Ontario gas station owner & buyer guide
PCI Compliance for Ontario Gas Stations: 2027 Deadline & Dispenser Upgrades
PCI compliance for Ontario gas stations raises an expensive question: do you need new fuel dispensers, or can you upgrade the payment equipment and keep the dispensers you already own?
You may be able to retain your existing dispensers. A compatible, processor-accepted payment retrofit can be an alternative to full replacement. The April 30, 2027 Interac retirement deadline concerns specified older payment devices; it is not a blanket order to replace every gas dispenser in Ontario.
Start with the payment module’s exact model and approval version, then obtain written confirmation from your processor. See the Moneris Interac retirement notice and Gilbarco’s Canadian retrofit information .
What does PCI compliance mean for a gas station?
The Payment Card Industry Data Security Standard (PCI DSS) protects payment account data. Relevant systems can include indoor terminals, pay-at-the-pump equipment, point-of-sale software and connected networks. Independent and branded stations accepting payment cards need to understand their applicable obligations.
PCI DSS, payment-device approval and retirement deadlines are different:
- PCI DSS: security requirements for the payment-data environment and its operation.
- PCI PTS: security requirements used to evaluate payment hardware, including PIN-entry devices.
- Network retirement rules: requirements governing when particular devices must stop being used on a payment network.
An approved terminal alone does not establish compliance for the entire station. Your processor determines the validation documents required for your payment setup.
What is the 2027 gas station payment deadline?
Moneris publishes the following Interac device-retirement schedule. Identify the device category precisely; a dispenser’s installation year is not its payment-device approval version.
| Payment-device standard | Retirement date |
|---|---|
| PCI PED/EPP 1.x | November 30, 2024 |
| PCI UPT 1.x | April 30, 2027 |
| PCI PED/EPP 2.x | April 30, 2027 |
| PCI PTS POI 3.x | April 30, 2030 |
| PCI PTS POI 4.x | April 30, 2034 |
| PCI PTS POI 5.x | April 30, 2037 |
| PCI PTS POI 6.x | April 30, 2042 |
Source: Moneris compliance notices . Continued use of expired devices is conditional, including purchase and inventory before device expiry. These dates do not guarantee manufacturer support or acceptance under other networks’ rules.
Why April 2027 can cause confusion
PCI SSC also extended existing PTS POI version 5 approval expiry to April 30, 2027. That is different from the older devices’ Interac retirement deadline. Do not interpret every reference to “April 2027” as a requirement to remove the same equipment. Read the PCI SSC version 5 extension bulletin .
PCI DSS deadlines are separate
PCI DSS 3.2.1 retired March 31, 2024; version 4.0 retired December 31, 2024. The future-dated version 4.x requirements became effective March 31, 2025. These concern security compliance, not automatic replacement of complete dispensers. See PCI SSC’s retirement guidance and version 4.0.1 announcement .
What equipment may need upgrading?
Use this as a discussion checklist with your contractor, not a mandatory shopping list. The accepted upgrade package determines which components change.
| Component | What to verify |
|---|---|
| Outdoor payment terminal / secure module | Exact model, approval number, firmware and applicable retirement rule. |
| PIN pad and card reader | Whether individual components or the complete payment assembly must be replaced. |
| Tap reader and display | Whether retained parts work with the accepted retrofit. Do not assume automatic replacement. |
| POS and forecourt controller | Compatibility, required software licences, configuration and supported connections. |
| Indoor payment terminals | Their own device versions and processor requirements, separately from outdoor terminals. |
| Complete dispenser | Whether an accepted retrofit exists and whether condition, parts availability and cost justify retention. |
Can the dispenser stay while payment equipment changes?
Yes, where a compatible solution is available. Gilbarco describes payment retrofit options for existing dispensers on its Canadian website. That demonstrates an upgrade path; it is not a recommendation to buy a particular product without checking current certification, processor acceptance and support life.
Hypothetical example: a station has serviceable dispensers but affected outdoor payment modules. If its contractor and processor confirm an accepted retrofit, the owner can compare that package with new dispensers instead of assuming full replacement is unavoidable.
The payment-device mandate does not itself require replacement of tanks, fuel piping, hoses or nozzles. Fuel-system safety and condition remain separate considerations. Read our TSSA gas station requirements guide for that part of ownership.
What should Ontario gas station owners do now?
- Inventory every payment device. Record dispenser and terminal models, hardware revisions, approval numbers and firmware. Ask your technician to identify inaccessible labels safely.
- Identify the merchant-account holder. Establish who receives processor notices and who coordinates compliance for your branded or independent operation.
- Get the requirement in writing. Ask your processor which devices are affected, the applicable deadline and the accepted replacement configuration.
- Obtain comparable quotations. Request retrofit and full-replacement options where both are available.
- Check cost responsibility. Review equipment ownership, leases, service arrangements and fuel-supply provisions. Do not assume the fuel brand pays.
- Plan commissioning. Agree on installation downtime, processor testing, documentation, warranty and ongoing support before approving the work.
What should an upgrade quotation include?
Ask for equipment and payment-side quantities, installation labour, software, controller changes, communications work, commissioning, disposal, taxes, warranty and exclusions. Request the exact replacement approval details and expected support life.
There is no reliable single upgrade price for every Ontario station. A hardware-only price is not the total installed cost. Comparing equivalent scopes is more useful than relying on an unsupported “cost per pump.”
PCI equipment due diligence when buying or selling a gas station
Payment upgrades belong in the acquisition budget alongside other infrastructure costs. A dispenser that operates normally may still need a payment-system upgrade.
Buyers should request the equipment inventory, processor notices, available compliance records and written quotations before finalizing their capital plan. Clarify who owns each component and whether any upgrade obligation remains outstanding at closing.
Sellers can reduce uncertainty by organizing these records early. If work is completed, keep invoices, installation records and processor acceptance documentation together.
For broader acquisition considerations, see our Ontario gas station buyer guide and gas station buying FAQs .
Ontario gas station PCI compliance FAQs
Who enforces PCI compliance?
Payment brands and acquiring banks manage compliance programs. Your processor is normally the practical first contact. PCI SSC develops standards but does not enforce merchant compliance. See PCI SSC’s explanation of enforcement .
Is PCI compliance the same as a TSSA inspection?
No. Payment compliance concerns card-data security and payment-network requirements. TSSA regulates fuels safety in Ontario . A fuel-safety inspection does not establish payment-system compliance.
Can someone inspect PCI compliance at my station?
Authorized inspections or assessments can occur. Moneris’s merchant agreement provides for equipment inspections and access during suspected security-incident investigations. Verify unexpected visitors directly with your processor before allowing access.
Does every station need an annual on-site PCI audit?
Not necessarily. Your acquirer determines the required validation method. This may involve a self-assessment questionnaire, a formal assessment and, where applicable, vulnerability scans. Consult PCI SSC’s merchant validation guidance .
Can I stop pay-at-the-pump and take payment inside?
Ask your processor and fuel supplier to assess this option. Confirm proper decommissioning of outdoor payment equipment and any contractual restrictions. Indoor payment systems still have applicable security obligations. Consider staffing, customer queues and unattended sales before changing operations.
Is chip-and-PIN or tap capability proof of compliance?
No. A terminal’s payment features do not establish the compliance of the whole payment environment. Check its exact approval and network acceptance, together with the station’s applicable PCI DSS requirements.
Can I buy a used payment terminal to reduce the cost?
Do not purchase solely because a used terminal looks compatible. Obtain processor acceptance for its exact hardware and firmware, and confirm permitted deployment, secure provisioning, support and warranty before committing.
Will new payment hardware make the whole station compliant?
No. Security controls and operating practices still matter. Ask your processor what evidence must be submitted after installation; retain that documentation with your equipment records.