September 2026 Summaries

PCI DSS scope creep is presented as a normal consequence of business growth rather than an inherent failure, becoming costly primarily when new in-scope systems or gaps are discovered unexpectedly during an audit. Scope can expand through access-management tools that affect the cardholder data environment, regional infrastructure growth, shifts from managed to self-operated services, and misunderstandings about vendor responsibilities. The text distinguishes planned compliance expansion, which incorporates security reviews, control mapping, and evidence collection into development, from audit friction caused by unanticipated systems, obsolete integrations, or unmanaged exceptions. It recommends assessing compliance implications before product and infrastructure decisions, enforcing important controls rather than relying on conventions, decommissioning retired services, and using compensating controls where architectures meet PCI security objectives differently. Although tokenization providers and other vendors can reduce obligations, organizations generally retain responsibility for elements such as hosted checkout pages, with compliance supported through a chain of attestations and clearly defined shared-responsibility boundaries.

Basis Theory’s August updates expand Agentic Payments through a Shared Payment Model that lets AI agents make bounded, auditable purchases across Visa, Mastercard, and Stripe using cardholder-approved allowances and single-use credentials. The platform’s former Agentic Commerce API is deprecated in favor of this unified approach, which supports network-specific verification requirements and Stripe Shared Payment Tokens. Beginning October 5, 2026, users will no longer be able to create new Reactors or Proxy transforms on the node-bt runtime, though existing resources will continue operating temporarily; Basis Theory recommends migrating to Node.js 22 or 24 runtime images for improved isolation, package support, configuration options, logging, and security scanning. The company has also introduced source validation for plaintext secrets in Reactor and Proxy code and plans to reject deployments containing hardcoded credentials, encouraging users to store sensitive values in encrypted configuration instead. Additional fixes preserve valueless Proxy query parameters, provide controlled errors when suspending network tokens during deletion, allow white-label Elements on root domains and subdomains, and prevent webhooks from targeting non-public network addresses.

Merchants face significant cost, security, and reputational risks when handling personally identifiable payment data under PCI-DSS, which applies to every system and environment that can access unencrypted customer information. A PCI-compliant payment vault can reduce this scope by collecting and storing sensitive card data separately and providing the merchant’s core payment system with non-reversible tokens for processing. Buying a vault service can offer faster deployment, predictable costs, vendor-managed security and maintenance, while building one may provide greater control and potential long-term savings for organizations with sufficient technical expertise, infrastructure flexibility, and capacity to manage ongoing compliance. The decision depends largely on time to market, internal skills, fixed versus variable cost preferences, system-segregation capabilities, and willingness to retain operational and breach-related risks.

Basis Theory has introduced a Merchant concept and automated onboarding capabilities for account updater and network token services, allowing platforms that manage many merchants to create and configure separate enrichment settings within a single Tenant. Merchants can be created through the API or customer portal, with service- and network-specific configurations for providers such as Visa, Mastercard, Amex, and Discover kept independent from other merchants’ setups. Onboarding status is tracked for each service and network through states including pending, onboarding, active, and failed, with updates available via webhooks, the portal, and API. Once activated, a merchant ID can be used in enrichment API calls, reducing reliance on forms, email exchanges, and manual support. Basis Theory also plans direct integration with Pagos and just-in-time account updater card updates as further steps toward fully automated enrichment onboarding.

Agent-initiated payments are emerging across consumer commerce, API usage, invoice settlement, and data purchases, but fragmented card, wallet, processor, and crypto protocols create operational and risk-management challenges for merchants. Merchants considering acceptance should identify which payment rails and credentials they can process, verify how consumer authorization mandates are established and recorded, assess regulatory and regional compliance requirements, and understand differing dispute and settlement rules, particularly between card payments and final stablecoin transfers. Most agent-payment models rely on a consumer-approved mandate that sets spending, merchant, currency, and time limits, with credentials issued against that authorization and linked to evidence of the consumer’s approval. Merchants are advised to retain mandate and transaction references, establish acceptance policies before transactions arrive, test dispute-response processes, and avoid becoming dependent on a single processor or protocol. The text argues that portable credential vaults and payment-orchestration systems can help merchants manage protocol fragmentation while preserving flexibility as agentic-payment standards continue to develop.

3D Secure (3DS) is used in only about 3% of U.S. e-commerce transactions as of 2025, largely because there is no regulatory mandate comparable to Europe’s PSD2 requirements and merchants fear additional authentication steps may reduce checkout completion. The protocol enables card issuers to verify online cardholders through frictionless or step-up authentication and can shift chargeback liability from merchants or platforms to issuers after successful authentication. Although U.S. businesses commonly rely on basic fraud and address-verification checks, 3DS can offer value when deployed selectively rather than universally, particularly for transactions with ambiguous fraud scores, soft declines requiring further authentication, and high-risk sectors such as airlines. Modular, processor-agnostic 3DS implementations can separate authentication from authorization, allowing platforms to authenticate selected payments before authorization or retry soft-declined transactions after issuer verification, potentially improving approval rates while managing fraud exposure.

A Merchant of Record is the legally recognized seller that processes consumer payments and appears on card statements, while merchants may either retain this role using payment service providers or outsource it to non-MOR platforms at the cost of checkout control and customer-data ownership. The growth of agentic commerce, in which AI agents help discover or complete purchases, complicates this choice because consumer-led transactions still depend on human checkout flows, whereas agent-led purchases require efficient, secure APIs or MCP endpoints that software agents can use directly. For merchants seeking to remain the Merchant of Record, programmable payment vaults can tokenize and isolate sensitive card data, allowing agents to reuse stored credentials or send new payment information directly to a secure vault rather than through merchant systems. This approach can reduce PCI-DSS exposure and data-leak risks while preserving customer relationships, payment-provider flexibility, and control over revenue and transaction data.