A service provider supplies other organisations with services involving card data processing, storage or transmission, or services that can affect the security of their card data environment.

The term also covers businesses providing services that control or affect card data security. Examples include payment channels such as PayPal, banks' payment platforms and hotel booking engines.

Service providers must comply with SAQ D SP, which contains all requirements and related security policies that the organisation must implement. Many organisations will need to validate compliance with the full PCI DSS requirements to meet SAQ D SP, while organisations with more specialised operating models may need to validate only part of them.

For example, a company that does not use wireless technology in its infrastructure will not need to validate compliance with the PCI DSS sections concerning wireless technology.

SAQ D SP applies to all service providers defined as a payment brand and eligible to complete an SAQ.

Service providers fall into one of two levels based on their annual transaction volume per card brand. These levels determine the certification methodology.

Level 2 Service Providers

Service providers performing up to 300,000 transactions per year

  • Annual completion of the SAQ D questionnaire
  • Quarterly ASV scans
  • Penetration Test
  • Internal scans
  • Completion of the Attestation of Compliance (AoC) form

Level 1 Service Providers

Service providers performing more than 300,000 transactions per year or delivering payment services (Payment Service Providers)

  • Annual Report on Compliance (RoC) by a Qualified Security Assessor (QSA)
  • Quarterly ASV scans by an Approved Scanning Vendor (ASV)
  • Penetration Test
  • Internal scans