The verdict in three sentences
An African merchant collecting cards via a hosted checkout (Paystack, Flutterwave, Stripe) falls under the PCI SAQ-A questionnaire, the simplest one, because they never touch card data. 3-D Secure 2 (3DS2) is mandatory and shifts fraud liability to the issuing bank. Configured well, 3DS2 cuts fraud without collapsing the success rate — configured badly, it scares customers away.
Who carries which card-compliance requirement
Fear of PCI DSS comes from a confusion: the effort level depends entirely on how you collect the card. With a field hosted by the provider, you offload most of it.
| Requirement | Who carries it | Merchant effort |
|---|---|---|
| Card data storage | The provider (PSP), never you | None with hosted checkout |
| PCI SAQ-A questionnaire | The merchant (hosted fields) | Light, annual self-assessment |
| Site TLS encryption | The merchant | Standard SSL certificate |
| 3-D Secure 2 | PSP + issuing bank | Enable on the PSP side |
| Card tokenization | The provider | None, handled by PSP |
| Fraud monitoring | Merchant + PSP | Anti-fraud rules to tune |
The key message: never host card entry yourself. A card form on your own server would push you to heavy PCI questionnaires (SAQ-D) and maximum liability.
The effect of 3DS on success rate
3DS2 adds an authentication step (OTP, biometrics) that protects but can cause abandonment. The point is to apply it intelligently, not always at maximum friction.
| 3DS setting | Effect on fraud | Effect on success rate |
|---|---|---|
| 3DS disabled | High fraud, merchant liable | High success but risky |
| Hard mandatory 3DS | Very low fraud | Lower success (friction) |
| 3DS2 with exemptions | Low fraud | Success preserved (frictionless) |
| Rules by amount | Optimized | Friction only on large baskets |
The cost of non-compliance isn't only a fine: it's mostly full liability for fraudulent chargebacks, plus chargeback fees often in the thousands of FCFA per dispute, and the risk of suspension by the provider.
Mini case study
Aminata sells fashion online in Dakar and internationally, with a 60,000 FCFA average basket and 500 card payments a month. Under hard mandatory 3DS her card success rate was 78%, i.e. 110 lost transactions a month (6,600,000 FCFA of volume). By switching to 3DS2 with frictionless exemptions below 30,000 FCFA and stronger authentication above, the rate climbed back to 90%, recovering about 72 monthly transactions while keeping fraud under 0.4%.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
FAQ
Do I really have to comply with PCI DSS if I use Paystack or Stripe?
Yes, but at the lightest level: SAQ-A, an annual self-assessment questionnaire. Since the provider hosts the card field and stores the data, you never touch card numbers and most of the burden falls on them.
Is 3-D Secure mandatory in Africa in 2026?
Yes, 3DS2 is the standard required by the Visa/Mastercard schemes and banks. It shifts fraud liability to the issuing bank when correctly applied.
Does 3DS scare customers away?
Badly tuned, yes: heavy authentication on every payment raises abandonment. Well tuned, with frictionless exemptions on small amounts, it preserves the success rate while blocking fraud.
What is a chargeback and how much does it cost?
It's a card payment dispute by the cardholder, which refunds the customer at the expense of an unprotected merchant. Beyond the lost amount, each dispute triggers processing fees, often several thousand FCFA (2026 order of magnitude).
Can I collect the card directly on my site?
Not advisable: it would push you to the heavy PCI SAQ-D and maximum data liability. Always use your provider's hosted fields.
Let's talk about your project. We set up a PCI-compliant card checkout and a 3DS2 tuned to maximize your success rate. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
