Payment Processor
PCIComplianceHubLast updated
The entity a merchant, an acquirer or another party engages to handle the mechanics of a card transaction: routing authorisation requests to the payment brand networks and managing clearing and settlement. The Council treats payment gateway and payment service provider as other names for the same role. Processors store, process and transmit account data, so they are service providers under PCI DSS and must validate their own compliance.
Applies to. Any entity a merchant, acquirer or other party engages to handle card transactions for it; the standard's vocabulary treats payment processor, payment gateway and payment service provider as overlapping labels for that role. Because the work means storing, processing or transmitting account data for others, a processor is a third-party service provider under PCI DSS and validates as one, with the service-provider additions such as a compliance programme owned by executive management (12.4.1) and six-monthly scope confirmation (12.5.2.1).
Example. A subscription box company sends card details from its checkout to its processor's API; the processor obtains authorisation over the brand network and settles funds to the company's acquiring account. The processor validates as a service provider for that platform. The company's own scope still covers its checkout page and anything that could alter the data before it leaves, and its SAQ eligibility depends on how that hand-off is built.
Limits. A processor is not the acquirer: the acquirer is the brand-recognised institution that holds the merchant relationship, the processor is a company engaged to do the transaction handling, and the two may or may not be the same organisation. The processor's attestation covers the processor's service, not the merchant's environment, so using a compliant processor does not make the merchant compliant. Nor does it remove the merchant from PCI DSS; it can reduce what the merchant must validate, subject to the SAQ eligibility criteria. A processor is not automatically a token service provider or a P2PE solution provider; those are separate roles that a processor may or may not also fill.