The verdict in three sentences
In 2026, storing raw cards is both illegal and pointless: tokenization replaces the number with a token that is useless to a fraudster. It enables one-click reorders while shifting the PCI scope to the payment gateway. The right decision: gateway-hosted fields (SAQ A) rather than self-hosted (SAQ D), unless you have a very specific need.
PCI DSS 4.0: what changes the scope
PCI DSS 4.0 has been mandatory since 2025. Your architecture choice determines your self-assessment questionnaire (SAQ) and therefore your compliance cost.
| Item | Hosted fields (SAQ A) | Self-hosted (SAQ D) |
|---|---|---|
| Controls to document | ~22 | 300+ |
| Card touches your server | No | Yes |
| Annual audit burden | Low | Heavy |
| Audit cost (order of magnitude) | Reduced | Tens of thousands of rand extra |
| Liability on a breach | Gateway | You |
| Suitable for SMEs | Yes | Rarely |
The takeaway: for the vast majority of e-commerce sellers, hosted fields drastically cut scope and cost.
Tokenization and 3DS2: conversion vs fraud
Tokenization improves conversion for returning customers; 3DS2 authentication reduces fraud but adds a step.
| Mechanism | Conversion effect | Fraud effect | Key point |
|---|---|---|---|
| Tokenized checkout (returning) | +~15% repeat conversion | Neutral | One-click reorder |
| 3DS2 (strong auth) | -2 to -4% (step-up) | Large fraud drop | Shifts fraud liability to issuer |
| No tokenization or 3DS2 | Baseline | High | Avoid |
| Tokenization + targeted 3DS2 | +10 to +12% net | Low | Best compromise |
Applying 3DS2 selectively (on risky transactions) rather than universally limits step-up abandonment while keeping protection.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Mini case study
Awa runs a fashion shop in Johannesburg with 40% returning customers. On 500 card orders a month at an average basket of R3,500, enabling tokenization lifts returning-customer conversion by around 15%: ~30 extra orders, i.e. R105,000 of additional monthly sales. By moving to hosted fields (SAQ A), she exits the SAQ D scope and removes tens of thousands of rand of annual audit cost.
FAQ
Does tokenization exempt me from PCI compliance? No, but it sharply reduces scope: with hosted fields you fall under SAQ A (~22 controls) instead of SAQ D (300+).
Does 3DS2 scare customers away? A little: step-up adds 2 to 4% abandonment. Applied selectively to risky transactions, the impact is minimal and fraud drops significantly.
Can I offer one-click payment legally? Yes, via a token stored by the gateway: you never keep the real number, only a reference useless elsewhere.
Who is liable in a data breach? With hosted fields, the card never passes through your server: liability and technical burden rest with the certified gateway.
How much does non-compliance cost? Beyond contractual fines, a breach triggers investigation costs, loss of card-acceptance capability and lasting reputational damage.
Let's talk about your project. We set up a tokenized checkout with hosted fields (SAQ A) and targeted 3DS2. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
