What is PCI-DSS and why does it matter for my gateway selection?

PCI-DSS (Payment Card Industry Data Security Standard) is the security standard that governs how card data is handled. A gateway that is PCI-DSS compliant has had its systems audited against this standard. This matters because: if you use a non-compliant gateway and a breach occurs, you may be liable even if the breach happened on the gateway's side. Paystack is PCI-DSS Level 1 compliant — the highest level. Always ask for the Attestation of Compliance (AOC) document.

What happens to my data if the payment gateway shuts down?

This is a key due diligence question. Ask explicitly: "If we close our account or you cease operations, in what format and for how long can we export our transaction data?" Transaction history (for accounting, compliance, tax purposes) must be preserved for 5-7 years depending on jurisdiction. A gateway that cannot guarantee data export is a risk. Paystack allows transaction data export via CSV from the dashboard and via API.

How common are gateway account freezes, and what causes them?

Account holds and freezes do happen — typically triggered by unusual transaction patterns, chargeback rates exceeding thresholds, compliance flags, or regulatory action against the gateway itself. Ask the gateway: "What triggers an account hold? What is the notification process? What is the resolution timeline?" Paystack generally sends email notifications and has a support process for holds, but resolution speed varies. Having an emergency backup gateway is prudent for businesses where payment downtime has severe revenue impact.

By Bonaventure Ogeto|Updated July 22, 2026

Payment Gateway Due Diligence Checklist for CTOs

CTO payment gateway due diligence covers: 1) Regulatory — is the gateway licensed by CBN/CBK/BoG/RBZ in each country? 2) Security — PCI-DSS compliance level, fraud tools, chargeback dispute support. 3) API quality — working sandbox, error code documentation, webhook reliability, test card suite. 4) Settlement — timing, net vs gross, what's deducted, FX policy for multi-currency. 5) Pricing — all fees disclosed upfront: transaction %, flat fee, refund fee, chargeback fee, monthly minimum. 6) Data — where is transaction data stored, can you export it, what happens if you leave. 7) Support — response time commitment, dedicated account manager at what volume threshold.

Due Diligence Checklist

Category	Check	What to Verify
Regulatory	CBN licence (Nigeria)	Verify at CBN website or official gazette — not just gateway's claim
Regulatory	CBK PSP licence (Kenya)	Check CBK's Payment Service Provider list
Regulatory	BoG EMI/PSP licence (Ghana)	Check Bank of Ghana payment systems registry
Security	PCI-DSS compliance	Ask for Attestation of Compliance (AOC) document
Security	HMAC webhook signature	Does the gateway sign webhooks? What algorithm?
Security	Fraud screening	Is there built-in fraud scoring? What are the thresholds?
API	Sandbox environment	Test yourself — does it work for your use case?
API	Error documentation	Is every error code documented with expected response?
API	Webhook reliability	Check developer community (Twitter/X, forums) for reports
Settlement	Settlement timing	T+1? T+3? When does money arrive in your account?
Settlement	Net vs gross	Is fee deducted from each transaction or from settlement batch?
Pricing	Full fee schedule	Transaction %, flat fee, refund fee, chargeback fee, FX markup, monthly minimum
Data	Data export	Can you export all transaction data in CSV/JSON? What happens at account closure?
Data	Data residency	Where are customer and transaction records stored? Relevant for NDPA/DPA compliance.
Support	Response time	What is the SLA for technical support tickets? For account holds/freezes?
Support	Dispute resolution	How are chargebacks handled? What evidence is required?

Learn More

See payment gateway SLAs and what they actually cover for interpreting the uptime commitments you will find in contracts.

Sign up for the McTaba newsletter

Key Takeaways

✓Verify regulatory licence in each country before going live — an unlicensed gateway can be shut down without warning.
✓PCI-DSS compliance is not optional — confirm the gateway's SAQ level and what it covers.
✓Request the full pricing schedule including refund fees, chargeback fees, and FX markup — not just the headline rate.
✓Test the sandbox environment yourself before selecting — broken sandboxes indicate poor engineering culture.
✓Ask what happens to your data if you close the account — exportability matters for migration and compliance.

Frequently Asked Questions

What is PCI-DSS and why does it matter for my gateway selection?: PCI-DSS (Payment Card Industry Data Security Standard) is the security standard that governs how card data is handled. A gateway that is PCI-DSS compliant has had its systems audited against this standard. This matters because: if you use a non-compliant gateway and a breach occurs, you may be liable even if the breach happened on the gateway's side. Paystack is PCI-DSS Level 1 compliant — the highest level. Always ask for the Attestation of Compliance (AOC) document.
What happens to my data if the payment gateway shuts down?: This is a key due diligence question. Ask explicitly: "If we close our account or you cease operations, in what format and for how long can we export our transaction data?" Transaction history (for accounting, compliance, tax purposes) must be preserved for 5-7 years depending on jurisdiction. A gateway that cannot guarantee data export is a risk. Paystack allows transaction data export via CSV from the dashboard and via API.
How common are gateway account freezes, and what causes them?: Account holds and freezes do happen — typically triggered by unusual transaction patterns, chargeback rates exceeding thresholds, compliance flags, or regulatory action against the gateway itself. Ask the gateway: "What triggers an account hold? What is the notification process? What is the resolution timeline?" Paystack generally sends email notifications and has a support process for holds, but resolution speed varies. Having an emergency backup gateway is prudent for businesses where payment downtime has severe revenue impact.

Ready to build real-world apps?

Join the McTaba Labs full-stack marathon (4 months full-time · 6 months part-time). Learn M-Pesa, USSD, and WhatsApp engineering while shipping 8 production apps.

Apply to the McTaba Marathon