Three quarters of the Visa registry is not a PCI DSS validation

When we built the Visa registry mirror for CertReports, the first version produced a number that looked wonderful and was wrong: thousands of vendors with verified PCI DSS status. A day of reading the registry’s own field definitions brought it down to about a quarter of that. This is what the registry actually contains, why scrapers and some compliance dashboards get it wrong, and how the index records it now.

3,626

Rows mirrored from the Visa registry

Nightly, page by page

~25%

Rows with a PCI DSS validation date

The only rows that become verified

12 months

Validity of a listing

From the validation date, unless renewed

What the registry is for

Visa requires service providers that store, process or transmit cardholder data on behalf of Visa clients to validate PCI DSS compliance and register. The registry is the public list of those providers, with the services validated, the assessor and the validation date. That is the population buyers care about. Service providers must revalidate every twelve months and submit the Attestation of Compliance and Report on Compliance to Visa one year from the validation date.

The same registry also carries Third Party Agents: merchant servicers, independent sales organisations, encryption support organisations and others that Visa clients register through the Third Party Agent programme for reasons unrelated to a PCI DSS assessment. They appear as rows, with names and regions, and without a validation date because no validation happened.

The Visa Third Party Agent Program registers entities performing activities like solicitation, device deployment, or encryption key management on behalf of Visa clients.

How the mislabel happens

Any tool that counts rows, or treats presence on the registry as compliance, inflates PCI DSS coverage by a factor of about four. Vendors do the same thing in reverse when a checkout page says "listed on the Visa registry" and the listing is an agent registration. Neither is malicious; the registry simply does not explain itself on the search page.

The counts in the index

Of 3,626 rows, 1,531 carry a validation date and match a vendor in the catalogue. Of those, 1,361 are within twelve months of validation and 158 have passed the window. The remainder are agent registrations, which are searchable on the mirror but create no PCI DSS state.

How the index handles it

1. A verified PCI DSS row is created only when the registry shows a validation date. The row stores the date, the services validated and the assessor verbatim.
2. The row expires twelve months after the validation date. After that it is shown as expired until the registry shows a newer date.
3. Agent rows are kept as registry entries and searchable on the mirror, but they create no framework state.
4. Mastercard SDP listings are recorded separately; a provider on either list with a current date is verified.
5. Registry entries are matched to vendors by domain and name with a join quality score; unmatched validations are kept and re-tried nightly.

Why the twelve-month rule is not optional

Compliance decays between assessments. Verizon’s Payment Security Report has tracked this for a decade; the 2023 edition found only 43.4 percent of organisations maintained full compliance after their initial validation. A registry row from eighteen months ago says something true about eighteen months ago. Treating it as current is the same error as counting agent rows, only slower.

Only 43.4% of global organizations maintain full compliance after their initial validation.

What to ask a vendor

• The Attestation of Compliance, not the Report on Compliance. It names the version, the assessor and the services in scope.
• Whether the service you buy is in the "services validated" list. A gateway validation does not cover a reporting dashboard.
• The validation date. Older than twelve months is expired for registry purposes.
• The responsibility matrix: which requirements are theirs and which are yours. Browse validated providers on the Visa PCI registry mirror.