As digital transactions continue to expand, the security of payment data and payment systems has become a critical part of financial infrastructure. Krungthai Card Public Company Limited (KTC) has achieved compliance with the Payment Card Industry Data Security Standard (PCI DSS) Version 4.0.1 for its card acquiring business following an assessment by BSI Group Japan K.K., a Qualified Security Assessor (QSA). KTC received a “Compliant” assessment result, confirming that it met all applicable requirements within the assessed scope.
KTC’s acquiring business recorded approximately 100 billion baht in transaction value from January through October 2026. Its merchant network comprises approximately 60,000 merchants, supported by around 28,000 Electronic Data Capture (EDC) terminals, while more than 32,000 merchants operate online. The scale of the network and transaction volume underscores the importance of strengthening the protection of cardholder data, systems, and payment processes alongside business expansion, as payment methods and associated risks continue to evolve.
Mrs. Wilaiwan Nopparat, Head of Information Technology at KTC, said, “Growth in the acquiring business should not be measured solely by transaction volume or value. It must also be supported by secure and reliable infrastructure, as every transaction connects cardholders, merchants, and partners across the payment ecosystem. For KTC, security is therefore more than a compliance requirement; it is a fundamental part of building trust and supporting sustainable business growth over the long term.”
The PCI DSS Version 4.0.1 assessment covers key security measures across systems and processes within the scope of KTC’s acquiring business, including access controls, cardholder data protection, system monitoring, and the management of vulnerabilities and cybersecurity risks. Measures include protecting data during storage and transmission, restricting access to authorized personnel based on business need, and ensuring that sensitive authentication data, such as card verification value (CVV) codes, is not stored after transaction authorization.
“Cyber threats continue to evolve, so security cannot be treated as a one-time exercise. It requires ongoing vigilance, monitoring, and continuous improvement. KTC will continue to strengthen its systems, people, and processes to support emerging payment methods and business growth while maintaining the confidence of merchants, customers, and business partners,” Mrs. Wilaiwan added.
About PCI DSS
The Payment Card Industry Data Security Standard (PCI DSS) is a global payment card data security standard developed by the PCI Security Standards Council (PCI SSC). It establishes baseline technical and operational requirements for organizations that store, process, or transmit payment card data, or that could affect the security of the cardholder data environment. PCI DSS Version 4.0.1 is a limited revision of Version 4.0 that provides additional clarification and guidance without adding or removing any requirements.