Acquirer

Applies to. The entity a payment brand recognises as the merchant's acquirer: it signs up the merchant, takes its card transactions and answers to the brand for that merchant's compliance. In the standard the acquirer appears as a party to notify: 12.10.1 requires an incident response plan to include contact and communication strategies for notifying payment brands and acquirers, at a minimum, when a security incident is suspected or confirmed. A merchant that self-assesses submits its SAQ and attestation to its acquirer, or to the payment brand where the brand asks for that.

Example. An online homewares retailer's acquirer tells it each year which SAQ it must complete and by when, receives the signed attestation, and passes any brand requirements on to it. When the retailer's security team suspects card data has been skimmed from its checkout, the incident response plan it keeps under 12.10.1 names the acquirer's fraud and compliance contacts as the first external calls, alongside the brand's own reporting route.

Limits. The acquirer is not the issuer, which sits on the cardholder's side of the transaction. It is not the payment brand: the brand defines who may be an acquirer and writes the rules; the acquirer applies them to its merchants. It is not necessarily the payment processor, which may be a separate company engaged by the acquirer or by the merchant to handle the transactions. The acquirer receives a merchant's validation; it does not perform the assessment, and an acquirer's own PCI DSS status does not cover the merchants it banks.