PCI DSS Certification: There Is No Certificate, So What Do You Get?

PCI DSS certification does not exist as a certificate. The PCI Security Standards Council (PCI SSC) writes the Payment Card Industry Data Security Standard and qualifies the assessors who test it, but it does not certify merchants or service providers, keep a register of compliant businesses or issue certificates. When an acquirer, customer or tender asks for “PCI certification”, what they need is evidence of validated compliance: a signed Attestation of Compliance (AOC), backed by a Self-Assessment Questionnaire (SAQ) or a Report on Compliance (ROC), against PCI DSS v4.0.1.

This guide, from Sovereign Secure, a PCI SSC-approved Qualified Security Assessor (QSA) company, explains what to ask for, what to hand over and why a “PCI certificate” on its own is not the document that counts.

Is there a PCI DSS certificate?

No. There is no PCI DSS certificate issued by the PCI SSC, the card brands or any government body. The confusion is understandable: the PCI SSC publishes listings, but of assessors and approved products, not of businesses that take card payments.

If a contract or tender asks for a PCI certificate, send your current AOC. That is what an informed buyer expects to receive.

What is the difference between PCI certification and PCI compliance?

PCI compliance is a continuous state: every applicable PCI DSS requirement is in place and working. Validation, which most people call certification, is the annual act of proving it, through an SAQ or ROC and a signed AOC.

The difference matters most when something goes wrong. An AOC records the position on the day it was signed. If card data is later compromised, the investigation looks at whether controls were operating at the time of the breach, not whether you held a current AOC. Treat the AOC as the output of a year-round programme, not as the goal.

What is an Attestation of Compliance?

An Attestation of Compliance is the PCI SSC’s official form for declaring your PCI DSS status. There is an AOC for each SAQ and for ROCs, with separate service provider versions for SAQ D and the ROC, all published in the PCI SSC document library.

The AOC records who you are, how you take payments, what was assessed and which validation route you used. It then states one of three results:

• Compliant: every applicable requirement is in place.
• Non-compliant: one or more requirements are not in place, with an action plan and target dates. Our guide to common PCI audit failures shows where assessments most often fall short.
• Compliant but with legal exception: a requirement cannot be met because a law or regulation prevents it.

Who signs the AOC?

The AOC is signed by your organisation, not issued to it. That is the clearest sign that it is not a certificate.

Because a senior officer signs on behalf of the business, the AOC is a commitment, not a formality. Make sure the person signing understands what has been validated.

ROC or SAQ: what sits behind the AOC?

Every AOC summarises one of two documents. A PCI ROC is the detailed record of an assessor testing every applicable requirement, required each year for Level 1 merchants and service providers. An SAQ is a self-assessment for eligible merchants and smaller service providers, and which SAQ you use depends on how you take payments. The standard is the same either way; what changes is who validates it, how deeply it is tested and, for the shorter SAQs, how many requirements apply to your set-up. Our guide to PCI compliance levels explains which route applies at each level.

Who issues PCI certification?

Nobody issues a certificate, but several parties have a role in validation, and knowing who does what tells you who to ask.

Service providers have a second audience: customers ask for your AOC each year because Requirement 12.8.4 obliges them to monitor their providers’ compliance status. Our page on PCI compliance for service providers explains what they look for.

How long does PCI certification last?

PCI DSS validation lasts a year. Card brand rules require annual validation, so acquirers and customers treat an AOC as current for 12 months from the date it was signed. Some obligations run on shorter cycles in between.

A significant change, such as a new payment channel or a platform migration, brings work forward: PCI DSS requires scope to be reconfirmed and scans and penetration tests repeated after significant change, and your acquirer may ask you to revalidate early.

Why do some companies issue “PCI certificates”?

Some scanning providers, compliance portals and assessors issue their own certificate, badge or seal after an SAQ, a scan or an assessment. These are the provider’s own documents, not PCI SSC documents. They can be a handy summary, but they are only as good as the AOC behind them.

When someone shows you a PCI certificate, for example a supplier you are about to hand card data to, ask for the AOC and check four things:

• The entity. The AOC names the same legal entity you are contracting with.
• The date. It was signed within the last 12 months.
• The scope. It covers the services you buy. A service provider AOC lists the services assessed and any that were not.
• The assessor. Where a QSA signed it, the company appears on the PCI SSC list. Our PCI QSA page explains how to check.

The same logic applies to your payment provider. Its AOC covers its own systems, not yours, so you still validate the part of the payment process you control.

Is “PCI accreditation” the same as certification?

Not quite. Accreditation, or more precisely qualification, is something the PCI SSC grants to the organisations that assess or scan: QSA companies, Qualified PIN Assessors (QPAs), Card Production Security Assessors (CPSAs) and Approved Scanning Vendors (ASVs), among others. You can check any of them on the PCI SSC’s Qualified Security Assessor list and the related listings. Merchants and service providers are validated, not accredited.

Individuals can also hold PCI SSC qualifications, such as PCI Professional (PCIP) or ISA; our guide to PCI DSS training explains what each one covers and where to check how much PCI training costs.

How do you get PCI DSS certification?

You validate, rather than certify. In outline: confirm your level and validation route with your acquirer, define and reduce your scope, close the gaps, then complete the right SAQ or have a QSA carry out a ROC, and sign the AOC. Our guide to how to become PCI compliant sets out the eight steps in full.

If your acquirer or customers need a ROC or a QSA-validated SAQ, our PCI compliance audit service delivers it, from scoping to the signed AOC. What it costs depends on your scope, and our guide to PCI compliance cost explains the drivers.

Why Sovereign Secure

• A PCI SSC-approved assessor. Sovereign Secure Ltd (Companies House 08334453, incorporated 2012, Accrington, Lancashire) is a Qualified Security Assessor (QSA) company, Qualified PIN Assessor (QPA), Card Production Security Assessor (CPSA), P2PE Assessor and 3DS Assessor.
• Part of the assessor community. We are a member of the PCI SSC Global Executive Assessor Roundtable (GEAR) for 2026-2028.
• Straight answers on validation. We will tell you which document your acquirer or customer actually needs, and we never present a certificate as a substitute for the AOC.
• Security we practise. We are ISO 27001 certified and also provide penetration testing, with quarterly external scans delivered through our PCI SSC Approved Scanning Vendor partner.

Find out exactly what you need to submit

For a quick first answer, our free PCI compliance check points you to the SAQ your set-up is likely to need. Then tell us how you take card payments and who is asking for proof of compliance. We will confirm your validation route, whether that is an SAQ, a QSA-validated SAQ or a ROC, and send a fixed quote. Contact our PCI team or call +44 161 523 5276.