/A.” ASV scan shows no high/critical vulnerabilities. · If failed: Remediate vulnerabilities and re-scan (unlimited re-scans within quarter).

Step 4: Implement Cross-Border Compliance (EU: PSD2/SCA)

Duration: 1-3 days (Stripe/Adyen) or 2-4 weeks (custom) · Tool: Payment provider SCA features

If accepting payments from EU/EEA customers, PSD2 Strong Customer Authentication is mandatory. [src3]

PSD2/SCA Compliance Checklist:
[ ] 3D Secure 2 (3DS2) enabled for EU transactions
[ ] SCA exemptions configured: low-value (< EUR 30), recurring, low-risk TRA
[ ] Payment failure handling for SCA challenges
[ ] PSD3 preparation (expected 2026-2027): monitor ECB/EBA announcements

Verify: Test with 3DS-required test card. Confirm challenge appears and completes. · If failed: Check Stripe Radar rules or Adyen risk engine configuration.

Step 5: Assess and Implement Licensing Requirements (US: MTL, FinCEN)

Duration: 1 week (assessment) to 6-12 months (licensing) · Tool: Legal counsel, FinCEN portal

Determine whether your business model requires money transmitter licensing and/or FinCEN MSB registration. Critical for marketplace, platform, and fintech models. [src5]

Models that typically NEED MTL:
- Payment facilitator holding funds in escrow
- Wallet/stored-value provider
- Money transfer/remittance service

Models that typically DO NOT need MTL:
- Ecommerce selling own products (merchant)
- SaaS subscription billing (merchant)
- Marketplace using Stripe Connect (Stripe holds MTL)

State MTL requirements:
- Application fee: $500-$5,000 per state
- Surety bond: $25,000-$500,000 (varies)
- Net worth minimum: $100,000-$500,000
- Processing time: 6-12 months

Verify: Legal counsel has confirmed MTL requirements. If required, FinCEN MSB registration filed. · If failed: Use Stripe Connect to potentially inherit Stripe's MTL coverage.

Step 6: Set Up KYC/AML Program

Duration: 1-2 weeks · Tool: Stripe Identity or manual compliance program

If your startup qualifies as an MSB, implement a KYC/AML program satisfying BSA requirements. [src4]

KYC/AML Program Components:
1. Customer Identification Program (CIP): ID verification, Stripe Identity ($1.50/check)
2. Customer Due Diligence (CDD): risk-rating, beneficial owner verification, sanctions screening
3. Transaction Monitoring: $10K+ CTR filing, structuring detection, unusual patterns
4. Reporting: CTRs and SARs via FinCEN BSA E-Filing
5. Record Retention: 5+ years for all customer and transaction records
6. Training: annual AML training for all employees

Verify: Written AML policy approved by compliance officer. CIP procedures tested. Sanctions screening integrated. · If failed: Consider compliance-as-a-service (Unit21, Alloy, Sardine: $500-$2,000/month).

Output Schema

{
  "output_type": "payment_compliance_plan",
  "format": "JSON",
  "columns": [
    {"name": "compliance_area", "type": "string", "description": "PCI DSS, PSD2/SCA, MTL, KYC/AML"},
    {"name": "status", "type": "string", "description": "not_started, in_progress, compliant, not_applicable"},
    {"name": "level_or_type", "type": "string", "description": "PCI Level 1-4, SAQ A/D, MSB status"},
    {"name": "provider", "type": "string", "description": "Payment provider or compliance tool selected"},
    {"name": "estimated_cost", "type": "string", "description": "Annual compliance cost estimate"},
    {"name": "next_action", "type": "string", "description": "Immediate next step for this area"}
  ],
  "expected_row_count": "4-6",
  "sort_order": "risk priority descending",
  "deduplication_key": "compliance_area"
}

Quality Benchmarks

If below minimum: Do not launch payment processing in production until minimum thresholds are met for PCI DSS and applicable licensing.

Error Handling

Cost Breakdown

Anti-Patterns

Wrong: Handling raw card numbers on your own servers

Storing or processing cardholder data directly escalates you from SAQ A (29 requirements) to SAQ D (260+ requirements) — transforming PCI compliance from a two-week project into a six-month effort costing $50,000+. [src2]

Correct: Always use hosted payment fields

Use Stripe Checkout (redirect), Stripe Elements (iframe), Adyen Drop-in, or Braintree Hosted Fields. Your server never sees card numbers, keeping you at SAQ A.

Wrong: Launching a marketplace without assessing MTL requirements

Operating as a money transmitter without a license is a federal offense with penalties up to $250,000 and 5 years imprisonment. [src5]

Correct: Get legal assessment before processing third-party funds

Have fintech counsel assess your money transmission exposure before launching marketplace payments. Use Stripe Connect to potentially shelter under Stripe's licenses.

Wrong: Ignoring PSD2/SCA for EU customers

Transactions without proper SCA will be soft-declined by EU issuing banks, causing 10-30% payment failure rates. [src3]

Correct: Enable 3DS2 before accepting EU payments

Activate 3D Secure 2 for all EU-originating transactions. Configure exemptions to minimize checkout friction while maintaining compliance.

Wrong: Treating PCI compliance as a one-time checkbox

PCI DSS requires ongoing compliance — quarterly ASV scans, annual SAQ re-assessment, continuous monitoring. Letting compliance lapse risks fines and breach liability. [src1]

Correct: Schedule recurring compliance activities

Set quarterly reminders for ASV scans, annual reminders for SAQ re-assessment and staff training, and integrate compliance monitoring into your development workflow.

When This Matters

Use this recipe when a startup is setting up payment processing for the first time or expanding to new geographic markets. It produces a compliant payment infrastructure with clear regulatory standing. Required before accepting any real payment transactions — launching without PCI compliance or proper licensing exposes the startup to fines, fraud liability, and potential criminal penalties.