Skip to content
Sovereign SecureSovereign Secure

PCI Services

PCI Compliance Services UK

PCI compliance services help businesses that take, process or store card payments meet the Payment Card Industry Data Security Standard (PCI DSS) and prove it to their acquirer. Sovereign Secure is a PCI SSC-approved QSA, QPA and CPSA company, so one team covers audits, consultancy, penetration testing, ASV scans, PCI PIN and card production.

Request a quoteFree PCI compliance check

Prefer to talk? Call +44 161 523 5276

  • Qualified Security Assessor
  • Qualified PIN Assessor
  • Card Production Security Assessor

The short answer

PCI compliance services help businesses that take card payments meet PCI DSS and prove it to their acquirer. Most merchants need SAQ support; Level 1 merchants and service providers need a QSA audit and Report on Compliance; many also need penetration testing and quarterly ASV scans. Sovereign Secure holds PCI SSC QSA, QPA, CPSA, P2PE Assessor and 3DS Assessor approvals.

Trusted by banks, payment providers and global brands

  • Accor
  • Fiserv
  • JCPenney
  • Ticketmaster
  • Nitecrest
  • Cashplus
  • Ahli United Bank
  • Kuwait Finance House
  • AYA Bank
  • Bank of Palestine
  • Liquid Pay
  • DataFlow Group
  • Wilmington
  • The Growth Company
  • Wahyukart

Verified by the PCI Security Standards Council

Our PCI SSC approvals and GEAR membership

A trusted partner for all your PCI compliance requirements, from strategy and programme management to gap analysis, assessment, training and awareness. Sovereign Secure Ltd (company no. 08334453, est. 2012, Accrington, Lancashire, UK) is a PCI SSC-approved Qualified Security Assessor (QSA), Qualified PIN Assessor (QPA), Card Production Security Assessor (CPSA), P2PE Assessor (Europe and USA) and 3DS Assessor company, a member of the PCI SSC Global Executive Assessor Roundtable 2026 to 2028, an IASME-licensed certification body for Cyber Essentials, IASME Cyber Assurance and Defence Cyber Certification Levels 0 and 1, and an ISO 27001-certified firm, with offices in Los Angeles, Singapore, Dubai and Dhaka.

Every approval below can be checked on the Council’s own listings, and our guide to the PCI Security Standards Council explains how the PCI standards and assessor programmes fit together.

Core PCI assessments

Assurance across the whole payment chain

We are approved to assess PCI DSS, PCI PIN and PCI Card Production, which means one team, one timeline and no gaps between standards. P2PE assessments and PCI 3DS assessments are listed with our other PCI services below.

QSA

PCI DSS Assessments

We are a Qualified Security Assessor (QSA), approved by the PCI Security Standards Council to validate organisations’ adherence to the Payment Card Industry Data Security Standard. PCI DSS applies to any organisation that accepts, processes, stores or transmits cardholder data, and includes around 250 detailed requirements. We help you navigate them, reduce cost and business impact, and keep your company’s and customers’ information safe.

PCI DSS assessmentsGet a quote

Services

  • Introductory awareness sessions
  • Programme management and strategy
  • Scoping definition
  • Gap analysis
  • Network design review
  • Internal scans, and external ASV scans through our PCI SSC Approved Scanning Vendor partner
  • Penetration testing
  • Remediation support
  • Solutions options analysis
  • Report on Compliance (ROC)
  • SAQ support and validation
  • Training and policy development
CPSA

PCI Card Production Audits & Consultancy

We are an approved PCI Card Production Security Assessor, qualified by the PCI Security Standards Council to validate adherence to the PCI Card Production Logical and Physical Security Requirements. Our expertise covers personalisation, manufacturing, PIN distribution, EMV and key management, and mobile provisioning, plus consultancy for vendors building or changing facilities.

Card production auditsGet a quote

Services

  • HR security and screening
  • Visitor handling processes
  • Production process and audit trail
  • Key management
  • Guard responsibilities
  • Security policies and procedures
  • Business continuity and DR
  • Facility build-out consultancy
QPA

PCI PIN Security Audits

We are a Qualified PIN Assessor (QPA), approved by the PCI Security Standards Council. The PCI PIN Security Requirements apply to acquirers and their agents processing PINs for payment card transactions, and to key-injection facilities. We audit and advise on the secure management, processing and transmission of PIN data at ATMs and attended and unattended POS terminals.

PIN security auditsGet a quote

Services

  • PCI PIN assessments incl. Annex A & B
  • Card brand TPA assessments
  • TR-39 audits of ATM operations
  • TR-39 audits for PIN debit POS
  • ISO, ESO and KLD facility audits
  • Key management consultancy

Everything you need to comply

PCI DSS compliance services: consultancy, testing, scanning and costs

Take a single service or the full programme. Our PCI compliance solutions run from a free readiness check and consultancy to penetration testing, ASV scans and cost planning, and each one is run by the same QSA company that will stand behind your assessment.

PCI DSS guides from our assessors

For SAQ choices, scoping and the PCI DSS v4.0.1 changes in more depth, read our PCI compliance blog.

Guides and tools in this section

Scope

Who does PCI DSS apply to?

PCI DSS applies to every organisation that stores, processes or transmits cardholder data, and to any organisation that can affect the security of that data. Size does not decide whether you are in scope: a café taking contactless payments and a global processor both are. It decides how you prove it. If you are new to the standard, our plain-English guide to what PCI DSS is covers the basics.

  • Merchants: retailers, hospitality, e-commerce, charities and public bodies that accept card payments. Most validate with a Self-Assessment Questionnaire; the largest need a Report on Compliance.
  • Service providers: payment gateways, processors, hosting and cloud providers, call centres, managed security providers and SaaS platforms that handle card data for others, or can affect its security. Service provider levels, the ROC and the AOC for Service Providers are covered on our PCI DSS for service providers page.
  • Acquirers, processors and key-injection facilities that handle PINs, which also need PCI PIN security assessments.
  • Card manufacturers, personalisers and provisioning providers, which need PCI card production audits.

Using a payment service provider or a hosted payment page reduces your scope but does not remove it: you stay responsible for the parts of the payment flow you control. In the UK, PCI DSS is a contractual requirement set by your acquirer rather than a law. Our guide to PCI compliance UK explains what that means for you.

PCI DSS v4.0.1

The 12 PCI DSS requirements at a glance

PCI DSS v4.0.1 groups 12 principal requirements under six goals, broken down into around 250 detailed requirements. Version 3.2.1 was retired on 31 March 2024, and the future-dated requirements introduced in v4.0 have been mandatory since 31 March 2025.

GoalRequirementsHow we help
Build and maintain a secure network and systems1. Install and maintain network security controls2. Apply secure configurations to all system componentsNetwork design review and firewall configuration review
Protect account data3. Protect stored account data4. Protect cardholder data with strong cryptography during transmission over open, public networksData-flow mapping, scope reduction and tokenisation options
Maintain a vulnerability management programme5. Protect all systems and networks from malicious software6. Develop and maintain secure systems and softwareSecure SDLC training, payment page script controls and application testing
Implement strong access control measures7. Restrict access to system components and cardholder data by business need to know8. Identify users and authenticate access to system components9. Restrict physical access to cardholder dataAccess, MFA and physical security reviews during gap analysis
Regularly monitor and test networks10. Log and monitor all access to system components and cardholder data11. Test security of systems and networks regularlyPCI DSS penetration testing, segmentation testing and ASV scans
Maintain an information security policy12. Support information security with organisational policies and programmesPolicy writing, targeted risk analyses, incident response and awareness training

For the evidence a QSA expects under each requirement, read our PCI DSS requirements guide or work through our free PCI DSS compliance checklist.

Merchant and service provider levels

PCI DSS compliance levels: how you validate

Your level decides how you prove compliance each year. The card brands set the thresholds and your acquirer confirms your level. Levels 1 and 2 follow Visa and Mastercard rules; the Level 3 and 4 rows are Mastercard’s thresholds, because Visa now publishes three merchant levels and its Level 3 covers fewer than 1 million Visa e-commerce transactions:

LevelAnnual transactionsTypical annual validation
Merchant Level 1Over 6 million transactions a year with one card brand, all channelsROC by a QSA, AOC and quarterly ASV scans
Merchant Level 21 million to 6 million transactions a yearSAQ and AOC, plus ASV scans where your SAQ requires them
Merchant Level 3 (Mastercard)More than 20,000 and up to 1 million e-commerce transactions a year. Visa’s Level 3 is fewer than 1 million Visa e-commerce transactionsSAQ and AOC, plus ASV scans where your SAQ requires them
Merchant Level 4 (Mastercard)All other merchants: 20,000 or fewer e-commerce transactions and up to 1 million in total. Visa no longer publishes a Level 4Set by your acquirer: usually an SAQ
Service provider Level 1Over 300,000 transactions a year, plus every VisaNet processor and several provider types Mastercard places at Level 1ROC by a QSA, AOC for Service Providers and ASV scans
Service provider Level 2Under 300,000 transactions a yearSAQ D for Service Providers, AOC and ASV scans

How to work out your level, what changes after a data compromise and what each level submits are covered in PCI DSS compliance levels. Level 1 merchants and service providers need a QSA assessment and Report on Compliance; our guide to PCI Level 1 explains what that involves.

Where we work

PCI compliance services in London and across the UK

We work with merchants and service providers in London and throughout the UK from our headquarters at 16 Whalley Road, Accrington, Lancashire. Scoping workshops, document review, interviews and configuration evidence can usually be handled remotely, and our assessors come on site where a testing procedure calls for observation. London retailers, fintechs, hospitality groups and contact centres get the same QSA team as clients anywhere else in the UK.

UK merchants validate through their acquirer, and each acquirer runs its own compliance portal, deadlines and fees. Where an acquirer charges a monthly PCI non-compliance fee, it stops only when the acquirer accepts a valid SAQ or AOC and any scans your SAQ requires. Our guide to PCI compliance cost explains what validating involves.

For multi-country estates, our offices in Los Angeles, Singapore, Dubai and Dhaka work alongside the UK team.

Financial services

PCI compliance for banks, processors and fintech

Banks and payment companies rarely need just one PCI standard. An acquirer or processor may need PCI DSS for its card data environment, PCI PIN for its HSMs and key management, and a key injection facility audit for the terminals it deploys. A card bureau needs Card Production and Provisioning, and often PCI DSS as well. Banks and payment firms on the Swift network also face the annual SWIFT CSP assessment and attestation, which shares controls such as patching, MFA and logging with PCI DSS.

Because we are approved as a QSA, QPA and CPSA, we plan these assessments together, reuse evidence where the standards overlap and avoid three separate audit calendars.

Our clients include Fiserv, Cashplus, Ahli United Bank, Kuwait Finance House, AYA Bank, Bank of Palestine and Liquid Pay, and our PCI PIN and card production work has been recommended by First National of Nebraska, Albertsons Companies, Level 10, Bamcard and ICPS.

What our PCI clients say

Trusted by banks, processors and card vendors

Level 10
PCI PIN

Approaching our PCI PIN 3.0 audit at the start of a pandemic was an overwhelming goal filled with uncertainties ranging from, “How could we ensure the safety of our employees & auditors?” to “Could this actually be done remotely?” Our colleagues at Sovereign Secure were true partners in this successful venture. While flexing to the distinct needs of an essential business, like ours, running during a pandemic, they stayed true to the high standards required of a business to ensure the PCI PIN 3.0 certification by the use of extraordinary communication, experienced auditors, and unique documentation delivery avenues. They made what was once thought of as impossible, not only very much possible, but also a pleasurable learning & partnership experience for our payment solutions team.

Courtney StoneVice President, Customer Experience & Strategy, Level 10
Bamcard
PCI CPSA, DSS & PIN

Sovereign Secure provided Payment Card Industry Compliance Services to Bamcard for the following standards: PCI CPSA, PCI DSS and PCI PIN. Even with the global COVID-19 pandemic, they managed to provide the best possible, knowledgeable support during the process of auditing and achieving compliance. The Sovereign Secure assessors were so helpful in these challenging times … with years of Payment Card Industry experience. We would happily recommend them to any company in need of the services mentioned.

Emir HandanExecutive Director, Bamcard
Albertsons Companies
PCI PIN

I highly recommend services of Sovereign Secure through my work with Azie Amini; PCI PIN Security audits. I have known Azie for fifteen years and have nothing but positive things to say, regarding her PCI PIN services both in auditing and as a PIN security instructor. We have used her services for various payment companies that I have been employed by including Albertsons Companies.

Gary ZempichInformation Security Analyst IV, Albertsons Companies

Choosing a provider

How to compare PCI compliance companies

When you compare PCI DSS compliance companies, check five things before you sign: their PCI SSC listing, the programmes they hold, how they keep consulting and assessment apart, who runs testing and ASV scans, and whether the quote is fixed.

What to compareWhat to look forSovereign Secure
PCI SSC listing and regionOnly the PCI SSC’s own list proves QSA status. Check the company is listed for the region where you will be assessed.Listed as a QSA company for Europe, USA, Canada, CEMEA and Asia Pacific. Check the PCI SSC QSA list.
Programmes heldPayment companies often need more than PCI DSS: PIN security, card production, P2PE or 3DS. One company holding each programme means one plan and shared evidence.QSA, QPA, CPSA, P2PE Assessor (Europe and USA) and 3DS Assessor, and a member of the PCI SSC GEAR for 2026 to 2028.
Independence of consulting and assessmentIf the same company helps you remediate and then assesses you, ask how it keeps advisory and assessment work separate, as the PCI SSC expects.Advisory and assessment work kept appropriately separated. See PCI DSS consultancy.
Testing and ASV arrangementsRequirement 11 calls for penetration testing and, for most, quarterly external scans by a PCI SSC Approved Scanning Vendor. Ask who runs each and whether the reports suit your assessor.PCI DSS penetration testing to Requirement 11.4. ASV scans delivered through our PCI SSC Approved Scanning Vendor partner and managed by our QSA team.
Fixed quoteA quote fixed after scoping, listing what is included (on-site days, testing, scans, remediation reviews), is easier to compare than a day rate.A fixed quote after a short scoping call. See what drives the price in PCI compliance cost.

For the questions to ask at each stage, read our guide on how to choose a PCI QSA company.

Partners and accreditations

  • PCI Security Standards Council
  • Cyber Essentials
  • Cyber Essentials Plus
  • MQA International Certification Body
  • Information Commission's Office (ICO)
  • Companies House
  • Dun & Bradstreet
  • Nanitor
  • CyStack
  • Tech Mahindra
  • Singtel
  • Be One Group

FAQ

Frequently asked questions

Can't find your answer? Call us on +44 161 523 5276 or send us a message.

Is Sovereign Secure a QSA?

Yes. Sovereign Secure is a PCI SSC Qualified Security Assessor (QSA) company, and you can check us on the PCI SSC QSA list. Our PCI QSA page explains what a QSA does and what an engagement delivers.

What is the difference between PCI DSS, PCI PIN and PCI Card Production?

PCI DSS protects cardholder data wherever it is stored, processed or transmitted. PCI PIN protects PINs and the cryptographic keys used to protect them. PCI Card Production covers the physical and logical security of facilities that make, personalise and distribute cards. Many payment companies need more than one, and we are approved for all three.

Do I really need PCI compliance?

Yes, if you accept card payments or store, process or transmit card data, or can affect its security. It is not a UK law, but your acquirer requires it under your merchant agreement, and card brand rules and customer contracts require it of service providers. Our guide to PCI compliance in the UK explains who must comply and how.

Which PCI assessment do we need?

That depends on your role in the payment chain and your transaction volumes. Merchants and service providers need PCI DSS; acquirers, processors and key-injection facilities need PCI PIN; card vendors need Card Production. P2PE solution and component providers need a P2PE assessment, and operators of 3DS Servers, Directory Servers and Access Control Servers need a PCI 3DS assessment. Call us and we will confirm on the first call.

Can I do PCI compliance myself, or do I need a PCI compliance company?

Most smaller merchants can complete their own Self-Assessment Questionnaire and sign their own AOC, but Level 1 merchants and service providers need a Report on Compliance from a QSA, and external scans must come from an Approved Scanning Vendor. Our guide to PCI compliance in the UK explains when doing it yourself works and when outside help is worth paying for.

How much do PCI DSS compliance services cost?

It depends on scope: your payment channels, the number of locations and systems, whether you need an SAQ or a ROC, and whether testing and scanning are included. We give you a fixed quote after a short scoping call. See PCI DSS compliance costs for the main cost drivers.

Are you an Approved Scanning Vendor (ASV)?

No. Sovereign Secure is not an ASV. Quarterly external scans are run through our PCI SSC Approved Scanning Vendor partner and managed by our QSA team, including scoping, false-positive disputes and rescans. See PCI ASV scans.

Do you provide PCI DSS penetration testing?

Yes. Where Requirement 11.4 applies, it calls for internal and external penetration testing at least once every 12 months and after any significant change, plus testing of segmentation controls if you use segmentation to reduce scope. We scope the tests to your cardholder data environment; see PCI DSS penetration testing.

Do you offer PCI DSS consultancy as well as audits?

Yes. Our PCI DSS consultancy covers scoping, gap analysis, remediation and SAQ support. Where we consult, we keep advisory and assessment work appropriately separated, as the PCI SSC expects of a QSA company.

What is GEAR?

The Global Executive Assessor Roundtable is the PCI Security Standards Council forum where senior leaders of qualified assessor companies give the Council recommendations and input. Sovereign Secure is a GEAR member for 2026 to 2028, as shown on the PCI SSC GEAR page.

Do you carry out PCI assessments outside the UK?

Yes. Alongside our UK headquarters we have offices in Los Angeles, Singapore, Dubai and Dhaka, and we have delivered PCI assessments for banks, processors and card manufacturers worldwide.

Not sure which PCI service you need yet? Take our free PCI compliance test: 22 questions that point to your likely SAQ and the gaps to fix first. When you are ready, ask us for a quote below.

Free consultation

Start your PCI compliance journey

We aim to reply within one working day, and send a fixed quote once your scope is confirmed.

  • PCI SSC-approved QSA, QPA, CPSA, P2PE and 3DS assessors
  • IASME-licensed Cyber Essentials certification body
  • Clients across the UK, US, Europe, Middle East and Asia since 2012

“We would happily recommend them to any company in need of the services mentioned.”

Emir Handan, Executive Director, Bamcard. Read the full testimonial

Call +44 161 523 5276

Email [email protected]

By sending this form you agree to us contacting you about your enquiry. See our privacy policy.

We aim to reply within one working day. The first consultation is free.