PCI DSS in the UAE and GCC: compliance, QSA validation and the regional rules around card data

Why companies in the UAE and GCC need PCI DSS

The trigger is usually commercial. A Dubai retailer opening an online store, a hotel group taking cards at the front desk, a free-zone contact centre handling payments for overseas clients or a fintech building a payment platform is asked for evidence by its acquiring bank or by the customer whose card data it touches.

Merchants hear it from the acquirer; service providers hear it from clients who want an Attestation of Compliance before the contract goes live. The standard itself is covered on the PCI DSS hub, and whether it applies to you in Do you need PCI DSS?

Saudi Arabia adds a regulatory layer for the financial sector. The SAMA Cyber Security Framework, under its subdomain on compliance with national and international industry standards, requires regulated financial institutions to comply with PCI DSS, the EMV technical standard and the SWIFT Customer Security Controls Framework. For a Saudi bank or insurer, the AOC is also evidence in a SAMA review. SAMA CSF

Who validates PCI DSS compliance in the UAE

PCI DSS is validated, not certified, and no national accreditation body is in the chain: QSA companies and Approved Scanning Vendors are qualified or approved directly by the PCI Security Standards Council.

Your acquirer

Merchant levels are set by the card brands on annual transaction volume and applied by your acquiring bank. Ask it in writing which level applies, whether it expects a Report on Compliance or a self-assessment questionnaire, by when, and whether any local payment-scheme or regulatory rule applies on top.

Your QSA and ASV

The Council's QSA list can be searched by place of business, region and language, and a QSA company may assess only in the regions and countries it is qualified for. Check that the firm is listed for the region covering the UAE or Saudi Arabia, is not marked "In Remediation", and that its assessors appear on the professional lookup. Do the same on the ASV list for the quarterly external scans. Choosing a QSA

Be wary of anyone selling a "PCI certificate". The documents that count are the AOC and the ROC or SAQ behind it.

Local practice that changes a PCI DSS project

Mainland, free-zone and Saudi entities

A group may hold a mainland licence, a DIFC or ADGM entity and a Saudi subsidiary, each with its own merchant agreement. The AOC names the assessed entity, so decide early which entities are validated and show in the CDE diagrams where each one ends.

In-country hosting and shared services

Many UAE and Saudi businesses host payments in local data centres or cloud regions. Each hosting, payment gateway and tokenisation provider needs a current AOC and a clear split of responsibilities. Support desks or developers abroad with access into the CDE are in scope wherever they sit. Scoping and segmentation

Card data is also personal data

For mainland companies, cardholder names and card numbers fall under Federal Decree by Law No. 45 of 2021, the UAE PDPL. Its Article 20 asks for risk-based security measures, including encryption, and its transfer rules reach processing abroad. PCI DSS controls support that work without replacing it. DIFC and ADGM entities follow their own data protection laws instead. UAE PDPL

Records and assessment logistics

Most records are in English, some HR and supplier records in Arabic; confirm the QSA can read what it samples. Fieldwork often mixes remote review with visits to stores, hotels or contact centres.

Local items to check, and where

How Sterling works on PCI DSS in the UAE and GCC

Sterling runs UAE and GCC engagements from its Dubai office, on site and remotely, drawing on 8,100+ client engagements in 60+ countries since 2003. Sterling does not validate compliance: the QSA assesses and attests, or your executive signs the SAQ and its AOC.

PCI DSS in the UAE and GCC: questions buyers ask