Is Your Payment Processor Actually PCI Compliant?

Your payment processor says your transactions are secure. Customers can enter their card details, payments go through, and your business receives its settlements on time. Everything appears to be working. But can your provider prove that it meets the security standards required to protect payment card data?

Many merchants assume that using a payment processor automatically makes their business PCI compliant. It does not. A provider may offer working payment technology while leaving important questions unanswered about its security assessments, data protection practices, or compliance documentation.

The good news is that checking a payment processor’s PCI DSS status does not have to be complicated. In this guide, we explain what to verify, which documents to request, what warning signs to watch for, and how to respond if a provider cannot demonstrate its compliance.

Quick answer: How can you verify a PCI-compliant payment processor?

A payment processor should be able to provide current PCI DSS compliance documentation, typically an Attestation of Compliance (AOC), that matches the services it delivers. You can also check the Visa Global Registry of Service Providers and the Mastercard Site Data Protection (SDP) program. Registry requirements and listing eligibility vary by program, so verify the provider’s exact status rather than relying on a logo or marketing claim.

Why “They Process Cards” Doesn’t Mean “They’re PCI Compliant”

A successful card transaction proves that a payment system can communicate with the relevant payment infrastructure. It does not prove that every system involved meets the Payment Card Industry Data Security Standard (PCI DSS).

Payment processing typically involves several parties. The payment processor handles transaction processing, the payment gateway securely transfers transaction information, and the merchant operates the website, checkout experience, or other sales channels. Depending on the arrangement, additional providers may manage tokenization, recurring billing, fraud screening, or customer information.

Each party has responsibilities based on the data it handles and the services it provides. Outsourcing payment processing can reduce a merchant’s exposure to cardholder data, but it does not automatically remove the merchant’s PCI DSS obligations.

The consequences of weak payment security can extend beyond a technical problem. A data breach may trigger investigations, contractual penalties, card-brand assessments, increased operating costs, and customer complaints. Depending on the circumstances, a business could also experience chargebacks, interrupted processing, or restrictions imposed by its acquiring bank.

Customer trust is another concern. People expect businesses to protect their payment information, even when an external provider handles the transaction.

The practical lesson is simple: evaluate your processor’s documented security controls, not just its ability to accept payments. Reliable payment processing requires both operational performance and appropriate security validation.

PCI DSS: What Compliance Actually Means Today

PCI DSS stands for Payment Card Industry Data Security Standard. It is a global security standard developed through the payment card industry to help protect account data and reduce the risk of payment card fraud and data breaches.

The standard emerged in 2004, when major card brands brought their security requirements together. The PCI Security Standards Council (PCI SSC) was established in 2006 to manage and develop the standards. Over time, the framework has evolved alongside online shopping, cloud infrastructure, mobile payments, software-as-a-service platforms, and distributed business operations.

As of October 2026, PCI DSS v4.0.1 is the current active version of the standard. PCI DSS v4.0 was retired at the end of 2024, and the future-dated requirements under the v4.x framework became effective on March 31, 2025. Businesses should consult the official PCI SSC website for the latest standard, supporting documents, and applicable updates.

PCI DSS addresses areas such as access control, protection of stored account data, secure transmission, vulnerability management, logging, monitoring, security testing, and organizational security policies. The specific requirements applicable to an organization depend on its environment and assessment method.

Compliance is not simply an annual form or a badge on a website. Annual validation remains important, but security must be maintained between assessments through patching, monitoring, testing, access reviews, and documented procedures.

PCI DSS timeline

2004 → 2006 → 2022 → 2024 → 2025 → Today

• 2004: The original PCI Data Security Standard is introduced.
• 2006: The PCI Security Standards Council is established.
• 2022: PCI DSS v4.0 is published.
• 2024: PCI DSS v4.0.1 is published, and v3.2.1 is retired.
• 2025: The future-dated PCI DSS v4.x requirements become effective.
• Today: Organizations must maintain appropriate controls and validate compliance under the applicable requirements.

Visual suggestion for publication: Turn this timeline into a horizontal infographic using WebPays’ brand colors, with a short label and date at each milestone.

6 Ways to Verify Your Payment Processor’s PCI Status

You do not need to be a cybersecurity specialist to begin checking a provider’s compliance. These six steps will help you establish whether its claims are supported by verifiable evidence.

1. Check the Visa Global Registry of Service Providers

Start with the Visa Global Registry of Service Providers. It allows users to search for service providers and review information such as company names, websites, regions of operation, services, and compliance validation dates.

Search for the provider’s legal business name rather than relying only on its trading name. If the business operates through multiple entities, ask which entity supplies your service and confirm that the listing matches it.

Pay attention to the validation date and the service categories shown. A listing associated with another company in the same corporate group may not establish that your actual provider is covered.

Visa explains that PCI DSS validation for applicable service providers is required every 12 months. The registry is updated periodically, so review the latest status rather than relying on an old screenshot or certificate.

You should also confirm with your acquiring bank that the provider is appropriately registered for your arrangement. A registry entry is an important verification step, not a substitute for checking the exact service you intend to use.

2. Check the Mastercard SDP Service Provider List

If your business accepts Mastercard, review the Mastercard Site Data Protection (SDP) program.

The program provides information about PCI DSS validation requirements for service providers. Mastercard also publishes a list of compliant registered service providers that meet its applicable Level 1 service provider requirements.

Search using the provider’s legal name and compare the available details with the information it has supplied. Check the assessment date and any status indicators on the current list.

There is an important distinction here: the published list is not an exhaustive directory of every organization that may have a PCI DSS compliance obligation. Therefore, the absence of a name should prompt a written explanation and further verification rather than an automatic conclusion that the company is noncompliant.

Ask the provider which Mastercard SDP category applies to it, what validation method it uses, and whether its documentation has been submitted as required.

3. Request the Attestation of Compliance (AOC)

An Attestation of Compliance is one of the most useful documents you can request from a payment processor.

An AOC records an organization’s assertion of its PCI DSS assessment results and the relevant assessment details. Depending on the assessment method, the documentation may be supported by a Report on Compliance (ROC) or a Self-Assessment Questionnaire (SAQ).

When reviewing the document, check these details:

• Company identity: Does the legal entity match your payment provider?
• Assessment date: When was the assessment completed?
• Standard version: Does it reference the applicable PCI DSS version?
• Assessment scope: Which services, systems, and locations were included?
• Assessor information: Is the Qualified Security Assessor (QSA) identified when an independent assessment was required?
• Attestation and status: Does the document record the applicable compliance outcome and required signatures?

A provider may not publish its AOC openly because the document contains business and security information. However, it should be able to explain how customers can obtain appropriate compliance evidence.

Do not confuse a general security certificate, an ISO 27001 certificate, a marketing statement, or a payment industry membership with PCI DSS validation. These may be relevant to security, but they are not interchangeable.

4. Confirm the Assessment Level and Validation Method

Ask the processor which service provider level applies to its business and what validation method is required under the relevant card-brand program.

Under Mastercard’s SDP program, Level 1 includes third-party processors and merchant payment gateways, among other specified service provider categories. Level 1 service providers must complete an annual PCI DSS assessment resulting in a Report on Compliance.

A Level 1 assessment is not simply a self-assessment completed without independent review. It involves the applicable formal assessment process, including a PCI SSC-approved QSA where required.

Other service providers may qualify for different validation methods under the applicable rules. For this reason, do not assume every company must follow an identical assessment process.

Ask the provider to identify its category, explain the applicable requirements, and supply the corresponding evidence. If a QSA performed the assessment, you can also use the PCI SSC’s Qualified Security Assessor resources to verify the assessor’s qualification.

5. Check the Date of the Last Assessment

PCI DSS compliance validation is generally an annual requirement for service providers under the applicable card-brand programs.

Ask when the last assessment was completed and when the next validation is due. Compare the dates with the AOC and any information available through the relevant card-brand registry.

A document issued several years ago is not sufficient evidence of current compliance. Likewise, a provider’s statement that an assessment is scheduled does not establish that the assessment has been completed successfully.

Keep in mind that an annual assessment represents a point-in-time evaluation. It does not guarantee that every security control has remained effective since the assessment took place.

If the document is approaching its renewal date, request confirmation of the provider’s current validation status and ask how it maintains security between assessments.

6. Confirm That the Assessment Covers Your Actual Services

A provider may offer several products under one brand, but not every product is necessarily covered by the same assessment scope.

For example, you might use a provider for card processing, a hosted payment gateway, recurring billing, tokenization, or payment-page services. Ask whether the relevant service and supporting systems are included in the provider PCI DSS assessment.

Also confirm whether subcontractors or other third-party providers participate in the payment flow. Ask which party is responsible for protecting each part of the process.

A providers AOC should be reviewed alongside its service description and responsibility matrix. The responsibility matrix identifies which security obligations belong to the provider, the merchant, and any other relevant party.

If your processor uses one validated platform for payment processing but delivers another service through a separate entity or system, do not assume that the second service receives the same coverage.

The goal is to verify the actual arrangement you use, not simply confirm that a company somewhere in the payment chain has passed an assessment.

Copyable PCI Verification Checklist

Use this checklist when reviewing a current provider or comparing new payment processing options.

• Confirm the provider’s legal business name.
• Search the Visa Global Registry, where applicable.
• Review the Mastercard SDP program and list, where applicable.
• Request the provider’s current PCI DSS AOC.
• Confirm the assessment date and applicable standard version.
• Verify the assessment method and assessor details.
• Confirm that your gateway and other selected services fall within scope.
• Request the provider’s responsibility matrix.
• Ask how vulnerabilities and security incidents are handled.
• Save the documents and record the next review date.

Keep the evidence. Save the checklist, AOC, relevant registry information, and correspondence in your vendor compliance folder. This makes future reviews and discussions with your acquiring bank much easier.

Questions to Ask Your Payment Processor

If you are reviewing an existing provider or evaluating a new payment gateway, send the following questions to its compliance or security team.

Copy-and-Paste Email

Subject: Request for Current PCI DSS Compliance Documentation

Hello,

We are reviewing our payment security arrangements and would appreciate your confirmation of the PCI DSS compliance status of the services you provide to our business.

Could you please answer the following questions and share the relevant documentation?

1. When was your most recent PCI DSS assessment completed, and who performed it?
2. Can you provide your current Attestation of Compliance (AOC) and, where appropriate, details of the related assessment?
3. How do you protect cardholder data during transmission and storage?
4. How do you identify, investigate, and remediate security vulnerabilities?
5. What monitoring and security testing do you perform between annual assessments?
6. Are you listed on the applicable Visa and Mastercard service provider resources? If not, please explain your validation and registration status.
7. Can you provide a responsibility matrix showing which PCI DSS obligations are handled by your organization and which remain our responsibility?
8. Does your assessment cover the specific services we use, including payment gateway functionality, recurring billing, and tokenization where applicable?
9. What is your process for reporting and responding to a suspected security incident?
10. When is your next PCI DSS validation due?

Please also let us know if any subcontractors or other third-party services are involved in processing our payment transactions.

Thank you for your assistance. We look forward to reviewing the documentation.

Best regards,
[Your Name]
[Company Name]

Red Flags That Your Processor May Not Be Compliant

A processors  inability to provide a clear answer deserves attention. However, evaluate the evidence before concluding that a provider has failed to meet its obligations. Some documentation may be confidential, and registry eligibility can vary.

If you see this	What you should do
The provider refuses to share an AOC or any acceptable evidence of compliance.	Request the document through its compliance team and ask what alternative verification is available.
The provider gives vague answers such as “we are fully secure” without supporting documentation.	Request specific assessment dates, validation methods, and evidence.
The provider is missing from a card-brand registry.	Ask whether it is required to be listed, whether another legal entity is registered, and how its status can be verified.
Its assessment documentation is outdated.	Request current validation evidence and confirm the status with the relevant card brand or acquiring bank.
The provider asks you to store raw card details without a clear business or security reason.	Stop the proposed implementation until the data flow, PCI DSS scope, and storage requirements have been reviewed.
There is no documented security incident response process.	Ask for its incident reporting procedure, escalation contacts, and response responsibilities.
The AOC covers a different company or service.	Request documentation that matches the legal entity and services you actually use.
The provider cannot explain your security responsibilities.	Request a responsibility matrix and confirm outstanding obligations with your acquiring bank or a qualified assessor.

One warning sign alone does not necessarily prove noncompliance. For example, a provider might have a legitimate reason for restricting access to detailed security documentation. What matters is whether it can provide sufficient, credible evidence through an appropriate channel.

Repeated evasiveness, contradictory statements, expired validation, or a clear mismatch between the assessment scope and your services should trigger a more formal review.

What Should Your Processor Be Doing Year-Round?

PCI DSS compliance should be supported by ongoing security work, not just preparation for an annual assessment.

A responsible payment processor should maintain controls appropriate to its environment, monitor relevant systems, investigate suspicious activity, and address vulnerabilities according to their severity and risk. It should also keep its security documentation current and review access to sensitive systems.

Regular activities may include vulnerability scanning, penetration testing where required, patch management, access reviews, security logging, incident-response exercises, and employee security training. The precise requirements depend on the systems involved and the applicable assessment criteria.

The provider should also evaluate changes that could affect its compliance scope. Introducing a new payment product, changing hosting infrastructure, modifying tokenization services, or onboarding a new subcontractor can create security questions that need to be addressed.

Merchants should ask how the processor monitors its controls between formal assessments and how it communicates significant security incidents.

An annual AOC is valuable evidence, but it should not be treated as a guarantee that a provider is secure in every circumstance. Effective payment security requires continuous attention, clear accountability, and prompt action when something changes.

Your Responsibility as a Merchant

Even when you work with a PCI DSS-compliant payment processor, your business still has responsibilities. The exact obligations depend on how you accept payments, whether your systems handle cardholder data, and which validation method applies.

Complete the Correct Self-Assessment Questionnaire

A Self-Assessment Questionnaire (SAQ) is a reporting tool used by eligible merchants to validate their compliance with applicable PCI DSS requirements.

SAQ A may apply to certain e-commerce and mail-order or telephone-order merchants that outsource all payment processing and do not electronically store, process, or transmit cardholder data on their own systems. Eligibility depends on meeting all the applicable criteria.

For example, a business that redirects customers to a compliant third-party payment page may qualify for SAQ A if it meets the other requirements. An embedded payment form may also qualify in certain circumstances, but the payment-page implementation and security controls must meet the relevant criteria.

Under PCI DSS v4.0.1, eligible e-commerce merchants using embedded payment pages must also address the applicable eligibility criterion concerning attacks against scripts that could affect their e-commerce systems. The PCI SSC explains the relevant conditions in its official SAQ A scripts FAQ https://www.pcisecuritystandards.org/faqs/1588/ .

Do not choose an SAQ solely because it appears to involve less work. Ask your acquiring bank or the organization responsible for accepting your compliance documentation which questionnaire applies to your payment setup.

Protect Your Own Systems and Accounts

Use strong, unique passwords and multifactor authentication for administrative accounts. Restrict access to employees who need it, remove access promptly when roles change, and install security updates according to an appropriate maintenance process.

Train staff to recognize phishing attempts, suspicious payment requests, and improper handling of customer information. Establish clear procedures for reporting possible security incidents.

Secure Your Checkout Page

Your payment page deserves particular attention. Even when card details are entered into a third-party hosted form, attackers may target the merchant’s website to alter payment links, redirect customers to fraudulent pages, or interfere with the checkout experience.

Keep your website and plugins updated, restrict who can modify checkout code, and review scripts that run on payment-related pages. Follow the security measures required for your implementation and document the controls used to protect the payment flow.

Maintain a Compliance Folder

Keep copies of your applicable SAQ, processor AOC, responsibility matrix, relevant security correspondence, and validation dates. Include any records required by your acquiring bank.

Review the folder periodically and whenever you change payment providers, add a new payment method, or modify your checkout system.

These steps help you demonstrate that you understand your obligations instead of relying entirely on a provider’s assurances.

How PCI Compliance Protects Your Business

PCI DSS compliance provides a structured approach to protecting payment card data. It encourages businesses and service providers to identify weaknesses, control access, maintain secure systems, and respond to potential threats.

For merchants, working with a provider that can demonstrate appropriate compliance helps establish a stronger foundation for payment security. Customers are more likely to trust a checkout experience when a business treats their information responsibly, although compliance alone cannot guarantee higher conversion rates.

Good security practices can also help reduce exposure to certain types of payment fraud and limit the impact of a security incident. Documented response procedures, appropriate monitoring, and clear responsibilities can help teams identify problems and coordinate their response more effectively.

There are operational benefits as well. A well-managed payment environment is easier to review, maintain, and explain to acquiring banks, business partners, and internal stakeholders.

However, PCI DSS compliance does not eliminate every form of fraud, cyberattack, or data breach. It does not guarantee that every transaction is legitimate or that a compliant provider will never experience an incident.

The strongest approach combines documented compliance, practical security controls, regular reviews, and responsible handling of payment information throughout the transaction lifecycle.

What to Do If Your Processor Isn’t Compliant

If your payment processor cannot demonstrate the required compliance, avoid making assumptions or ignoring the issue. Follow a documented process to establish the facts and protect your business.

Step 1: Request Documentation in Writing

Contact the provider’s compliance or security team. Request its current AOC, the applicable assessment details, and confirmation that your services are within scope.

Keep copies of your request and the response. If the provider claims that a registry listing is unnecessary, ask it to explain the applicable validation and registration requirements.

Step 2: Set a Reasonable Deadline

Give the provider a clear date to supply the requested information or explain the outstanding issue. The deadline should reflect the seriousness of the concern and any requirements imposed by your acquiring bank or card-brand program.

If you suspect an active compromise, do not wait for an ordinary documentation deadline before escalating the matter.

Step 3: Contact Your Acquiring Bank

Your acquiring bank can help clarify your compliance obligations, determine which validation evidence is required, and explain any relevant contractual or card-brand requirements.

Share the documentation you have collected and ask what action is necessary to address the concern. Do not assume that a provider’s assurance overrides the requirements of your acquiring relationship.

Step 4: Review Your Exposure

Work with qualified security or compliance professionals to understand whether the issue affects cardholder data, checkout systems, recurring billing, or other payment services.

If you suspect a data breach, follow your incident response procedure and promptly notify the appropriate parties according to your contractual, legal, and card-brand obligations.

Step 5: Prepare a Migration Plan if Needed

If the provider cannot resolve a material compliance concern, assess alternative processors and gateways. Before switching, confirm their validation status, service scope, security responsibilities, integration requirements, and settlement arrangements.

Plan the migration carefully. Token portability, recurring payment credentials, customer notifications, and transaction continuity may require coordination with the existing provider and acquiring bank.

Do not transfer or export sensitive payment data without confirming that the process is authorized and appropriately protected.

A documented decision protects your business better than an abrupt change made without understanding the technical and contractual consequences.

Final Thoughts

A payment processor’s security claims should be supported by evidence. Reviewing its PCI DSS documentation, checking applicable card-brand resources, confirming the assessment scope, and understanding the division of responsibilities can help you make a better-informed decision.

For merchants choosing or reviewing a payment gateway, the goal is not simply to find a provider that says it is secure. It is to establish that the provider can demonstrate the appropriate validation, explain its security practices, and support the payment services your business actually uses.

WebPays recommends making PCI DSS verification part of your regular payment-provider review. Keep your documentation current, address gaps promptly, and treat payment security as an ongoing business responsibility rather than a once-a-year task.

Disclaimer: This article provides general educational information, not legal, cybersecurity, or compliance advice. Confirm your specific PCI DSS obligations with your acquiring bank, the applicable payment brands, or a qualified PCI professional.

Frequently Asked Questions

1. What Is the Difference Between PCI Compliant and PCI Certified?

PCI DSS compliance means an organization has validated its adherence to the applicable security requirements through the relevant assessment process. “PCI certified” is often used informally in marketing, but it can be misleading because PCI DSS validation is not a universal product certification. Ask for the specific AOC, assessment method, and scope instead of relying on terminology alone.

2. How Often Should a Payment Processor Be Audited?

Applicable PCI DSS service provider validation is generally required every 12 months, although the exact validation method depends on the provider’s category and card-brand requirements. Annual validation does not replace ongoing security work. Ask when the last assessment was completed, when the next one is due, and how vulnerabilities and security controls are managed between assessments.

3. Is a Payment Gateway Automatically PCI Compliant?

No. A payment gateway is not automatically PCI DSS compliant simply because it accepts or transmits card transactions. Its provider must meet the applicable requirements for its services and environment. Merchants should request compliance evidence, confirm the assessment scope, and check the relevant card-brand resources where applicable.

4. Do Small Merchants Need to Worry About PCI Compliance?

Yes. Business size does not automatically remove PCI DSS obligations. Small merchants may qualify for a simpler validation method, such as an appropriate SAQ, depending on their payment setup and acquiring bank’s requirements. Outsourcing payment processing can reduce scope, but merchants must still meet the requirements applicable to their own systems and operations.

5. What Happens If I’m Not PCI Compliant?

The consequences depend on the circumstances, contractual terms, and applicable card-brand and acquiring-bank rules. A merchant may face additional assessments, remediation requirements, increased costs, or restrictions on payment acceptance. Noncompliance can also increase exposure to payment data breaches. Contact your acquiring bank to confirm your obligations and address any gaps promptly.

6. Does Using a PCI-Compliant Processor Make My Business PCI Compliant?

No. A compliant processor can help reduce the amount of cardholder data your business handles, but your own compliance responsibilities depend on your payment environment. You may still need to complete an applicable SAQ, secure your website and administrative accounts, protect checkout pages, and maintain supporting documentation. Confirm the correct requirements with your acquiring bank.