A card network that operates a payment system and sets the rules merchants and service providers must follow for cards carrying its mark. Visa, Mastercard, American Express, Discover and JCB, the five founding members of the PCI Security Standards Council, are the best known, and the Council's definition also covers other global and regional schemes. The distinction from the Council matters in practice: the Council writes and maintains PCI DSS but does not enforce it. Each payment brand runs its own compliance validation programme, sets merchant and service provider levels, decides who must submit what, and levies fines through acquirers. Requirements and thresholds therefore differ between brands.
Applies to. Every merchant and service provider that accepts or handles cards carrying a brand's mark, whether the brand is a Council participating brand or a regional scheme or network. The standard treats brands as parties to be notified and as a source of procedure: 12.10.1 requires an incident response plan to cover notification of payment brands and acquirers at a minimum, and to reference or include the brands' own incident response procedures. Outside the standard's text, each brand runs the compliance programme that decides how an entity validates and what happens when it does not.
Example. A travel agency accepts cards from four brands. Its acquirer sets one validation schedule, but the agency's incident response plan under 12.10.1 lists a separate notification route and a reference to the reporting procedure for each brand, because after a suspected compromise each brand may expect to hear from it directly.
Limits. The payment brand is not the PCI Security Standards Council: the Council writes and maintains PCI DSS and runs the assessor and vendor listing programmes, while the brands enforce the standard through their own rules and through acquirers. The term is not limited to the founding brands; any global or regional scheme whose cards are accepted is a payment brand for the entity accepting them. Brand operating rules, merchant levels and validation deadlines are not part of PCI DSS and can differ from one brand to the next. The brand is also not the acquirer or the issuer, even where a brand network connects the two.