Frequently Asked Question
Are acquirers considered service providers for the purpose of PCI DSS Requirements 12.8 and 12.9?
However, an entity that acquires a merchant’s payment transactions and is defined by a payment brand to be an acquirer is not considered a service provider for that particular merchant’s PCI DSS compliance for the purpose of Requirements 12.8.
If the acquirer provides other services to the merchant, for example management of the merchant’s payment terminals, then the merchant and acquirer should work together to understand which party is responsible for managing the applicable PCI DSS requirements for the services provided.
Whether acquirers are required to validate PCI DSS compliance, including Requirement 12.9, is determined by the individual payment brands.