PCI DSS Roles and Responsibilities: Merchants, Acquirers, QSAs, and ASVs

PCI DSS roles and responsibilities are divided across a chain of parties: the PCI Security Standards Council writes the standard, the five card brands enforce it, acquiring banks pass those requirements down to the businesses they process for, merchants and service providers protect the cardholder data itself, and a set of certified professionals (QSAs, ASVs, ISAs, and PFIs) validate the work or investigate when it fails. Knowing which party owns which obligation is the whole game, because the gaps between “I thought my processor handled that” and what the processor actually handles are where breaches and fines happen.

Who Writes the Rules vs. Who Enforces Them

American Express, Discover, JCB, Mastercard, and Visa founded the PCI Security Standards Council in 2006 to develop and maintain the standard.¹ The council owns the technical requirements. It does not enforce them.

Enforcement sits with the individual card brands, and each one runs its own compliance program. Visa defines what a Level 1 Visa merchant is; Mastercard sets its own thresholds for Mastercard volume. Each brand sets its own validation requirements, timelines, and penalty structures. Visa, for instance, manages all of its own compliance enforcement and validation initiatives separately from the council.² The practical consequence: there is no single enforcement authority to call, and your obligations depend on which brands’ cards you accept.

Acquiring Banks

Acquiring banks are the financial institutions that process card payments for merchants, and for most businesses they are the face of PCI enforcement. Your acquirer determines your merchant level, tells you which validation method applies, collects the documentation, and imposes the consequences when something is missing.

Acquirers must ensure their merchants validate at the appropriate level and submit the required compliance documentation.³ They can also escalate a merchant to a higher validation tier after a data breach. Penalties from the card brands flow through the acquirer in the form of monthly fines, higher processing fees, or termination of the processing agreement. The brands do not publish fine schedules, but the amounts are contractual and typically escalate the longer non-compliance persists.

Merchant Responsibilities

A merchant is any business that accepts payment cards. PCI DSS applies globally to every entity that stores, processes, or transmits cardholder data or sensitive authentication data.⁴ Cardholder data, at minimum, means the full primary account number, and can include cardholder name, expiration date, and service code. Sensitive authentication data covers card verification codes, full track data, and PINs.⁵

Outsourcing to a payment processor does not transfer your compliance obligations. You remain responsible for the security of cardholder data even when someone else handles it on your behalf.⁶ Core merchant duties under v4.0.1 include:

Maintaining a current inventory of every third-party service provider with access to account data or any ability to affect the security of your cardholder data environment, along with a description of each one’s services.
Having written agreements with each service provider that acknowledge the provider’s responsibility for the security of the account data it handles.⁷
Monitoring each service provider’s PCI DSS compliance status at least once every 12 months.
Running due diligence on any new service provider before engagement.

Merchant Compliance Levels

Annual transaction volume determines how you validate. Visa and Mastercard set their own thresholds. Visa’s levels, which the industry references most often, work like this:³

Level 1: More than 6 million Visa transactions annually across all channels. Annual Report on Compliance by a Qualified Security Assessor, quarterly scans by an Approved Scanning Vendor, and an Attestation of Compliance.
Level 2: 1 million to 6 million transactions annually. Annual Self-Assessment Questionnaire, quarterly ASV scans, and an Attestation of Compliance.
Level 3: 20,000 to 1 million e-commerce transactions annually. Same validation as Level 2.
Level 4: Fewer than 20,000 e-commerce transactions, or up to 1 million total transactions through other channels. Annual SAQ recommended, with specifics set by the acquirer.

Any merchant that suffers a breach can be moved up to a higher validation level regardless of volume.³ Mastercard uses a similar tiered structure but also requires certain Level 2 merchants to engage a QSA or an Internal Security Assessor for validation.⁸

The PCI SSC publishes multiple SAQ types tailored to how a merchant accepts cards. Choosing the wrong one is a common mistake, and the right choice depends on your specific payment environment; your acquiring bank or QSA can confirm which SAQ fits.

Service Provider Responsibilities

A service provider is any entity, other than a card brand, that is directly involved in processing, storing, or transmitting cardholder data on behalf of another organization. Managed firewalls, hosting, tokenization, and payment gateways all fall in this category.

Service providers carry an obligation merchants do not: they must give each customer a written acknowledgment confirming that they accept responsibility for the security of account data they possess, store, process, or transmit on the customer’s behalf. They must also supply PCI DSS compliance status information on request and spell out which requirements they handle versus which ones fall to the customer.⁷

Validation is stricter on the provider side. Mastercard classifies any third-party processor or payment gateway as a Level 1 service provider regardless of volume, requiring a full ROC by a QSA.⁸

The Shared Responsibility Matrix

When cardholder data moves into a cloud environment or any outsourced function, both sides need a formal responsibility matrix. The matrix walks every applicable PCI DSS requirement and marks it as the provider’s, the customer’s, or shared. Written agreements should document that division and describe how the customer will monitor the provider’s compliance status.⁶

Where a provider uses its own downstream vendors (sometimes called nested third parties), extra oversight is needed. You cannot assume your provider is managing those relationships. This is the quiet place where most compliance gaps hide.

Qualified Security Assessors

A Qualified Security Assessor is an individual working for a QSA company certified by the PCI SSC to perform on-site PCI DSS assessments. QSAs confirm the scope of your cardholder data environment, evaluate your controls against each requirement, and produce the Report on Compliance. A duly authorized officer of the QSA company signs the Attestation of Compliance that summarizes whether the assessed entity meets PCI DSS.⁹

QSAs must be on-site during the assessment, maintain independent judgment, and retain the workpapers used to reach their conclusions. When sampling is used in a large environment, the QSA chooses the facilities and systems that represent the whole. The ROC is the definitive compliance document for Level 1 merchants and most Level 1 service providers.

Customized Approach Assessments

PCI DSS v4.0.1 added a second validation path called the customized approach, which allows an organization to meet a requirement’s security objective without following the prescribed steps. The organization documents the alternative control in a controls matrix, performs a targeted risk analysis, and tests the control. The QSA’s job becomes more involved: the assessor must derive custom testing procedures and independently verify the control meets the objective.¹⁰ A QSA who helped design or implement a customized control cannot then assess it.

Approved Scanning Vendors

Approved Scanning Vendors are companies certified by the PCI SSC to perform external vulnerability scans of internet-facing systems. Requirement 11.3.2 calls for evidence of passing external scans by an ASV at least once every three months.¹¹ Quarterly ASV scans are required for Level 1 through Level 3 Visa merchants and may be required for Level 4 depending on the acquirer.³

Internal Compliance Roles

PCI DSS cannot be a once-a-year assessor-driven exercise. Several internal roles carry year-round responsibility.

Executive Accountability

Under v4.0, the requirement for formal assignment of information security responsibility was clarified. A Chief Information Security Officer or another knowledgeable member of executive management must be formally designated as accountable for the information security program and PCI DSS compliance.¹² That person owns the formal information security policy, confirms it is reviewed and updated at least annually, and ensures employees acknowledge their responsibilities for protecting cardholder data.

Internal Security Assessors

An Internal Security Assessor is a full-time employee who has completed PCI SSC training and passed the required examinations. The program is meant to strengthen internal self-assessments and smooth interactions with external QSAs.¹³ ISAs can only assess their own employer’s environment, and whether a card brand accepts ISA work for validation varies by brand. Mastercard permits Level 1 and Level 2 merchants to use ISAs for certain assessments.⁸ Qualification requires annual retraining and renewed exams; falling behind revokes standing immediately.

Security Awareness Training

Requirement 12.6 places the organization on the hook for a formal security awareness program covering all personnel. Training is required at hire and at least once every 12 months after that, measured from each employee’s individual training date rather than the calendar year. Under v4.0, content must specifically address phishing, social engineering, and acceptable use of end-user technologies. Each employee acknowledges the training in writing at least annually, and the program itself must be reviewed and updated at least once every 12 months.

Incident Response and PFIs

Requirement 12.10 obligates every organization to maintain an incident response plan covering roles, communication procedures, containment and mitigation steps, business recovery, data backup, and legal reporting analysis. Personnel assigned to incident response must be available around the clock, and the plan has to be reviewed, updated, and tested at least annually.

When a breach actually happens, card brands and acquirers typically require engagement of a PCI Forensic Investigator qualified by the PCI SSC.¹⁴ The PFI determines how the breach occurred, assesses the scope of exposed data, and recommends remediation. The acquirer or brand decides when a PFI is required, and the compromised entity pays for it.

What Changed in v4.0.1

PCI DSS v3.2.1 retired on March 31, 2024, and v4.0.1 has been the only supported version since December 31, 2024.¹⁵ The transition introduced 64 new requirements, 51 of which were classified as future-dated and became mandatory on March 31, 2025.¹⁶ These touch targeted risk analysis, phishing-specific training content, and enhanced authentication. Any organization still working from v3.2.1 habits is now assessed against the full v4.0.1 set.

A Boundary Worth Naming

PCI DSS is an industry standard, not a law. Card brands and acquiring banks enforce it through contract. Government regulators are a separate track: the Federal Trade Commission has brought action against organizations that failed to safeguard consumer data, often under Section 5 of the FTC Act,¹⁷ and several states have statutes that mirror PCI DSS controls or require reimbursement to banks after breaches involving prohibited data storage. Being PCI compliant does not automatically provide a legal safe harbor. Being demonstrably non-compliant makes defending against regulators and civil suits much harder.

1
PCI Security Standards Council. Five Leading Payment Brands Unite to Strengthen Global Data Security
2
Visa. Account Information Security Program and PCI
3
Visa. Validation of Compliance
4
PCI Security Standards Council. PCI DSS Quick Reference Guide
5
PCI Security Standards Council. Glossary
6
PCI Security Standards Council. Third-Party Security Assurance
7
PCI Security Standards Council. PCI DSS v4.0 SAQ D for Service Providers
8
Mastercard. Site Data Protection Program FAQs
9
PCI Security Standards Council. Qualified Security Assessors Program Guide
10
PCI Security Standards Council. PCI DSS v4.0.1
11
PCI Security Standards Council. Resource Guide – Vulnerability Scans and Approved Scanning Vendors
12
PCI Security Standards Council. Summary of Changes from PCI DSS Version 3.2.1 to 4.0
13
PCI Security Standards Council. ISA Qualification Requirements
14
PCI Security Standards Council. PCI Forensic Investigators
15
PCI Security Standards Council. Just Published – PCI DSS v4.0.1
16
PCI Security Standards Council. Now Is the Time for Organizations to Adopt the Future-Dated Requirements of PCI DSS v4.x
17
Federal Trade Commission. Privacy and Security Enforcement