PCI AOC: Attestation of Compliance, ROC and QSAs

What the AOC is, in the Council's words

So the AOC never travels alone. It sits on top of the document that holds the detail, and it is signed by the entity and by the QSA company if one was involved. For a merchant on a Self-Assessment Questionnaire, the AOC is not even a separate job: the SAQ Instructions say the Attestation in each SAQ “consists of Section 1: Assessment Information and Section 3: Attestation and Validation Details.” Section 2, between them, holds the requirements you answered.

The Council's assessment process runs scope, assess, report, attest, submit, remediate. The attest step is the AOC: “complete the appropriate Attestation of Compliance (AOC) in its entirety. Official AOCs are only available on the PCI SSC website.” The submit step sends the SAQ or ROC and the AOC, with scan reports where asked, to the entity that manages your compliance program.

SAQ, ROC, AOC, QSA: which paper is which

The names arrive together in your processor's emails and blur. Some are forms you fill in, the ROC is a report an assessor writes, and the rest are people:

ROC vs AOC

Which one you owe is not your choice, and not the Council's. Each card brand's program decides “whether an entity is eligible to complete a Self-Assessment Questionnaire (SAQ) or must complete a Report on Compliance (ROC).” Depending on the card brands' programs, an entity either has a detailed assessment documented in a Report on Compliance or self-assesses with an SAQ. An AOC goes with either one, and “Quarterly submission of an ASV scan report … may also be required.” The ROC holds what the SAQ does not: your environment, the samples the assessor picked and how each requirement was tested. The AOC is the signed summary, and it is the page a service provider shows its customers: the Council expects a provider with an AOC to provide it “to customers upon request.”

QSA vs ISA

“QSA companies are qualified by PCI SSC to validate an entity's adherence to PCI DSS requirements.” They are independent firms, listed on the Council's QSA list. An Internal Security Assessor is a company's own employee whom the Council trained and qualified to improve that company's self-assessments and its work with QSAs. Both have a line on the AOC; on a small merchant's form, both are usually “Not Applicable.”

Your AOC, part by part

The SAQ Instructions call the Attestation “the entity's declaration of eligibility to complete the applicable SAQ and their attestation to the results of a PCI DSS self-assessment.” Here is what the merchant form asks, in the order it asks it, read from the AOC for SAQ A. The other SAQ types' AOCs follow the same parts; the requirement list in Part 2g and the criteria in Part 2h change with the SAQ.

Parts 2f and 2h trip small merchants. Part 2f is your service-provider list, and the form adds “Requirement 12.8 applies to all entities in this list,” so every name you write there is a provider whose own AOC you should hold (more on that below). Part 2h is where you certify you are eligible for the SAQ you used: if any line there is untrue, the whole attestation is, which is why the SAQ type finder walks the same criteria first.

The status you pick in Part 3

• Compliant

  Every requirement is In Place, In Place with CCW or Not Applicable.

• Non-Compliant

  A section is incomplete or a requirement is Not in Place. You add a target date for compliance.

• Compliant but with Legal exception

  A requirement is Not in Place only because a law prevents it. The entity you submit to reviews it.

A Non-Compliant AOC is still an AOC. Part 4, the action plan, is filled in only “upon request of the entity to which this AOC will be submitted,” so ask your acquirer before you write one. Never tick Compliant to make the form go away: Part 3a has you confirm that the SAQ and the attestation fairly represent your results “in all material respects.”

Who signs it

The signature that is always there is yours. The form asks for the “Signature of Merchant Executive Officer,” with name, title and date; American Express's policy says the SAQ AOC “must be signed and dated by the authorized level of leadership” of the business. In an owner-run shop that is normally the owner, not the bookkeeper or the developer who filled in the answers.

A QSA signs only when one took part, and the form makes it say how: “QSA performed testing procedures” or “QSA provided other assistance.” A consultant who is not a QSA, and compliance software, have no line at all. That matches the consultants compare: they can help you answer, but the attestation is still yours.

Where you send it, and how often

For a small merchant the requesting entity is usually the acquirer, the “merchant bank” behind your card account. The Council does not collect AOCs and does not set your date: “Compliance validation requirements are set by brands, acquirers, payment facilitators, etc.” The form itself says the same in its first instruction: “Contact the entity(ies) to which the Attestation of Compliance (AOC) will be submitted for reporting and submission procedures.”

Scan reports follow the same rule. The ASV Program Guide: “Scan reports must be submitted according to each Participating Payment Brand's requirements. Scan customers should contact their acquiring bank or each Participating Payment Brand to determine to whom results should be submitted.” How to read and send them is in what an ASV scan is.

American Express publishes its own rules in its Data Security Operating Policy. Its levels run on yearly American Express card transactions, and Level 3 and 4 merchants send validation documents only if American Express asks. Below Level 1, the document it names is the SAQ AOC (unless you submit a ROC AOC), with quarterly scans for certain SAQ types.

The AOCs you collect from your providers

Your own AOC is not the only one you need. You also hold the AOC of every provider in Part 2f. Requirement 12.8.4: “A program is implemented to monitor TPSPs' PCI DSS compliance status at least once every 12 months.” Requirement 12.8.5: “Information is maintained about which PCI DSS requirements are managed by each TPSP, which are managed by the entity, and any that are shared between the TPSP and the entity.” In practice you meet the first by collecting each provider's current AOC every year, and the second with its responsibility matrix or your own written split.

Look a provider up on Visa's registry

Visa keeps a public Global Registry of Service Providers. The listings we opened showed the validation, its date and the assessor, not the AOC document itself. Its notice sets the clock: “PCI DSS compliance must be validated every 12 months,” and “The Visa validation date is determined based on the company's PCI DSS Report on Compliance (ROC) date or Self-Assessment completion date.” When revalidation papers are late, a listing carries one warning icon “Within 1 - 60 days upon expiry of the validation documents” and another “Within 61 - 90 days,” and “After 91 days, the service provider will be removed from the Registry.”

Search by company name and pick the suggestion that appears; the registered name is often the parent company. Square is listed as “Block, Inc. Square Inc.” and Authorize.net under a Cybersource listing. The step-by-step search is in the Authorize.net vs Stripe compare.

How providers hand theirs out

Each provider does it differently: a download, a request form, or a pointer to Visa. Pick yours, then tick what the document actually shows. The checks come from the Council's service provider AOC form, where Part 2a lists the services that were assessed and, separately, those that were not.

Source: PCI SSC, AOC for ROC, Service Providers, v4.0.1 (Aug 2024), Parts 1a, 2a, 3, 3c, read on 2026-10-22

The AOC on one receipt