The verdict in three sentences
Securing collections in Dublin without storing card data, by delegating to a PCI-DSS-compliant PSP (Stripe, Adyen), cuts your scope to the SAQ A questionnaire and avoids a heavy audit priced at EUR 5,000 to 30,000 in 2026. Tokenization and 3-D Secure v2 curb fraud and shift liability in disputes. Plan for chargeback handling (EUR 15-25 each) and monitoring: compliance protects reputation and avoids costly penalties.
PCI-DSS: shrink your scope rather than face an audit
Your compliance level depends on how you handle card data. The golden rule: never touch it. By redirecting to the PSP or using its hosted fields, you fall into the lightest SAQ.
| Technical scenario | PCI level | Compliance cost 2026 | Effort |
|---|---|---|---|
| PSP hosted fields (Stripe Elements) | SAQ A | EUR 0 - 2,000 | Minimal |
| PSP page redirect | SAQ A | EUR 0 - 2,000 | Minimal |
| Embedded non-tokenized form | SAQ A-EP | EUR 5,000 - 12,000 | Medium |
| Storing card data (avoid) | SAQ D | EUR 15,000 - 30,000 | Heavy, audit |
| QSA audit (high volume) | Level 1 | EUR 20,000 - 50,000 | Very heavy |
Key message: staying in SAQ A by delegating everything to the PSP avoids almost all compliance cost and risk. Storing a card datapoint blows up your scope.
Fraud, 3-D Secure and disputes
| Measure | Effect 2026 | Cost |
|---|---|---|
| 3-D Secure v2 | Shifts liability to issuer | PSP included |
| Tokenization | Zero card data stored | PSP included |
| Anti-fraud rules (scoring) | -30 to -60% fraud | 0.1-0.3% or included |
| Chargeback handling | Dispute contest | EUR 15-25 / case |
| Real-time monitoring | Anomaly alerts | EUR 100-500/month |
3-D Secure v2 is central: once the customer is authenticated, liability for a fraudulent unpaid transaction moves to the issuing bank, not you.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Mini case study
Sophie, IT director of a services SME in Dublin (online collection, 2,500 transactions/month), considered an in-house payment form storing cards, which would have pushed her into SAQ D with an audit estimated at EUR 22,000 plus EUR 8,000/year in compliance upkeep. She chooses Stripe hosted fields: scope cut to SAQ A, near-zero compliance cost, tokenization and 3-D Secure v2 included. She thus saves EUR 22,000 in audit and ~EUR 8,000/year. On fraud, scoring rules bring chargebacks from 1.2% to 0.4%, i.e. on 2,500 transactions at EUR 90, about EUR 1,800/month in avoided disputes.
FAQ
Do I need to be PCI-DSS certified myself? No, if you delegate everything to the PSP via hosted fields or redirect: you stay on the SAQ A questionnaire, the lightest, with no external audit.
What does tokenization bring? It replaces the card number with a token useless elsewhere. You never store the real card, eliminating the risk of a sensitive-data breach.
Does 3-D Secure really protect against unpaid transactions? Yes for fraud: once the customer is authenticated with 3-D Secure v2, liability for a disputed fraudulent transaction moves to the issuing bank.
What does a chargeback cost? Between EUR 15 and 25 in fees per case, not counting the disputed amount. Preventing fraud upstream (scoring, 3-D Secure) is far cheaper than absorbing disputes.
What is the risk of non-compliance? Card-network fines, merchant-account suspension, and above all lost trust after a breach. Compliance protects business continuity and reputation.
Let's scope your project. Describe your current collection flow and monthly volume, and we'll price a secure SAQ A architecture (tokenization, 3-D Secure v2, monitoring) with no heavy audit. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
