Card payments now pass through merchants, gateways, processors, cloud hosts, and software vendors before a transaction settles, and each of these parties is expected to prove that it protects cardholder data. Acquiring banks need that proof before they keep processing for a merchant, enterprise buyers need it before they sign a payment-related contract, and auditors need it before they close a vendor finding.
The PCI Data Security Standard answers this demand with one formal document that travels across the entire payment ecosystem: the Attestation of Compliance (AOC). Despite its importance, many teams misread what an AOC covers, which version applies, or what a weak one looks like during procurement.
This guide explains everything security and governance leaders should know about the PCI AOC under PCI DSS v4.0.1.
What Is A PCI Attestation Of Compliance (AOC)?
A PCI Attestation of Compliance (AOC) is the official declaration, completed on a PCI Security Standards Council (PCI SSC) template, that confirms an organization has finished its PCI DSS assessment and states its compliance status.
The AOC records the outcome of either a Qualified Security Assessor (QSA) onsite assessment or a Self-Assessment Questionnaire, so it always follows a completed assessment and never stands on its own. It ends with one of three statuses:
Compliant, Non-Compliant, or Compliant but with Legal Exception. Because it omits sensitive control details, the AOC is the document organizations share with acquirers, payment brands, and business partners as proof of validation.
Who Needs A PCI AOC?
Every merchant and service provider that stores, processes, or transmits cardholder data, or that can affect its security, needs a current PCI AOC to demonstrate validation. Merchants are grouped into four levels by annual card transaction volume, and Level 1 under Visa and Mastercard programs covers those processing more than six million transactions a year.
Level 1 merchants validate through a QSA-led onsite assessment, while Levels 2 to 4 usually complete a questionnaire unless their acquirer requires more. Service providers handling more than 300,000 transactions a year are Level 1 and need an onsite assessment, while smaller providers can self-assess. Organizations unsure which questionnaire fits can review our guide to PCI SAQ types and eligibility.
What Information Does A PCI AOC Contain?
A PCI AOC contains four parts that together identify the organization, describe the assessed environment, record the compliance status, and capture signatures. Part 1 lists contact details for the assessed entity and the assessor.
Part 2 is the executive summary, which describes payment channels or assessed services, in-scope locations, the cardholder data environment, PCI SSC-validated products, third-party service providers, and a summary of results for each requirement.
Part 3 holds the validation and attestation statements, and Part 4 is an action plan that only Non-Compliant entities complete. The current forms for every validation path are published in the PCI SSC Document Library.
Which PCI AOC Template Should You Use?
The correct PCI AOC template depends on whether the organization is a merchant or a service provider and on how it validated compliance. Merchants assessed onsite use the AOC for Onsite Assessments for Merchants, while self-assessing merchants use the AOC attached to their questionnaire, such as SAQ A, SAQ A-EP, SAQ B-IP, SAQ C, or SAQ D.
Service providers use either the AOC for Onsite Assessments for Service Providers or the AOC that accompanies SAQ D for Service Providers. The service provider version adds a scope verification section listing the services assessed and the services excluded. Engaging a qualified PCI QSA early helps confirm the right path before fieldwork begins.
Who Signs A PCI AOC, How Long Is It Valid, And Where Is It Submitted?
An executive officer of the assessed organization signs the AOC to attest to its accuracy, and the QSA or Internal Security Assessor (ISA) who performed or supported the assessment also signs.
The AOC reflects compliance on the assessment date, and acquirers and customers treat it as current for 12 months, which sets an annual validation cycle. Organizations submit the AOC to their acquiring bank or the relevant payment brands, and they share it with customers on request.
Every AOC issued today must reference PCI DSS v4.0.1, since the Council retired v4.0 on December 31, 2024, as noted in its v4.0.1 publication announcement.
How Do Organizations Obtain A PCI AOC?
Organizations obtain a PCI AOC by defining scope, closing control gaps, completing the required assessment, and signing the matching attestation. A typical sequence follows five steps:
- Confirm the merchant or service provider level and the validation method with the acquirer.
- Scope the cardholder data environment and reduce it through segmentation or tokenization.
- Run a readiness assessment and remediate gaps against PCI DSS v4.0.1.
- Complete the onsite assessment or questionnaire, including quarterly external scans.
- Sign the AOC and submit it with supporting evidence to the acquirer or payment brands.
External scanning is a recurring requirement in that cycle, and our explainer on how a PCI ASV scan works covers what passing results require.
| Ampcus Cyber’s PCI DSS compliance services include vendor AOC reviews alongside readiness and assessment support. |
Why Do Customers Request A Service Provider AOC?
Customers request a service provider AOC because PCI DSS Requirement 12.8 obliges every entity to manage and monitor the PCI DSS compliance status of third parties that handle cardholder data or could affect its security.
A payment gateway, hosting provider, or contact center platform extends the client’s own compliance scope, so the client’s assessor will expect a current AOC from each one. Requirement 12.8.5 adds a documented matrix of which requirements each provider manages, and Requirement 12.9 obliges providers to acknowledge their responsibilities in writing.
Mature programs fold AOC tracking into a modern third-party risk management program with risk scoring so expiry dates trigger reviews automatically.
How Should CISOs Review A Vendor’s PCI AOC?
CISOs should review a vendor’s PCI AOC by confirming that it is current, properly signed, issued against PCI DSS v4.0.1, and scoped to the exact services the organization consumes. Check that the assessment date falls within the last 12 months and that the compliance status reads Compliant.
Read the scope verification section closely, because providers often assess one product line while selling several. Look for requirements marked Not Tested and confirm that a QSA signed when the provider is Level 1. In the PCI engagements our consultants support, a frequent late-stage finding is a vendor AOC that expired months earlier or covers a different service than the one the client uses.
| Secure your next PCI AOC with confidence by speaking with Ampcus Cyber’s PCI QSA professionals about a tailored readiness review. |
People Also Ask
Is a PCI AOC the same as a PCI compliance certificate?
No, the AOC is the official validation document, and assessor-issued certificates are informal summaries the PCI SSC does not recognize.
Does the PCI SSC collect or approve AOCs?
No, organizations submit their AOC to their acquiring bank or payment brands, and the PCI SSC does not review individual attestations.
Can a company share its AOC with customers?
Yes, the AOC is designed for sharing with customers and partners because it confirms compliance status without exposing control details.
What happens if a vendor’s AOC has expired?
Treat the vendor as unvalidated, request an updated AOC or proof of an assessment in progress, and record the gap in your risk register.
Can a non-compliant organization still submit an AOC?
Yes, it submits the AOC with a completed Part 4 action plan that sets target dates for each unmet requirement.
Enjoyed reading this blog? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn.
