Savannah Keys, Director of Strategic Partnerships at Aperia Compliance, appeared on The Payments Shed Podcast to share her experience of merchant compliance and discuss some of the practical challenges businesses face when managing PCI requirements.
Savannah joined host Justin Hanna for an episode recorded during the earlier stages of The Payments Shed. Since then, the podcast has grown significantly, reaching more than 270,000 YouTube subscribers and building an audience across the payments and fintech industry.
The conversation provided an opportunity to highlight Aperia Compliance’s work with acquirers, ISOs, banks and other organisations managing merchant portfolios. Through its white-labelled PCI compliance platform, Aperia helps businesses give their merchants a more accessible way to complete PCI self-assessment questionnaires and manage their compliance responsibilities.
Drawing on her experience in payments technology, enterprise sales and merchant compliance, Savannah discussed one of the challenges that sits at the centre of PCI compliance: many smaller merchants simply do not have dedicated teams or resources to manage it.
For an independent retailer, restaurant or other small business, understanding PCI terminology and completing an assessment can be difficult alongside the day-to-day demands of running the business. Savannah explained why providing the technology alone may not be enough, and why clear communication and merchant education remain an important part of improving compliance rates.
The discussion also looked at the relationship between PCI compliance and wider merchant security. Savannah highlighted an important distinction: completing a PCI assessment does not mean a business is protected from every potential data breach.
This is an area where Aperia is looking at how compliance can sit alongside a broader understanding of merchant risk. Rather than treating every business in the same way, Savannah discussed the potential for a more individual approach, where merchants can better understand their risk profile and the additional measures that may be relevant to their circumstances.
These could include areas such as payment page monitoring, endpoint protection, data breach insurance and other services designed to complement the merchant’s core compliance requirements.
The episode also touched on the role acquirers and ISOs can play in making compliance easier to understand. While non-compliance fees remain part of the commercial model for parts of the industry, Savannah spoke about organisations that are taking a more active approach to helping merchants complete the process and understand why it matters.
Her contribution reflected Aperia Compliance’s focus on making merchant compliance more accessible while recognising that payment security continues to evolve. As technology, fraud and regulation change, businesses need to continue reviewing the controls and support they provide rather than seeing compliance as a one-off exercise.
The conversation offers a practical perspective on the challenges faced by smaller merchants and the role payment providers can play in helping them manage PCI compliance and wider risk more effectively.
Watch Savannah Keys’ full conversation on The Payments Shed Podcast.