Merchant

Applies to. Any organisation that takes payment cards for goods or services, in any channel and at any size: a market stall with one terminal, a call centre taking cards by phone, and an online store all count. The same organisation is also a service provider if what it sells involves holding or handling card data for other businesses, for example a software company that sells subscriptions by card and also runs a payment application used by other merchants. How a merchant validates (an SAQ or a Report on Compliance, and which SAQ) is set by its acquirer under payment brand rules and the eligibility criteria in the SAQ Instructions and Guidelines, not by PCI DSS itself.

Example. A chain of gyms takes card payments at reception, sets up card-on-file memberships by phone and sells passes through its website, and is a merchant in all three channels. Its acquirer tells it which SAQ it is eligible for and when to submit. When it starts offering white-label class booking and payment pages to independent studios, it takes on service-provider requirements for that line of business as well.

Limits. Merchant status is defined by accepting cards, not by size, turnover or channel. Merchant levels, transaction thresholds and what must be submitted are set by each payment brand and applied by acquirers; PCI DSS contains no levels. Outsourcing payment to a hosted page or a processor does not stop an organisation being a merchant or take it outside PCI DSS; it changes which requirements remain with the merchant. A merchant is not the cardholder, the acquirer that banks it, or the processor it uses, and a business that only issues cards or only processes them for others is not a merchant unless it also accepts cards itself.