Is a bank's affiliate that provides services to the bank issuer required to demonstrate compliance or certification to PCI DSS? If so, how is this typically done?

  • 2
    The answer will depend on exactly what services are provided, so you’d better specify that in the question.
    – Mike Scott
    Aug 19, 2018 at 16:30
  • 3
    If there are card numbers involved, then yes, and via SAQ or PCI audit. If "Affiliate" and "Services" means "Printer" and "Brochures," then no. More details are needed to make this really answerable.
    – gowenfawr
    Aug 19, 2018 at 16:40

1 Answer 1


Both Visa and Mastercard require their issuing banks to only use third party service providers that are compliant with the relevant PCI standards. So it all depends on what services are being provided and therefore what the card scheme requires (because there are more PCI standards than just PCI DSS).

If the service provider is just doing stuff with cardholder data and not providing services where other PCI standards apply (eg card personalisation) then typically the issuing bank will specify compliance with PCI DSS in the contract - the service provider would need to have an annual onside assessment by a QSA and provide a ROC to the issuer. Also Visa (I am not as familiar with the Mastercard rules) would require the bank to register the service provider with Visa and the service provider would also have to provide their RoC directly to Visa.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .