Assessment
PCI-PAL keeps raw card data out of the contact centre so agents and bots can take payments without card numbers touching the organisation's systems. Key to Pay, Click to Pay, and Speak to Pay let a customer on a call or chat pay by typing card numbers on the phone keypad (DTMF tones), through a secure link, or by speaking card details; the company also lists digital wallets, some buy-now-pay-later (BNPL) options, and open-banking payments alongside cards. The same secure capture works for live agents and for AI voice and chat bots, which shrinks how much of the contact centre falls under PCI DSS while keeping current contact-centre software and the organisation's own card processor.
For the year ended 30 June 2025, audited group results showed revenue of £22.48 million, up 25%, with annual recurring revenue (ARR) of £19.26 million and Contracted ARR of £22.20 million. Adjusted EBITDA was £2.32 million. In a 28 July 2026 trading update the company guided FY26 revenue to about £24.6 million and ARR to £24.4 million. In September 2026 it delayed its audited FY26 results while the year-end audit continued. Until those accounts are filed, the £22.48 million FY25 figure is the latest audited revenue, and the July numbers are unaudited guidance.
PCI-PAL fits a retailer, insurer, healthcare payer, utility, or other regulated service organisation that takes card payments on the phone or in digital messaging, and it fits a contact-centre software or AI-agent vendor that wants a payment partner to build in. It is a weaker fit for a merchant that only needs to store cards for online checkout and has no contact centre, or for a buyer that wants card acquiring, the bank side of accepting cards, from the same vendor.
Rating by criterion
Each of the eight criteria below is scored out of 100.
Sector criteria
PCI-PAL captures card details securely and passes each payment to whichever gateway or processor the customer uses. Key to Pay, Click to Pay, and Speak to Pay cover card capture across voice and digital channels, and the company also lists Apple Pay, Google Pay, some BNPL brands, and open-banking payment options inside those flows. It does not issue cards. A contact-centre buyer will mostly care which channels it covers (voice, chat, email, social) and whether AI agents can use the same controls as human agents.
PCI-PAL runs in the cloud and is sold to plug into a customer's existing tools. The company says it deploys in days and needs no on-site hardware. It integrates with contact-centre, phone, and communications platforms (CCaaS, UCaaS, and CPaaS), CRM systems, and payment gateways. Whether a deployment works day to day comes down to how call recordings are redacted, what the agent sees on screen while keypad tones are masked, and how a bot hands over a payment without pulling systems back into PCI scope.
Reducing PCI scope is what the product is for. Card data stays out of the contact-centre environment, so fewer of the enterprise's systems need a PCI assessment. PCI-PAL says it is listed on the Visa Global Registry of Service Providers as a PCI DSS validated service provider. Royston Ballard is listed as chief information security officer. Once the integration is set, the buyer's own qualified security assessor (QSA) still has to review whatever PCI scope remains.
The company says more than 80% of its sales volume comes through partners. Most of its selling runs through repeatable integrations with large CCaaS vendors, such as RingCentral, which trading updates have mentioned. Its marketing also cites more than 300 payment-gateway connections. If a buyer's phone or bot platform is on PCI-PAL's certified list, deployment carries less risk.
Vendor criteria
In FY25 and FY26 the company stressed that the same secure capture works in human and AI-led conversations, and it pointed to verify-and-protect add-ons for authentication and fraud management alongside capture. The July 2026 trading update highlighted growth with US enterprises and with partners that sell AI conversation tools. For a buyer, the useful measure of depth is which CCaaS and AI bot connectors are certified for its own systems today.
Most customers are set up through a partner, though results statements also mention direct enterprise deals. PCI-PAL does not publish an onboarding SLA.
As of 5 October 2026, pcipal.com has no self-serve rate card for enterprise Key to Pay, Click to Pay, or Speak to Pay deployments, and pricing is sold through sales and partners. Some third-party marketplace listings, such as AWS Marketplace package pages, have shown prices for small, narrow packages. An enterprise deployment is quoted on its own terms, by agents, channels, and regions. Older investor materials give average deal sizes, which only show rough scale.
Most revenue is recurring: 91% of FY25 revenue came from recurring contracts. Management points to ARR and Contracted ARR as its forward measures. Contracts in this category usually run a year or longer. Renewal terms, price-indexation clauses, and whether the contract is with PCI-PAL or a partner all affect a comparison with Spreedly or Basis Theory, which sell different kinds of vault and orchestration products.
Against its peers
These are the other companies in payments and acquiring, with their ratings.
Fact file
| Products | Key to Pay; Click to Pay; Speak to Pay; authentication and fraud add-ons |
|---|---|
| FY25 revenue (audited) | £22.48 million, year ended 30 Jun 2025 (+25%) |
| FY25 ARR / CARR | ARR £19.26 million; CARR £22.20 million |
| FY26 trading update (unaudited) | Revenue guided ~£24.6 million; ARR £24.4 million; CARR £27.5 million (28 Jul 2026) |
| FY26 audited results | Delayed as of mid-Sep 2026 audit extension notices. Use FY25 until filed |
| Recurring mix | 91% of FY25 revenue from recurring contracts; gross margin ~90% |
| Go-to-market | Company states >80% of sales volume via partners |
| Listing | AIM: PCIP; Companies House 03869545 |
| Compliance note | Company states Visa Global Registry listing as PCI DSS validated service provider |
Competitive landscape
Secure payment capture, tokenisation, and vault vendors a contact-centre or platform buyer would compare with PCI-PAL.
PCI-PAL: 70
- PCI-PAL70
- SpreedlyNot reviewed
- Basis TheoryNot reviewed
- Processor-native vaults and large acquirer hosted-payment toolsNot reviewed
Comparisons
Key leadership
James Barham
Mufti Monim
Ryan Murray
James Barham leads PCI-PAL as chief executive, with Mufti Monim as chief technology officer and Ryan Murray as chief financial officer.
Barham is a founder of the PCI Pal secure-payments business. He built the company's early sales, marketing, and operations functions, moved to the United States temporarily in 2018 to open the North American operation, and became group CEO later that year. His career has been almost entirely in business software and technology, including commercial and operations roles at IPPlus, the contact-centre company PCI-PAL grew out of, and at IP3 Telecom, Call Connection, and the insurer Hiscox. He holds a BSc (Hons) in Business Management and Communications from Bath Spa University.
Monim joined PCI-PAL as chief technology officer in April 2021 from Deko, the retail-finance cloud provider, where he was CTO and led product and engineering for a platform used by more than 1,700 merchants. Before Deko he was head of technology at Lebara Money, where he built an international money-transfer platform, and he held digital technology leadership roles at Lebara Mobile.
Murray joined as chief financial officer in October 2024 from FD Technologies, a software group quoted on AIM, the London Stock Exchange's growth market. He spent about 14 years there in senior finance roles, most recently as group financial controller, and earlier as head of corporate finance and CFO of its foreign-exchange software division. He is a Chartered Accountant who qualified at EY in audit and corporate tax.