Compliance Assessment ToolChoosing a merchant PCI compliance program for your ISO or PayFac
Every merchant in your portfolio is expected to validate PCI DSS compliance each year. Most small merchants do it with a Self-Assessment Questionnaire (SAQ) and a signed Attestation of Compliance (AoC). The hard part is not the paperwork — it is getting a restaurant owner or a salon to pick the right SAQ and finish it. Here is how to compare your options.
What matters, in order
- Completion. A program only helps for the merchants who finish it. Ask any vendor what share of invited merchants complete, and how long it takes them.
- The right SAQ for every payment method. A merchant with a counter terminal and an online store has two channels to cover. Picking the wrong SAQ means the attestation doesn't match how they really take cards.
- Questions a non-technical owner can answer. "Is your card machine plugged into a phone line or the internet?" gets answered. "Is your POI device PTS-listed?" gets abandoned.
- Official output. The PCI SSC SAQ and AoC, filled in and signed by the merchant — what your acquirer and auditors expect.
- Your brand and your merchant relationship. Does the merchant see you, or the vendor?
- How you integrate. Zero-code invites, a redirect, an embedded white-label experience, or a full API — and how much engineering each needs.
- Portfolio visibility. Who is compliant, in progress or expiring, as a dashboard, an export for your acquirer, and events your systems can consume.
- Renewals. Validation is annual. Does next year start from this year's answers?
- Pricing model. Per completed assessment, per merchant per month, or bundled into a fee charged to merchants — and who carries the cost.
- What else you need bundled. Quarterly ASV scans, breach protection or insurance, a merchant support line. Some programs bundle these; others do one thing and integrate with the rest.
- The vendor's own security. No cardholder data in scope, a published Trust Center, a DPA, and clear sub-processors.
The four ways ISOs run a merchant PCI program
| Send merchants the PCI SSC forms | Managed merchant-compliance program | Build it in-house | API-first, white-label platform | |
|---|---|---|---|---|
| What it is | Email the SAQ PDFs and collect them back | An established provider runs a compliance portal for your portfolio — for example SecurityMetrics (Acquirer PCI Program) or VikingCloud (merchant partnership programs) | Your team builds SAQ selection, questionnaires and tracking | A compliance engine you embed or integrate under your own brand — for example Compliance Assessment Tool |
| Merchant experience | The official form itself — roughly 30 to 120 pages, depending on the SAQ | Depends on the provider's portal | Whatever you build | Plain-English questions inside your product or a branded link |
| Your branding | Yours (it's just email) | Varies by provider | Yours | Yours |
| Integration | None | Usually the provider's portal plus reporting | All of it | REST API, iframe, redirect or zero-code invites |
| Often bundled | Nothing | Commonly ASV scanning, merchant support and incident response | Only what you build | Focused on SAQ + AoC; pair with an ASV vendor if scans are required |
| Time to launch | Immediate | A contract and onboarding cycle | Months | Days to weeks; sandbox the same day |
| Best when… | A handful of merchants | You want one provider to bundle scanning and support | Compliance is core to your product | You want merchants to finish, under your brand, with an API |
Provider examples are from each company's own website as of October 2026; capabilities vary by program, so confirm details with each vendor.
Questions to ask any vendor
- What percentage of invited merchants complete their SAQ, and in how long?
- How do you decide which SAQ a merchant needs — and what happens when they take cards more than one way?
- Show me the exact questions a merchant with a counter terminal sees. Would a restaurant owner understand them?
- Is the output the official PCI SSC SAQ and AoC, signed by the merchant?
- Whose brand does the merchant see — in the questions, the emails and the documents?
- How do we integrate, how long does it take, and can our engineers try it today?
- How do we see portfolio status, export it for our acquirer, and get notified when a merchant becomes compliant or is about to expire?
- How does annual renewal work?
- What does it cost, and is that charged to us or to the merchant?
- Do you touch cardholder data? Where is your Trust Center, DPA and sub-processor list?
Where Compliance Assessment Tool fits
CAT is the API-first option. A merchant describes how they take cards in their own words; CAT asks plain-English questions until it has what it needs, determines the right SAQ for each payment method — all nine merchant SAQs under PCI DSS v4.0.1 — walks them through it one plain-English question per requirement, and produces the official, signed SAQ and AoC. You launch with zero-code invites, a redirect, an embedded white-label iframe, the REST API or an MCP server, and you get a portfolio API, CSV export and signed webhooks. Pricing is $25 per completed assessment.
When CAT is not the right fit: if you want a single provider to bundle quarterly ASV scans, breach insurance and a merchant call center under one contract, a managed program is likely a better match — or pair CAT with a scanning vendor.
See it with your own merchants' descriptions
Free sandbox credentials as soon as you verify your email — same API and engine as production.
Get a sandbox → How it worksCommon questions
What should an ISO look for in a merchant PCI compliance vendor?
Above all, whether merchants actually finish: a program only reduces risk and non-compliance for the merchants who complete it. Then: correct SAQ selection for every way each merchant takes cards, plain-language questions, the official PCI SSC SAQ and Attestation of Compliance as output, your branding, the integration options your team can support, portfolio visibility and exports, annual renewals, and a pricing model that fits how you bill your merchants.
Do ISOs have to manage merchant PCI compliance?
Acquirers are responsible to the card brands for their merchants' PCI DSS compliance, and they typically pass that responsibility to the ISOs and PayFacs that board merchants for them. Your acquirer agreement sets exactly what you must track and report.
Should we build merchant PCI compliance in-house?
It is possible but substantial: nine SAQ types, eligibility logic for each, the official form layouts, annual updates when PCI SSC revises the standard, and a merchant-facing experience simple enough that small businesses finish it. Most ISOs buy rather than build.
Does Compliance Assessment Tool provide ASV scanning or breach insurance?
No. CAT handles SAQ selection, the plain-English assessment, and the signed SAQ and AoC. If your merchants need quarterly external vulnerability scans from an Approved Scanning Vendor, or you want breach-protection coverage, pair CAT with a scanning vendor or choose a program that bundles them.
Compliance Assessment Tool facilitates merchant PCI DSS self-assessment. It is not a Qualified Security Assessor and does not certify compliance; acquirers set each merchant's validation requirements. Third-party names are trademarks of their owners and are used only to describe their published offerings.