PCI Attestation of Compliance (AOC): Forms, Scope, and v4.0 Rules

A PCI Attestation of Compliance is the signed, one-page-style summary form that certifies your organization has met the Payment Card Industry Data Security Standard (PCI DSS) for the past assessment cycle. It is valid for one year, after which you need a fresh assessment and a new AOC. Any business that processes, stores, or transmits credit card data needs one, as does any service provider that handles cardholder data for those businesses. Acquiring banks, payment brands, and business partners rely on the AOC as the standardized proof that you are holding up your end of the security chain.

Who Needs One, and at What Level

If your business accepts credit cards in any form, PCI DSS applies to you. The card brands sort merchants into levels by annual transaction volume, and the level determines how rigorous your assessment has to be. Visa’s framework is the one most commonly referenced.

Level 1: More than 6 million Visa transactions a year, or any merchant that has suffered a data breach. Requires an on-site audit by a Qualified Security Assessor and a Report on Compliance.
Level 2: Between 1 million and 6 million transactions a year. Historically allowed self-assessment, though Mastercard now requires Level 2 merchants to use a QSA.
Level 3: Between 20,000 and 1 million e-commerce transactions a year.
Level 4: Fewer than 20,000 e-commerce transactions, or up to 1 million total transactions a year across all channels.

Levels 3 and 4 can typically complete a Self-Assessment Questionnaire paired with an AOC, instead of a full external audit. Your acquiring bank can impose stricter requirements than the brand minimums, so confirm with them before assuming you qualify to self-assess.

Service providers have their own classification. Level 1 service providers handle more than 300,000 card transactions annually and must undergo a full QSA-led assessment. Level 2 service providers fall below that threshold and can self-assess. Either way, the AOC is the deliverable your clients and their banks will ask to see.

Choosing the Right AOC Form and SAQ

The PCI Security Standards Council publishes separate AOC forms for merchants and service providers, and separate versions for self-assessments and full QSA audits. The current forms in the PCI SSC Document Library are:¹

AOC for SAQ (Merchants): Paired with a Self-Assessment Questionnaire for merchants who qualify to self-assess.
AOC for ROC (Merchants): Paired with a Report on Compliance for Level 1 merchants or anyone whose acquirer requires a full QSA audit.
AOC for SAQ (Service Providers): For service providers that self-assess.
AOC for ROC (Service Providers): For Level 1 service providers undergoing a QSA-led assessment.
Supplemental AOC (Designated Entities): For entities subject to additional requirements beyond the base standard.

If you are self-assessing, you also have to pick the SAQ type that matches your payment environment. The wrong choice will get your AOC rejected. The main SAQ types under v4.0 are:²

SAQ A: You have outsourced all cardholder data functions to PCI-validated third parties and do not store, process, or transmit card data on your own systems.
SAQ A-EP: E-commerce merchants who outsource payment processing but whose website can affect the security of the transaction, such as a redirect or iframe setup.
SAQ B: You process cards only through imprint machines or standalone dial-out terminals with no electronic storage.
SAQ B-IP: Standalone, PCI-approved point-of-interaction devices connected via IP but isolated from other network systems.
SAQ C: Payment application systems connected to the internet, with no electronic cardholder data storage.
SAQ C-VT: You manually key one transaction at a time through an internet-based virtual terminal provided by your payment processor.
SAQ D: The catch-all. If none of the others fit, you use SAQ D, which covers the full range of PCI DSS requirements. There are separate SAQ D versions for merchants and service providers.
SAQ P2PE: Merchants using a validated point-to-point encryption solution with no electronic cardholder data storage.

Choosing the wrong SAQ is one of the most common mistakes, and it often means redoing the entire assessment. When in doubt, SAQ D is always valid. It is just far more work.

Your Next AOC Must Use PCI DSS v4.0

PCI DSS v4.0 replaced version 3.2.1 and has been fully in effect since March 31, 2025, including all 51 requirements that were originally marked as “future-dated best practices.”³ If your last AOC was completed under v3.2.1, it is no longer valid for new submissions. Your next assessment has to use the v4.0.1 AOC templates, which were published in August 2024.¹

The biggest structural change in v4.0 is a new “customized approach” alongside the traditional “defined approach.” Under the defined approach you implement each requirement exactly as written and use compensating controls when you cannot. The customized approach lets you meet a requirement’s security objective using a different method of your choosing, as long as you can prove the outcome is equivalent. The AOC asks you to document which approach you used for each requirement, so it is not something you can decide after the fact. Compensating controls also cannot be used retroactively to cover a requirement you simply missed in the past.⁴

What the Form Asks For

The AOC itself is a summary document, but completing it honestly requires substantial preparation. You will need to provide:

Business details, including legal name, DBA names, primary contact, and the URL of your payment page if you have one.
A facility inventory covering every physical location where cardholder data is handled, stored, or could be accessed, including corporate offices, retail locations, data centers, and disaster recovery sites.
A list of every third-party service provider that stores, processes, transmits, or could affect the security of your cardholder data. Their compliance status directly shapes your own risk profile.
Hardware and system descriptions, including point-of-sale terminals, payment applications, web servers, firewalls, and any other components in your cardholder data environment.
Current network diagrams showing how cardholder data flows through your systems and where segmentation boundaries sit.

For each PCI DSS requirement, the form asks whether you are compliant, non-compliant, or whether the requirement does not apply. Non-compliant items need a target remediation date. If you used compensating controls, you must describe the constraint and the alternative control in detail. Behind every compliance claim sits supporting evidence: firewall configurations, vulnerability scan reports, access control logs, encryption settings, and employee security training records. The AOC essentially certifies that this evidence exists and was reviewed.

Getting Scope Right

Scope is where most AOC problems start. Every system that stores, processes, or transmits cardholder data is automatically in scope, and so is every system connected to those systems or capable of affecting their security. Under PCI DSS v4.0 Requirement 12.5.2, you have to confirm your scope’s accuracy at least once a year and before each annual assessment by identifying all locations and flows of account data.⁵ Keep documentation showing how you reached your scoping decisions so your assessor can review it.

Network segmentation can shrink your scope dramatically, but it has to be done right. A system is only out of scope if it meets all of these conditions:⁶

It does not store, process, or transmit cardholder data.
It is not on the same network segment, subnet, or VLAN as systems that do.
It cannot connect to or access any system in the cardholder data environment.
It cannot gain access to the CDE or affect a security control through an in-scope system.

If you rely on segmentation to reduce scope, your assessor must verify that the segmentation is adequate. The standard requires penetration testing of all segmentation controls at least annually for merchants and at least every six months for service providers.⁶ Segmentation that has not been tested is treated as if it does not exist, which puts every system on the flat network in scope.

Who Has to Sign

The AOC requires signatures from specific people, and the wrong signature makes the document worthless.

For self-assessments, a duly authorized officer of the company signs, attesting that the information is accurate and the security controls are functioning as described. This person must have the authority to legally bind the organization to those claims.

For assessments involving an external audit, a Qualified Security Assessor signs as well. QSAs are individuals employed by companies that the PCI SSC has independently qualified to validate PCI DSS adherence.⁷ The AOC includes a dedicated section for the QSA’s signature, company name, and the specific role they played in the assessment.⁸

Internal Security Assessors are a third option. ISAs are employees of the assessed organization who have been trained and certified by the PCI SSC. They can perform the assessment and sign the AOC for their own company, and the form documents their involvement separately from a QSA’s.⁸ Not every organization qualifies to use an ISA in place of a QSA. Your acquiring bank and the card brands determine whether that option is available to you.

Submitting and Keeping Records

Merchants submit the completed AOC to their acquiring bank, the financial institution that connects them to the card networks. Some acquirers provide a secure online portal; others accept encrypted email. The AOC form itself tells merchants to contact their acquirer for specific submission procedures.⁹ Service providers typically share the AOC directly with their merchant clients as proof of their security posture.

After submission, the acquirer reviews the document for completeness. Expect follow-up questions if fields are left blank or if your scope description does not match what the acquirer knows about your business. The AOC is valid for one year, and the annual cycle resets with each new assessment.

The standard does not fix a separate retention period for the AOC document itself, but holding onto prior-year AOCs and the supporting evidence indefinitely is smart practice. If a breach investigation reaches back in time, you want proof of what your compliance posture looked like during the relevant period.

When Changes Trigger a Fresh Assessment

Your AOC reflects the security environment as it existed at the time of assessment. Significant changes to that environment can invalidate your current compliance status and require a new assessment before the year is up. The PCI SSC identifies these triggers as changes to technologies, business processes, personnel, or third-party relationships that could affect the security of cardholder data.¹⁰

In practice, this includes migrating to a new payment processor, deploying a new e-commerce platform, restructuring your network, or adding a major new service provider. You do not necessarily need a full reassessment for every change, but a targeted risk analysis under v4.0 should decide whether the change affects requirements you already validated. Relying on a stale AOC after a material change is one of the fastest ways to end up non-compliant without realizing it.

What Non-Compliance and Breaches Cost

Financial pain from non-compliance comes through your acquiring bank. Visa and Mastercard do not fine merchants directly. They fine the acquirer, which passes the costs downstream to you. Monthly non-compliance penalties typically run from $5,000 to $100,000 depending on severity and duration, and a single breach can generate fines up to $500,000 per incident. Your merchant agreement almost certainly includes an indemnification clause making you responsible for all fines, penalties, and assessments resulting from your failure to comply with PCI DSS.

Beyond fines, an acquirer can raise your per-transaction processing fees, restrict the types of transactions you are allowed to process, or terminate your merchant account outright. Losing the ability to accept credit cards is an existential threat for most businesses, and finding a new acquirer after a compliance-related termination is extremely difficult.

A breach almost always voids your previous AOC. You will need to remediate the issues found during the forensic investigation, undergo a new full assessment, and produce a fresh AOC before the card brands will consider you compliant again. If you were a Level 4 merchant that previously self-assessed, a breach can bump you to Level 1 requirements regardless of your transaction volume.

Signing an AOC that contains false information carries its own risk. The AOC is a legal attestation, and the authorized officer who signs it is affirming under their legal authority that the stated security controls are in place and functioning. If a breach reveals that the AOC was inaccurate, the signing officer and the organization face potential liability not just from the card brands but from affected cardholders and business partners. That exposure is why the signature block deserves the same care as the assessment behind it.

1
PCI Security Standards Council. Document Library
2
PCI Security Standards Council. PCI DSS v4 Whats New with Self-Assessment Questionnaires
3
PCI Security Standards Council. Now Is the Time for Organizations to Adopt the Future-Dated Requirements of PCI DSS v4.x
4
PCI Security Standards Council. PCI DSS v4.0 Compensating Controls vs Customized Approach
5
PCI Security Standards Council. PCI DSS v4.0.1
6
PCI Security Standards Council. Guidance for PCI DSS Scoping and Network Segmentation
7
PCI Security Standards Council. Qualified Security Assessor (QSA)
8
University of Michigan Finance. PCI Attestation of Compliance (AOC) Example
9
PCI Security Standards Council. PCI DSS v3.2.1 Attestation of Compliance for Merchants
10
PCI Security Standards Council. PCI DSS Risk Assessment Guidelines