Worldpay PCI Compliance and Safer Payments: What Worldpay Merchants Must Do

Worldpay PCI compliance means meeting PCI DSS v4.0.1 for the way you take card payments and proving it to Worldpay once a year. For most merchants that proof is a Self-Assessment Questionnaire (SAQ) and a signed Attestation of Compliance (AOC), completed in Worldpay’s SaferPayments portal. Worldpay processes your payments and runs the programme, but the questionnaire covers your business, and you are the one who signs it.

Sovereign Secure is not affiliated with, endorsed by or a partner of Worldpay. We are an independent PCI SSC-approved Qualified Security Assessor (QSA) company. Details of Worldpay’s programme below come from its public SaferPayments page, checked on 13 October 2026; your merchant agreement, Worldpay’s current terms and the portal itself take precedence if anything has changed.

What is Worldpay Safer Payments?

SaferPayments (often searched as “Worldpay Safer Payments”) is Worldpay’s PCI DSS compliance programme. It gives merchants a web-based portal for confirming compliance each year, with support by telephone, email and chat. Worldpay also offers SaferPayments Managed, which adds compliance reporting over the phone, dedicated agents and security tools.

The fine waiver applies only once you have confirmed compliance through the programme, and Worldpay lists conditions: telling Worldpay in writing within seven working days of discovering a data compromise, keeping records, logs and electronic evidence, cooperating with Worldpay and the card schemes in any investigation, and having answered the online questionnaire honestly and in good faith. That last condition is why a carelessly accepted SAQ is a risk, not a shortcut. Read Worldpay’s current terms rather than relying on this summary.

How does Worldpay PCI compliance work, step by step?

The SaferPayments route to Worldpay PCI DSS compliance, as Worldpay describes it, is short: log in to the portal, follow the steps to confirm your compliance (or, if you are already compliant through another QSA, upload your certificate, which in PCI DSS terms is your Attestation of Compliance), and repeat every year. Worldpay says it can take as little as 30 minutes; that is realistic for one simple channel, less so if you take payments several ways. In practice it breaks down into five steps:

1. Describe how you take payments. Card machines, online checkout, phone orders, and anything else. Include every channel, not just the ones run through Worldpay.
2. Confirm your SAQ. The portal suggests one from your answers. Check its eligibility criteria before you accept it; our free PCI compliance check gives you an independent second view.
3. Answer the questions honestly, with evidence behind every “yes”.
4. Add ASV scan results if your SAQ requires quarterly external scans.
5. Attest. An officer of your business confirms the answers and signs the Attestation of Compliance.

If you are a larger merchant, your validation route may differ. Merchants with over 6 million Visa or Mastercard transactions a year are Level 1 and need a Report on Compliance rather than an SAQ, normally from a QSA (Visa and Mastercard also allow certain internal routes); our guide to PCI compliance UK explains the levels. Ask Worldpay how it wants your AOC submitted.

Which SAQ do Worldpay merchants complete?

There is no Worldpay-specific questionnaire. Worldpay merchants complete the same PCI SSC SAQs as everyone else, chosen by how card data moves through the business. Common Worldpay set-ups usually map like this:

Our guide to which PCI SAQ you need explains each one’s eligibility criteria, and the questionnaires themselves are free in the PCI SSC SAQ library. If you take phone orders, our guide to taking card payments over the phone compares virtual terminals, keyed card machines and payment links.

A QSA’s caution on pre-filled answers. Pre-population is useful, but it can only reflect the Worldpay products on your account. It cannot know about a checkout plug-in your web developer added, a second payment provider, phone orders taken another way or card numbers sitting in a shared mailbox. Read each pre-filled answer against what actually happens in your business, because the attestation is yours, not Worldpay’s.

Do Worldpay merchants need ASV scans?

Only if your SAQ requires them. Look for Requirement 11.3.2 in your questionnaire: if it is there, you need an external vulnerability scan by a PCI SSC Approved Scanning Vendor (ASV) at least once every three months, and each one must pass. Under PCI DSS v4.0.1 that covers SAQ A (for the website that sends customers to the payment page), SAQ B-IP (card machines that connect over the internet), and SAQ C, A-EP and D. SAQ B and SAQ C-VT do not include it. Worldpay says SaferPayments can schedule these scans where they apply. If a scan fails, the fix is yours: patch, reconfigure or remove the flagged service, then rescan. If you prefer an independent route, our PCI ASV scans are delivered through our PCI SSC Approved Scanning Vendor partner.

What does Worldpay handle, and what do you own?

Worldpay is responsible for card data once it reaches Worldpay’s systems. You are responsible for everything before that point and for the accuracy of your attestation.

Does Worldpay make me PCI compliant?

No. Using a PCI DSS compliant acquirer reduces the work, especially if you use Worldpay-hosted payment pages or standalone terminals, but it does not transfer your obligations. The security tools in SaferPayments Managed can help you meet some requirements; they do not validate you. If card data is stolen from your website, your staff or your till, the merchant agreement holds you responsible.

What happens at renewal?

You revalidate every year. SaferPayments sends periodic email reminders, and SaferPayments Managed contacts you before your reporting deadline. Treat renewal as a fresh check rather than a repeat of last year’s answers:

• Has anything changed? A new website, checkout plug-in, phone ordering, till system or payment provider can change your SAQ.
• SAQ A merchants: since the PCI SSC revised SAQ A in January 2025, you must confirm your site is not susceptible to attacks from scripts that could affect your e-commerce systems. Our guide to SAQ A vs SAQ A-EP explains what that means in practice.
• Are your scans current? Every quarter in the year should have a passing scan if your SAQ requires them.
• Are other providers’ AOCs in date? Check them every year.

If you miss the deadline, Worldpay’s page says a monthly non-compliance fee applies until you confirm compliance; our guide to the PCI non-compliance fee explains how these charges work and how to stop them.

When should a Worldpay merchant call a QSA?

Most small Worldpay merchants with one simple channel can complete SaferPayments themselves. Independent help is worth it when:

• you take payments in more than one way and are unsure which SAQ, or how many, apply;
• the portal suggests SAQ D, or you cannot meet the criteria for a shorter SAQ;
• your checkout sits between SAQ A and SAQ A-EP;
• Worldpay asks for a QSA-validated SAQ or a Report on Compliance;
• you store card data, or have found card numbers in email, notes or recordings;
• you have had, or suspect, a breach.

Our PCI DSS consultancy covers SAQ selection, gap analysis and evidence review, and our PCI compliance audit covers QSA-validated SAQs and Reports on Compliance.

Why Sovereign Secure

Sovereign Secure Ltd (Companies House 08334453, incorporated 2012) is headquartered in Accrington, Lancashire. The PCI Security Standards Council has approved us as a Qualified Security Assessor (QSA) company, a Qualified PIN Assessor (QPA) and a Card Production Security Assessor (CPSA), and we are a member of its Global Executive Assessor Roundtable (GEAR) for 2026 to 2028. We are independent of every acquirer, including Worldpay. If you use us for both advice and assessment, we will explain how the two are kept apart under the PCI SSC’s independence requirements for QSA companies.

Next step

Unsure which SAQ fits your Worldpay set-up, or asked for something the portal cannot give you? Tell us how you take payments and we will confirm your validation route and send a fixed quote. Contact our PCI team or call +44 161 523 5276.