Incorporated in Trenton, New Jersey35 services · 3 practices · 8 industries
Speak With an Expert
FinTech & Payments · Confidential client

PCI DSS Service Provider Assessment for a Property-Management Payment Facilitator

A first Level 1 service provider Report on Compliance, with every future-dated 4.0.1 requirement in place on the day enforcement began.

Discuss a similar engagementAll projects
Client name withheld by agreement
Client
Payment facilitator for property-management software, 11,000 sub-merchants
Region
Philadelphia, Pennsylvania
Year
2025
Duration
14 weeks
Scope
3 payment channels · 186 in-scope systems · 11,000 sub-merchants
Practice
Financial Services

The challenge

What was at stake.

A payment facilitator embedded in property-management software collects rent, deposits and fees by card and ACH for 11,000 landlords and management companies. Card volume had crossed the Level 1 service provider threshold, which meant its first Report on Compliance from a QSA instead of a self-assessment.

The future-dated requirements in PCI DSS 4.0.1 were weeks from becoming mandatory. Its hosted payment page loaded 41 third-party scripts, sub-merchant onboarding ran on shared admin accounts, and no one could say which of its 186 systems actually touched card data.

What we did

The approach, step by step.

  1. 01

    Data flows confirmed with engineering

    We walked every rent payment path, from the tenant portal and recurring autopay to the call center, and confirmed with log and traffic samples where card data was stored, processed or only passed through.

  2. 02

    Payment-page scripts brought under control

    The 41 scripts on the payment page were cut to 9 authorized ones, each with a written justification, integrity checks and tamper alerting to meet requirements 6.4.3 and 11.6.1.

  3. 03

    Sub-merchant access rebuilt

    Shared onboarding accounts were replaced with named, MFA-protected roles, and any change to a sub-merchant’s payout account now needs a second approver.

  4. 04

    Service provider obligations written down

    A responsibility matrix for sub-merchants and the software platform partner sets out which requirements the facilitator covers, which it shares and which each landlord owns.

  5. 05

    Evidence packaged for the QSA

    Targeted risk analyses, segmentation tests and quarterly scans were assembled by requirement, so testing started on the first morning of fieldwork.

Outcomes

What changed, in numbers.

41 to 9
scripts on the hosted payment page
0
requirements marked Not in Place
11,000
sub-merchants covered by a responsibility matrix
1st
ROC submitted to the acquirer without rework
By the time the QSA arrived, our first ROC felt like a formality, which is exactly how it should feel.
Chief Technology Officer, client name withheld

Services delivered

Related engagements

More work in Financial Services.

All projects
Facing something similar?

Let’s talk about your version of this.

Share what you are up against. A senior practitioner who has delivered this kind of work will reply within one business day.

Speak With an ExpertRequest an Assessment