Nexi is Italy's leading merchant acquirer, offering PCI-DSS-tiered integration paths (hosted page, SAQ-A iFrame, SAQ-D server-to-server) via its XPay gateway; the wider acquiring market blends Nexi/SIA-legacy processing with major bank acquirers (Intesa Sanpaolo, UniCredit, Banco BPM) and international players (Adyen, Stripe) operating via EU passporting. High-risk verticals such as gaming and crypto face materially stricter PSP onboarding and compliance scrutiny.
Standing sub-brief · as of 5 July 202692 words · last cycle 2026-07-04
Merchant Acquiring & Risk
On Nexi's XPay e-commerce gateway, PCI DSS compliance burden scales by integration model: a hosted payment page requires no merchant certification, an SAQ-A-compliant iFrame integration carries a lighter self-assessment burden, and a full server-to-server integration requires SAQ-D certification. The choice of integration model directly determines PCI DSS compliance cost and audit burden for Italian e-commerce merchants on the country's leading payment gateway.
Outlook
This is a dated, vendor-documentation-sourced finding rather than a live rule change; no regulatory shift to Italy's merchant-acquiring PCI DSS framework was identified this cycle.