Type "what is PCI DSS compliance" into a search bar and most results collapse a detailed, dated assessment into a single yes or no badge. A real PCI DSS validation is not a badge. It is an Attestation of Compliance, a signed document that names a merchant level, a validation method, the Qualified Security Assessor who carried out the review, and an expiry date after which the assessment no longer applies. This article walks through what that document actually records, how to read the same fields on a public registry such as the Visa PCI registry mirror, and why appearing on that registry is not automatically the same thing as holding a current validation.
What PCI DSS actually is
PCI DSS, the Payment Card Industry Data Security Standard, is a set of technical and operational controls written by the PCI Security Standards Council, the body founded by Visa, Mastercard, American Express, Discover and JCB. The standard sets requirements across firewalling, encryption of stored and transmitted cardholder data, access control, vulnerability management, logging and regular penetration testing. It applies to any organisation that stores, processes or transmits payment card data, and to the service providers, payment gateways and processors that touch that data on a merchant's behalf. PCI DSS: what PCI DSS third-party service provider management asks of your vendors sets out what a buyer specifically needs from a vendor sitting in that supply chain, rather than from the merchant itself.
What "PCI DSS compliant" is supposed to mean
Compliance with PCI DSS is not awarded once and kept indefinitely. An entity completes an assessment, either a Report on Compliance led by a Qualified Security Assessor or an internal security assessor, or a Self-Assessment Questionnaire that the entity scores itself against a defined set of control statements. The Self-Assessment Questionnaire comes in several variants depending on how card data is handled, from SAQ A for a merchant that outsources all card data to a validated third party, through to SAQ D for a merchant or service provider that stores card data directly. The result of either route is recorded on an Attestation of Compliance, a short signed document stating whether the entity met the requirements at the time of the assessment. The AOC carries an assessment date and an expiry date, usually twelve months later. A vendor stating it is "PCI DSS compliant" on a trust page is describing a status at a point in time, not a permanent property of the company, in the same way a SOC 2 report covers a fixed period rather than standing good forever, a point made plainly in there is no such thing as "SOC 2 certified".
Merchant and service provider levels decide the validation method
The depth of assessment a merchant or service provider must complete depends on transaction volume, set by merchant level. Visa publishes four levels, and the other card brands run broadly similar tiers, though the exact thresholds and the choice between a Report on Compliance and a Self-Assessment Questionnaire can be set by the acquiring bank rather than by the card brand alone.
| Level | Annual transaction volume | Typical validation method |
|---|---|---|
| Level 1 | Over 6 million transactions, or any merchant that has suffered a card data breach | Annual Report on Compliance by a QSA or an internal assessor |
| Level 2 | 1 million to 6 million transactions | Self-Assessment Questionnaire, or a Report on Compliance if the acquirer requires it |
| Level 3 | 20,000 to 1 million e-commerce transactions | Self-Assessment Questionnaire |
| Level 4 | Fewer than 20,000 e-commerce transactions, or up to 1 million total | Self-Assessment Questionnaire, set by the acquirer |
Visa's published merchant levels. Acquirers and other card brands can set different thresholds for the same tier.
What a validated Attestation of Compliance actually records
An AOC is short, usually a handful of pages, but every field on it changes what a buyer can actually rely on. The table below sets out the fields that matter most when a vendor sends over an AOC, or when the same information appears summarised on a registry entry. The same framework is indexed at PCI DSS: vendors with public evidence, which shows how often each field is actually populated across the vendors CertReports tracks.
| Field on the AOC | What it records | Why it matters to a buyer |
|---|---|---|
| Entity name and type | Legal name, and whether it is a merchant or a service provider | Confirms the AOC belongs to the vendor you are reviewing, not a parent or a sibling entity |
| PCI DSS version | The version assessed against, for example 4.0 or 4.0.1 | An AOC against a retired version is no longer current evidence |
| Validation method | Report on Compliance by a QSA, or a specific Self-Assessment Questionnaire type | A QSA-led RoC and a self-scored SAQ are not the same strength of evidence |
| QSA or assessor name | The Qualified Security Assessor company and the individual signatory | Lets a buyer confirm the assessor is a currently licensed QSA |
| Assessment date and expiry | The date the assessment was signed, and the date it is due for renewal | Validation lapses on a schedule, it is not a one-off badge |
| Compliance status | Compliant, or a status indicating remediation is required | The headline result the AOC actually attests to, separate from the scope statement |
The core fields on a PCI DSS Attestation of Compliance, and why each one changes what the document proves.
PCI DSS applies to any entity that stores, processes or transmits cardholder data, or that could affect the security of the cardholder data environment, regardless of size or number of transactions.
Where to check it: the Visa registry mirror
Visa keeps a public list of validated service providers known as the Global Registry of Service Providers. CertReports mirrors the same entries in the Visa PCI registry mirror, alongside the AOC fields described above, so a buyer can see the merchant level, validation method, QSA and expiry date without requesting a copy of the document directly from the vendor. Where PCI DSS evidence actually lives goes into more detail on how Visa's registry compares with Mastercard's equivalent list, and why the two do not always agree on the same vendor.
- 1
Find the correct legal entity
Search by the legal entity name rather than the product name, since service providers are often listed under a holding company.
- 2
Check the assessment and expiry dates
Confirm the listing shows a recent assessment date, not one that has quietly lapsed.
- 3
Match the QSA
Check the assessor named on the registry is a currently licensed Qualified Security Assessor, rather than a company you do not recognise.
- 4
Match the service description
Confirm the registry entry's service description covers the product you are actually buying, not a different business unit of the same group.
Why most Visa registry rows are not a validation
Not every row on the Visa registry represents a current PCI DSS validation. Some entries are historic, some cover a different legal entity than the one being reviewed, and some show no expiry date at all, which is a sign the listing has not been refreshed. CertReports examined this directly in Three quarters of the Visa registry is not a PCI DSS validation, which found that a large share of registry rows do not carry the dated evidence a buyer actually needs before relying on them.
- 4
- Visa merchant levels
- Set by annual transaction volume, from Level 1 down to Level 4.
- About 3 in 4
- Visa registry rows without a current validation
- Finding from the CertReports index on 2026-11-06.
- 4.0.1
- Current PCI DSS version
- Published by the PCI Security Standards Council as a clarifying update to version 4.0.
PCI DSS 4.0: what changed and why the version matters
PCI DSS 4.0 is the current major version of the standard, published by the PCI Security Standards Council to replace version 3.2.1, which the council retired in March 2024. Version 4.0 added more prescriptive authentication requirements, including wider use of multi-factor authentication, more detailed logging and monitoring, and a formal process for organisations to run their own targeted risk analyses on certain controls where the standard allows flexibility. The council followed with a clarifying update, 4.0.1, that corrected wording and timing without changing the substance of the requirements. An AOC should state which version of the standard was assessed. An attestation against 3.2.1 dated after the retirement date is no longer current evidence, whatever a vendor's trust page claims.
Reading a vendor's PCI DSS status in five minutes
The fastest way to check a vendor's PCI DSS status is to treat the claim the same way you would treat a SOC 2 report or an ISO 27001 certificate, by going to the primary evidence rather than the marketing page. How to read a trust centre in ten minutes covers the equivalent steps for SOC 2 and ISO evidence, and the same discipline applies here: find the document, check the date, check the scope, and check who signed it.
Checkout.com's public listing is a useful illustration of what a dated PCI DSS validation looks like sitting next to other evidence types on the same page. Rather than quoting figures here, since the card below renders live data, look at whether the PCI DSS row shows a validation date and a named registry source, and compare that to how the SOC reports on the same page state their report type.
checkout · Trust report
Payments · Public evidence as of 19 Oct 2026
Framework overview
CertReports state for each framework with public evidence: 1 verified, 6 vendor-stated.
3Documents and agreements
Legal and review documents checkout publishes or offers, as of 30 Sep 2026.
- Subprocessor list · Public
- Privacy policy · Public
- Public trust centre documents · Cyber Essentials+ 2026; Cyber Essentials+ 2025
3Subprocessors
Named on checkout's public subprocessor list, last seen 30 Sep 2026.
People also ask
What is pci dss?
PCI DSS is the Payment Card Industry Data Security Standard, a set of technical and operational requirements written by the PCI Security Standards Council for any organisation that stores, processes or transmits payment card data. It covers network segmentation, encryption, access control, logging and regular testing. It applies to merchants and to the service providers and payment processors that handle card data on their behalf.
What is pci dss compliance?
PCI DSS compliance means an entity has completed a validation, either a Report on Compliance signed by a Qualified Security Assessor or a Self-Assessment Questionnaire, and holds a current Attestation of Compliance. It is not a certificate and it is not permanent: validation is tied to a specific assessment date and lapses after roughly twelve months, so a buyer should check the status, merchant level and expiry rather than accept the label alone.
What is pci dss stand for?
PCI DSS stands for Payment Card Industry Data Security Standard. "PCI" refers to the payment card industry generally, and the standard is maintained by the PCI Security Standards Council, a body founded by the major card brands including Visa, Mastercard, American Express, Discover and JCB. "DSS" refers to the data security standard itself, the detailed set of requirements organised into twelve control objectives.
What is pci dss 40?
PCI DSS 4.0 is the current major version of the standard, published by the PCI Security Standards Council to replace version 3.2.1, which was retired in March 2024. It adds requirements such as targeted risk analyses, wider multi-factor authentication and more detailed monitoring. A clarifying update, 4.0.1, followed. An AOC should state which version was assessed, since older versions are no longer current evidence.
Solomon Amos · Founder, CertReports
Solomon builds CertReports, the public evidence index for vendor security reviews. PhD in machine learning and cybersecurity, two years embedded at HMRC digital programmes, founder of TapTax. He writes about what registries, trust centres and auditors actually publish, and how buyers can use it before the questionnaire goes out.
Read next on CertReports
You might also like
Where PCI DSS evidence actually lives: the Visa and Mastercard registries
CertReports Research · 3 Sep 2026 · 10 min read
The state of public compliance evidence in 2026: what 3,000 vendors actually publish
CertReports Research · 18 Sep 2026 · 12 min read
Three quarters of the Visa registry is not a PCI DSS validation
CertReports Research · 17 Sep 2026 · 10 min read