What Happens If Your Third-Party Service Provider's AOC Is Nearly a Year Old?

Many businesses rely on a third-party service provider to meet some PCI DSS requirements for them, and show it with the provider's Attestation of Compliance (AOC). A common question at assessment time is what happens when that AOC records an assessment completed almost a year ago. The PCI Security Standards Council answered it directly in FAQ 1601 (November 2025).

What the Council says

The FAQ makes two points:

1. Evidence the assessor accepted stays accepted for that assessment. Any evidence reviewed during a PCI DSS assessment that the assessor deems valid when it is reviewed remains valid for that assessment. It does not need reviewing again before the Report on Compliance is finalised just because time has passed.
2. The assessor also checks your process. As part of the assessment, the assessor is expected to confirm that you have defined and implemented processes that keep the documentation supporting your PCI DSS controls up to date.

Questions about whether a particular provider's AOC can be accepted as evidence go to whoever manages your compliance programme: your acquirer, a payment brand, or another entity.

So an AOC that was current when your assessor reviewed it does not become a problem at the end of your assessment. An organisation with no way of noticing when its providers' AOCs go out of date does have a problem, and the assessor is expected to look for exactly that.

Why a year matters

PCI DSS itself does not put an expiry date on an AOC. A year matters because the payment brands' programmes generally expect validation every year, and because 12.8.4 requires you to monitor each provider's PCI DSS compliance status at least once every 12 months. An AOC well past a year old is the clearest sign that the monitoring has lapsed.

What the process should look like

Nothing in the FAQ prescribes a method. What an assessor needs to see is that the process exists and runs:

• A list of your providers and the services each provides, as 12.8.1 requires, with the date of each provider's current AOC and which of your requirements it supports.
• A reminder well ahead of each anniversary, so a new AOC is requested before the old one ages out, not after.
• Agreements that oblige providers to supply it. 12.9.2 requires service providers to give customers their compliance status on request; your agreement can set when.
• A record of what you did when an AOC was late: the request, the reply, and any decision taken with your acquirer or assessor.
• A check that the AOC still covers what you use. A provider's new AOC may have a different scope from last year's. FAQ 1576 says the AOC should apply to the services the provider gives you.

When a provider's AOC is late

1. Ask the provider for its current AOC, or its expected date and any interim evidence it can give.
2. Record the request and the answer.
3. If your own assessment is running, tell your assessor early rather than at the end.
4. If you are unsure whether what you have is acceptable, ask your acquirer or the brand, as the FAQ directs.

A provider that does not undergo its own assessment can still support your compliance: under FAQ 1576 it is expected to give you specific evidence for the requirements it meets for you. Which of your requirements depend on a provider, and which you meet yourself, belongs in the record 12.8.5 requires, usually a responsibility matrix.

For the wider question of which providers need to be compliant at all, see Should my service provider be PCI compliant?.