The PCI Security Standards Council held its fifth annual Latin America Forum online this week, drawing more than 1,100 payment security practitioners from across the region. Hosted with regional leadership and senior security figures from Getnet, Bank C6 and Banko Safra, the discussion circled a single theme: cloud is no longer the experimental choice in Brazilian payments. It is the default.
What five years of cloud progress looks like
The forum's framing of cloud was notably different from five years ago. The conversation then centered on whether regulated payment workloads could safely move. Now the question is how to operate them well.
The shift was partly pandemic-driven. As organizations adapted to remote transactions and e-commerce, cloud adoption accelerated sharply. But speakers argued the driver is now maturity, not necessity. Ricardo Nielsen Moreno, Information Security Supervisor at Banko Safra, put it plainly: cloud services have genuinely matured in the last five years, which explains the explosive growth in adoption, particularly in information security.
Vinicius Tels de Aruda, Director of Information Security at Getnet, noted that major cloud providers have invested heavily in compliance, standards and security frameworks. That work has lowered adoption friction for regulated industries, including payments.
The Council reinforced this shift with a recent joint publication with the Cloud Security Alliance focused on correct scoping of cloud environments under PCI DSS — which components fall inside scope, which do not, and how to maintain that boundary as architectures evolve.
Three gaps that remain inside the customer
Practitioners from all three banks identified the same three organizational challenges:
Cost modeling.** Organizations underestimate the cost of a 100% cloud environment when they model it like a hosting change. Cloud cost structures are consumption-based, which rewards architectural discipline and punishes over-provisioning.
Shared responsibility.** The division of security duties between provider and customer is well-documented but poorly internalized. Organizations frequently cannot articulate their obligations end-to-end, which creates gaps assessors find quickly.
Incident response readiness.** Cloud environments change continuously. Response teams that are credible in on-premises settings often lack the visibility and tooling to operate credibly in the cloud. Preparation needs to be specific to the environment.
Anilado Barros, Head of IT Services at Bank C6, added that assembling the right team is the first step. Understanding which cloud services map to which organizational needs, and knowing what authority your provider actually holds over your security posture, is basic due diligence that many organizations skip.
Our analysis
The real question has shifted from "can we move to the cloud" to "are we ready to operate in the cloud." Cloud lowers infrastructure friction but raises the bar on architecture discipline, identity management and incident response. Compared with the on-premises default of five years ago, the upside is agility and elastic capacity. The downside is that a misconfigured identity policy or an undocumented data flow is now a compliance gap rather than a configuration mistake.
Who benefits: organizations with mature cloud architecture and incident response practices. Who loses: organizations that treat cloud as a hosting change rather than an operational model change.
Who should care about this
| Role | Why it matters |
|---|---|
| Acquirers and processors | Cloud underpins new payment methods; scope errors drive audit findings |
| Issuers | Cloud migration affects cardholder data environments directly |
| Merchants with significant online volume | E-commerce growth has made cloud the default, not the exception |
| Security teams | The operational burden has shifted; tooling alone is not the answer |
| Compliance leads | Joint PCI Council and CSA guidance will shape upcoming assessment expectations |
What to watch next
Watch for the Council's next wave of regional guidance on cloud-specific scoping under PCI DSS, and watch how Brazilian acquirers translate the joint CSA bulletin into assessor expectations. The technical capability to run payment workloads in the cloud is no longer in question. The open question is whether organizations have built the internal discipline to do it without expanding their PCI scope unnecessarily.
Key takeaways
- Cloud adoption across Latin American payments has reached the mainstream; the conversation is now about maturity.
- Joint guidance from the PCI Council and the Cloud Security Alliance on cloud scoping is the most relevant near-term reference.
- The biggest remaining gaps are cost modeling, shared responsibility clarity and incident response readiness.
- Cloud lowers infrastructure friction but raises the cost of identity and configuration mistakes.
Frequently asked questions
What is the PCI Latin America Forum?
An annual regional event hosted by the PCI Security Standards Council that brings together payment security practitioners. This year's edition drew more than 1,100 attendees online.
Why is cloud scoping so important for PCI DSS compliance?
PCI DSS scope defines which systems, networks and identities the assessor will evaluate. In cloud environments, scope can expand quickly without disciplined architecture, which raises compliance cost and audit risk. The joint Council and CSA guidance specifically addresses how to draw and maintain that boundary.
Did the Council release new cloud guidance at the forum?
The Council highlighted a recent joint bulletin with the Cloud Security Alliance focused on correct scoping of cloud environments under PCI DSS. More guidance is expected as the Council works to increase Brazilian stakeholder participation in standards development.
Who needs to care about this in the region?
Acquirers, issuers, payment processors and any merchant or service provider migrating or running cardholder data environments in the cloud across Latin America.