PCI DSS Merchants vs Service Providers: Roles, Levels, and Validation

Merchant vs Service Provider

Levels and Validation

Exact Level 1-4 cutovers and service-provider tiers are set by payment brands and acquirers. Confirm thresholds with your acquirer and see the compliance levels page - do not assume a single global volume table applies to every brand.

How CyberSilo Helps

• CSA evidence for merchant or service-provider assessments
• ThreatHawk SIEM multi-tenant logging patterns for service providers
• TPSP inventory and Requirement 12.8 monitoring workflows

Frequently Asked Questions

We only host apps - are we a service provider?

If you store, process, or transmit CHD/SAD for others, or provide services that control or impact CHD/SAD security, yes under the glossary service-provider definition. Confirm with your QSA or brand program.

Does buying a compliant gateway make us SAQ A automatically?

Only if you meet all SAQ A eligibility criteria and your acquirer allows an SAQ. A compliant TPSP does not automatically equal SAQ A.

Must every TPSP be PCI DSS compliant for us to meet 12.8?

Requirement 12.8 requires monitoring compliance status; it does not require every TPSP to be compliant. But if a TPSP's service is meant to meet your PCI DSS requirements, that service must be demonstrated as meeting them or those requirements are not in place for you.

Related PCI Resources

SAQ D · ROC and AOC · SAQ types · CDE scoping · QSA vs ISA vs ASV · Compliance levels