Twenty years in, PCI DSS is still evolving. Jeremy King, PCI's European vice president for 15 years, explains why the standard can't stand still, and why your PCI compliance program shouldn't either.
Recorded at PCI North America Community Meeting in Vancouver for PCI's 20th anniversary, SecurityMetrics QSA Jen Stone and Jeremy go behind the scenes of how the PCI Security Standards Council writes standards, how criminals adapt as payment security improves, and why merchants who chase the certificate are missing the point.
Questions theyanswer:
- How does the PCI Security Standards Council decide what goes into PCI DSS?
- Do the card brands influence PCI standards?
- Can anyone write a security standard for AI?
- Will PCI DSS ever stop changing?
- Why are criminals moving from card data to ransomware, deepfakes, and CEO fraud?
- Why does operational resilience matter for ransomware recovery?
- Is PCI compliance just a checkbox?
Chapters:
- 0:00 Meet Jeremy King
- 0:45 Balancing competing voices in PCI standards
- 2:20 Why final standards look nothing like first drafts
- 3:15 From PCI v1 to v3, and the AI challenge
- 4:35 The card brands are competitors
- 5:20 Will PCI DSS ever stop changing?
- 6:40 Why criminals moved beyond card data
- 7:50 Operational resilience and ransomware
- 8:25 PCI is the bedrock of security
- 9:10 Stop chasing the certificate
- 9:45 Thank you, Jeremy
Why PCI DSS Will Never Stop Changing: A Conversation with Jeremy King
Recorded during PCI's 20th anniversary at PCI North America Community Meeting, SecurityMetrics QSA Jen Stone talks with Jeremy King, who spent 15 years as PCI's European vice president, about how PCI standards are developed, why PCI DSS keeps evolving, and why compliance should start with security.
Who is Jeremy King?
Jeremy King spent 15 years as the European vice president for PCI and retired in 2025 after roughly 30 years in the payments industry. He came out of retirement for PCI's 20th anniversary to talk with SecurityMetrics QSA Jen Stone.
Jen Stone: So would you please tell people a little bit about yourself?
Jeremy King: Jeremy King. I was the European vice president for PCI for 15 years. My goodness. And I retired in 2025 after really sort of 30 years in the industry. And it was like, yeah, okay. It was time, time to pack the bags and go away. And then suddenly, PCI celebrating its 20th anniversary, and JB from SecurityMetrics kindly invited me out of retirement for one last hurrah. And here I am.
How does the PCI Security Standards Council develop new standards?
According to Jeremy King, the Council is always playing catch-up with new payment technology. It has to weigh conflicting views from different companies and create standards that are balanced and meet real market needs.
Jen Stone: You have such deep institutional knowledge and just a wealth of experience in PCI. There are a lot of people who, from different perspectives, their needs need to be met by the standard and the development of it. And I'd like to have your insights into how does that work, and how do you make sure that those needs are met in the community?
Jeremy King: That's a really good question. I think, again, just a little bit of history. Back in the day, payments were really easy. You either used cash or you used a credit card in the store. And then we started going online. But it was still quite simple, four-party model. And then technology does what technology does. So sometimes the council is playing catch-up with a standards body. They're always playing catch-up. And so when something new's coming along, there's a lot of issues that need to be addressed to see whether a standard is the right thing. Now you get two different companies looking at new technology in different ways. Are they going to try and want the standard to reflect how they're approaching it? Yes, they are. They may not align. So you may have conflicting areas. And the council has got to try and create standards that meet the market needs, are balanced, are going to provide the right level of security across the right area.
Jen Stone: Right.
Who has input into PCI DSS requirements?
Participating organizations, the Board of Advisors, and other engaged groups give input during standards development. Jeremy notes the Council doesn't have experts in every field, so that outside input is essential.
Jeremy King: And so we'll start the development, and the beauty of engagement with the council, of the GEAR, of the Board of Advisors, of the Principal, is that they get now input into the development of their standards.
Jen Stone: Okay.
Jeremy King: And that's a really good part, because the council, certainly when I was there, the council doesn't have experts across every field. We've got some very, very knowledgeable people. The brands have got some very knowledgeable people, but some of the technologies, we're hearing an awful lot about AI. Does it mean it's going to be perfect? No, not necessarily. Does it mean that it's going to meet the needs of the industry? We hope so. Certainly on some of the standards I worked on and oversaw in the past, you could see that what came out was nothing like where we started.
Jen Stone: Oh, okay.
Why do final PCI standards look different from the first draft?
Industry feedback shapes what's realistic. A requirement no one can meet doesn't work, which is why PCI DSS version 1 was scaled back and the standard reached its intended level by version 3.
Jeremy King: Because sometimes you're like, yeah, you'll get a comment. It's like, yeah, that's really good. And then I remember you'll get a comment. It's like, we can't do that. And it's not good to have a requirement no one can meet. You know, it doesn't go down well. Looking into the history, the first version of the standard. Yes, the brands wanted to go further, but the industry was like, we're not there yet. So version one was followed through. And by version three, we've got to where we're going to be.
Can there be a security standard for AI?
Jeremy expects AI standards to follow the same gradual path as early PCI DSS. The challenge is that AI changes so quickly that it's hard to know where to start.
Jeremy King: It's probably going to be the same with artificial intelligence. But the challenge there is it changes so quickly. So when you're trying to write a standard, you're trying to make AI secure. Well, where do you start?
Jen Stone: Yeah. How?
Jeremy King: Oh, that's it. And so you see all these different views. And as the council, the council has got to try and take all those into consideration. I always remember a great cartoon. The guy's in this room, and he's on the phone to his wife, and it's like, "It's all over bar the shouting," and behind him there's a huge shouting match going on. And sometimes it's like that. Everyone wants to try and get their voice heard. Everyone wants to try and get their point across.
Jen Stone: Right.
Do the card brands influence PCI standards?
Yes. The card brands are competitors, and each may look for an advantage. The PCI Council's job is to separate genuine security needs from product-driven influence and produce a standard everyone will adopt.
Jeremy King: Take that on board, digest it, work out whether that's just somebody trying to influence because that's how their product is developed, or whether that's a particular... And don't forget, the brands are competitors, right? And sometimes we forget that the brands are competitors. And so they're not averse sometimes to looking at, thinking, we might be able to get a bit of advantage over the brands. And the council's trying to manage all of this and then bring it into a standard that everyone's going to adopt and feel happy with, right?
Will PCI DSS ever stop changing?
No. Every new payment technology creates a gap that criminals move quickly to exploit, and the standard has to evolve to close it. Jen Stone and Jeremy King both see that adaptability as a strength.
Jen Stone: I think it's very interesting, and it helps maybe inform our current understanding of where is PCI now, and will it continue to grow. Because where it came from, it has always grown. It has always been modified and changed based on current understandings, based on current threats that are actually being seen out there in the payment card space. And so sometimes I'll get asked, because I'm a QSA and I work with a lot of merchants and service providers, and I'll get asked, is it going to stop changing? Can we have this standard not change for a while? And my response is, I don't know what other new threats and vulnerabilities are there that we are not currently addressing. It has to do with what's actually happening in the real world. And so as much as we would like to just take a break from the changes and have things be super predictable for a while, that's not the way that technology works. And I'm actually relieved that we have an organization that can adapt and modify and really support us in our efforts to keep organizations secure.
Jeremy King: No, absolutely. And it's a really good example there, because again, throughout the history, as soon as you thought, oh, we've got this sorted, some new technology would come and a new way of doing the payment in. You're like, oh, here we go again. Because as soon as there was a new technology, the standards then are playing catch-up, and there's a gap.
Jen Stone: Yes.
Jeremy King: And there's a gap the criminals are so quick to exploit.
Jen Stone: Yes.
Jeremy King: So then you're racing to close that gap.
Jen Stone: Yeah.
Why did criminals move beyond stealing card data?
As payment security improved, criminals shifted to monetizing personal data, ransomware, deepfakes, and CEO fraud. Jeremy questions whether stronger payment security pushed them there.
Jeremy King: And I think as much as anything as well, the criminals have changed. And I often think, have the criminals changed because of the standard, or have the criminals changed just because they see the different technologies? And as we've improved, you know, when we first started this, it was, please don't store card data. And now a lot of the merchants, a lot of the people in the conference here, are doing great things with payment security. And suddenly you're seeing the criminals are like, okay, I can now actually monetize personal data. I can now do ransom attacks. I can now do deepfakes. I can do CEO fraud. And you look at it and you're like, is that because we've made it too hard here? They've gone there. And then certainly the regulators are coming in and going, actually, we need your organization, because you're not taking care of your data, we need you to have a data protection, a data security. And it's like we've gone beyond a sort of single payments standard, towards more, organizations have to be sort of aware across all of their systems and services about security. Because the criminals are looking for any way in. Operational resilience.
Jen Stone: Yes.
What is operational resilience, and why does it matter for ransomware?
Operational resilience is an organization's ability to recover from an attack like ransomware without paying the ransom. That means having clean, restorable systems that aren't infected.
Jeremy King: Because resilience to me is now the new buzzword, because organizations have got to make sure that if someone does a ransomware attack on them, if someone tries to shut them down, they can actually recover from that, right? If you don't want to pay the ransom, then you've got to be resilient enough to have systems that you can restore that are going to be safe and sound and not infected with this.
Jen Stone: Right.
Is PCI compliance enough to secure your business?
PCI is the bedrock, but not the whole picture. Jen Stone encourages organizations to treat PCI as a starting point and extend security to every system that could be attacked.
Jeremy King: And so the spectrum for organizations is broader. The bedrock is still PCI.
Jen Stone: Yes, absolutely. And that's a conversation I have over and over again with organizations, because sometimes they just want to think about PCI, which is great. I'm glad they're thinking about PCI. But also, I want all of the systems that you have to run your business, also need to not be ransomware, right? We need the broader security of the organization. And what is that balance between the scope for PCI and then the scope for the broader footprint of what could be attacked, and what kind of information could be stolen? And so it's a constant conversation between: don't just stop when you have your PCI taken care of. It's a great, great starting place. And then let's broaden it.
Is PCI compliance just a checkbox?
Jeremy King's most important message for merchants: focus on security, and PCI compliance will follow. Doing the bare minimum to get a certificate leaves you exposed.
Jeremy King: And I think for some merchants, they have this view of, just get me the certificate, just tick the box. And you're like, no, no, you've got this completely wrong. You know, your security, you should focus on security, and that will give you your PCI compliance. But don't just go do the minimum, because you are going to be in serious trouble. I think that is the most important message for a lot of our merchants today.
Jen Stone: Yes. Thank you so much for joining me and talking to me.
Jeremy King: It was an absolute delight.
Jen Stone: I hope that you enjoy your retirement, but your impact on the payment card industry has been just massive. And I just want to thank you for being part of that.
Jeremy King: Thank you very much. It's been a pleasure.