Connect NMI to Compliance Assessment Tool

For ISOs and resellers on the NMI gateway. Connect your NMI Partner Portal once, and every merchant you choose gets a PCI DSS self-assessment under your brand, with their payment methods already described from their NMI activity. Your merchants never see NMI or a key.

What you need

• An NMI Partner Portal login with permission to create security keys.
• A Compliance Assessment Tool partner account. A free sandbox is issued the same day; connect an NMI sandbox to it first if you like.
• About ten minutes.

Step 1: create a key in NMI

1. Sign in to the NMI Partner Portal.
2. Go to Settings → Security Keys and add a new key.
3. Name it Compliance Assessment Tool, choose your username, and select the v4 API permission.
4. Create it and copy the key. Keep the tab open until step 2 is done.

Step 2: connect it in Compliance Assessment Tool

1. Sign in at banks.complianceassessmenttool.com/login and open Your portfolio.
2. In the NMI gateway card, paste the key and choose Production (or Sandbox for an NMI sandbox key). If you use a branded gateway domain, enter it; otherwise leave it blank.
3. Choose your options: describe payment methods from NMI activity (recommended), add newly boarded merchants every day, and whether those new merchants are emailed automatically.
4. Click Connect NMI. We check the key with one read of your merchant list.

Step 3: import your merchants and invite them

1. Click Show my NMI merchants. Merchants already in your Compliance Assessment Tool book (same NMI ID or email) are marked and skipped.
2. Click Select all ready, or pick merchants individually.
3. Tick Email each one your branded PCI invite and click Import.

Each merchant gets an email under your brand with a personal link. They confirm the payment methods we drafted, answer plain-English questions (one SAQ per payment method), sign, and receive the official PCI SSC SAQ and Attestation of Compliance. You follow progress in your portfolio, with renewal dates and a CSV export, and signed webhooks can keep your own systems in sync.

How NMI activity becomes payment methods

What NMI shows	Payment method we draft
Transactions sent by software (API)	Online payments. The merchant is asked whether the card boxes come from NMI (hosted fields or page) or their own form, which decides between SAQ A and SAQ A-EP.
QuickClick	NMI QuickClick payment links or buttons
Virtual Terminal	Phone and mail orders keyed into NMI's Virtual Terminal
Swiped, chip or tap entry, or card-reader devices	In-person card payments: one payment method for all readers on the account, however many there are. The merchant is asked which reader model is used.
Mobile, or Tap to Pay on a phone	Mobile payments
Recurring billing	Recurring billing from stored cards (folded into online payments when the merchant also sells online)
Batch upload or accounting-software plug-in	Batch uploads

The merchant can edit, remove or add payment methods before answering. A merchant with no recent card activity simply describes how they take payments.

What we read, and what we never do

• Read only: your merchant list, each merchant's processor details, and a sample of recent transactions (how each payment was taken, not card numbers).
• Never: run or refund transactions, change merchant settings, board merchants, or contact your merchants unless you choose to send invites.
• The key is stored encrypted, never shown again, only sent to the NMI gateway host you chose, and deleted when you click Disconnect. You can also delete it in the NMI Partner Portal at any time.

For developers

Everything in the portal card is also in the REST API, with your partner API key: POST /v1/integrations/nmi/connect, GET /v1/integrations/nmi/merchants and POST /v1/integrations/nmi/import. See the integration docs and the OpenAPI specification.

Common questions

Do my merchants need an NMI login or key?

No. You connect once, as the ISO. Your merchants get your branded invite email and complete their questionnaire in the browser; they never see NMI or a credential.

What does Compliance Assessment Tool read from NMI?

Only reports: your merchant list (business name, contact email, address, status), each merchant's processor details (such as the account classification and MCC), and a sample of recent transactions to see how each merchant takes cards (online, virtual terminal, card reader, mobile, recurring). We never run transactions, change settings or board merchants.

How is the key protected?

It is stored encrypted, readable only by the service that calls NMI, never shown again in the portal or the API, and deleted when you disconnect. It is only ever sent to the NMI gateway host you chose. You can also delete the key in your NMI Partner Portal at any time.

Does it pick the SAQ from NMI data?

It drafts the payment methods, one per setup, and the merchant confirms them. Some answers are not visible from the gateway, such as whether an online checkout uses NMI's hosted payment fields or the merchant's own form, or which card reader model is used, so the merchant is asked those in plain English. The acquirer decides which SAQ applies.

What happens when I board a new merchant on NMI?

If you leave the daily sync on, merchants boarded on NMI after you connect are added automatically, with their payment methods drafted. You choose whether they are also emailed the invite automatically.

What does it cost?

The connection is free. Partner pricing is $25 per completed merchant assessment, and sandbox accounts are free with watermarked test documents.

Sources

• NMI: Third Party Integrations
• NMI: Account Management (v4 API key from the Partner Portal, Settings → Security Keys)
• NMI: Get Merchant List
• NMI: Get Merchant Processors and Value Added Services Details
• NMI: Get Transaction Data
• PCI SSC: Document Library (SAQs and AoCs)

Compliance Assessment Tool is an independent product and is not affiliated with or endorsed by NMI. NMI is a trademark of its owner. This page is general information, not legal advice; card-brand rules and your sponsor or acquirer agreements set each merchant's validation requirements, and the acquirer decides which SAQ applies. Compliance Assessment Tool facilitates merchant PCI DSS self-assessment under PCI DSS v4.0.1. It is not a Qualified Security Assessor and does not certify or guarantee compliance.