PCI DSS 4.0.1 was published on 11 June 2024 as a minor revision of version 4.0. Version 4.0 was retired on 31 December 2024, so 4.0.1 is the only valid version.

Requirements labelled future-dated were optional best practice until 31 March 2025. They became mandatory on 1 April 2025.

The customised approach

Version 4 lets a company meet the intent of a requirement in its own way, if a Qualified Security Assessor analyses it. The classic approach, where each requirement is met exactly as written, still exists.

Questions for a partner

  • Which version are you assessed against, and when was your last report?
  • Which parts of card handling are yours and which stay with us?
  • Do you use the customised approach anywhere?

Sample story, checked against the source on 17 October 2026. Confirm details with the source before you rely on them.

Source: PCI DSS v4.0.1 overview