Frequently Asked Question
Are acquirers considered service providers for the purpose of PCI DSS Requirements 12.8 and 12.9?
Service providers include business entities that are not a payment brand, directly involved in the processing, storage, or transmission of cardholder data on behalf of another entity. This includes organizations providing acquiring services — for example, payment gateways, PSPs, ISOs etc.
However, an entity that acquires a merchant's payment transactions and is defined by a payment brand to be an acquirer is not considered a service provider for that particular merchant's PCI DSS compliance for the purpose of Requirements 12.8.
If the acquirer provides other services to the merchant, for example management of the merchant's payment terminals, then the merchant and acquirer should work together to understand which party is responsible for managing the applicable PCI DSS requirements for the services provided.
Whether acquirers are required to validate PCI DSS compliance, including Requirement 12.9, is determined by the individual payment brands.
However, an entity that acquires a merchant's payment transactions and is defined by a payment brand to be an acquirer is not considered a service provider for that particular merchant's PCI DSS compliance for the purpose of Requirements 12.8.
If the acquirer provides other services to the merchant, for example management of the merchant's payment terminals, then the merchant and acquirer should work together to understand which party is responsible for managing the applicable PCI DSS requirements for the services provided.
Whether acquirers are required to validate PCI DSS compliance, including Requirement 12.9, is determined by the individual payment brands.
July 2014
Article Number: 1284
