Home › Merchant PCI program for sponsor banks

A merchant PCI program for sponsor banks: oversight across ISO and PayFac portfolios

The ISOs and payment facilitators your bank sponsors board merchants you may never speak to, yet those merchants' PCI DSS compliance remains the acquirer's responsibility. This page is for the risk, compliance and third-party-risk teams who have to show that the programs under the bank's sponsorship work.

Short answer

Card-brand rules make the acquiring bank responsible for making sure its merchants comply with PCI DSS and validate, including the merchants boarded by the ISOs and payment facilitators it sponsors. Most sponsor banks delegate the day-to-day merchant PCI program to those agents, so oversight depends on consistent evidence: the right Self-Assessment Questionnaire (SAQ) for each way a merchant takes cards, a signed and dated Attestation of Compliance (AoC), renewal tracking, and portfolio reporting that means the same thing from every program.

What the card brands hold acquirers responsible for

Merchant compliance and validation. Visa states that acquirers are responsible for ensuring their merchants and service providers comply with PCI DSS, that merchants validate at the appropriate level, and that the acquirer obtains the validation documentation. Mastercard's Site Data Protection program has merchants submit their PCI validation documents to their acquiring bank, which oversees compliance and reports to Mastercard when required.
Smaller merchants. Mastercard expects acquirers to have a risk management program covering their smaller (Level 3 and Level 4) merchants.
Agents. Visa requires acquirers to register the ISOs and payment facilitators they work with, after their own due diligence, and treats the acquirer as liable for its agents.
Payment facilitators. Visa says acquirers are responsible for the acts of both the PayFac and its sponsored merchants.

The bank can delegate the work, as its sponsorship agreements set out, but not the responsibility.

Where oversight usually breaks down

Every program is different. One ISO emails PDF questionnaires, another uses a vendor portal, a third uses a spreadsheet, and each report is built differently.
"Compliant" means different things. In one report it means a signed AoC; in another it means the merchant was sent an invitation.
The SAQ doesn't match the merchant. A merchant with a counter terminal and an online store has two channels to cover; an attestation describing one of them is incomplete.
Dates drift. Validation is annual, and without expiry tracking a portfolio that was current last year quietly lapses.
Evidence sits with the agent, so the bank has to fetch it when asked.

What good evidence looks like

For each merchant

Each way the merchant takes cards, and the SAQ chosen for each one.
The official PCI SSC SAQ and Attestation of Compliance under PCI DSS v4.0.1, signed by the merchant.
The validation date and the date it expires.

For the portfolio

The same status definitions from every program: invited, started, in progress, completed, expiring, expired.
An export your team can load and compare across programs, on a schedule you set.
A list of exceptions, merchants who have not started or have lapsed, with an owner for each.

Merchant PCI in your third-party risk management

For US banks, the 2023 interagency guidance on third-party relationships from the Federal Reserve, FDIC and OCC describes risk management across a life cycle: planning, due diligence and selection, contract negotiation, ongoing monitoring and termination. It also says not all relationships need the same level or type of oversight. How that applies to your ISO and PayFac relationships is your bank's call, but merchant PCI fits naturally into each stage:

Due diligence: ask each agent how its merchants validate, and review any vendor it uses (Trust Center, security overview, DPA, sub-processors).
Contract: write the reporting format, frequency and status definitions into the sponsorship agreement.
Ongoing monitoring: receive the portfolio export on schedule, follow up on exceptions, and sample merchant documents.

PCI and fraud are separate measures

PCI DSS covers how card data is protected. Fraud and disputes are measured separately, through programs such as the Visa Acquirer Monitoring Program (VAMP), which looks at fraud and disputes across the acquirer's whole portfolio. Both roll up to the bank. Our free VAMP calculator works out the ratio for a merchant or a portfolio CSV. CAT itself does not measure fraud, disputes or VAMP ratios.

How an API-based program supports oversight

Compliance Assessment Tool is an API for PCI compliance. A bank can offer it to merchants under its own brand, and the ISOs and PayFacs it sponsors can run it under theirs.

The right SAQ per payment method: merchants describe how they take payments in plain words, and the SAQ for each payment method is determined automatically, across all nine merchant SAQ types.
Official, signed documents: the merchant reviews every answer, signs digitally and gets the official PCI SSC SAQ and AoC PDFs.
Portfolio visibility: a funnel across the partner's merchants (invited, started, in progress, completed, expiring, expired) with a CSV export, and annual renewal tracking.
Status in your systems: signed webhooks report status changes.
Delivery: REST API, an MCP server for AI agents and bank chatbots, an embeddable white-label iframe, or a platform redirect.

See the PCI compliance API overview, or, if you are evaluating options for an agent program, how to choose a merchant PCI compliance program. New ISOs you sponsor may find the starting an ISO guide useful.

Questions to ask your ISOs and PayFacs

How do your merchants validate, and which tool or vendor runs it?
How is the SAQ chosen for a merchant that takes cards more than one way?
Is the output the official PCI SSC SAQ and AoC, signed by the merchant?
What do "completed" and "in progress" mean in your report?
How do you track expiry, and what happens when a merchant lapses?
For a PayFac: where is your own AoC, and your responsibility matrix for sub-merchants?

See the portfolio view in a sandbox

Free sandbox credentials as soon as you verify your email; sandbox documents are watermarked as test documents. $25 per completed assessment in production.

Get a free sandbox → Read the docs

Also see: PCI compliance for PayFacs · A PCI compliance API for ISOs.

Common questions

Is a sponsor bank responsible for merchant PCI compliance when an ISO boards the merchant?

Under card-brand rules, the acquirer is responsible for making sure its merchants comply with PCI DSS and validate, whoever boarded them. Visa also requires acquirers to register the ISOs and payment facilitators they use, and treats acquirers as responsible for their agents. Banks usually delegate the program itself to the ISO or PayFac in the sponsorship agreement, but the responsibility to the card brands stays with the bank.

What should a sponsor bank ask its ISOs and PayFacs to report?

At a minimum: how many merchants are in the program, how many have validated, how many are in progress or have not started, and how many are expiring or expired, using status definitions that are the same across every program. For each merchant, the SAQ type for each payment method, the signed AoC and its date should be available on request.

How often do merchants re-validate PCI compliance?

Each year for the SAQ and AoC, plus quarterly external vulnerability scans by an Approved Scanning Vendor where the merchant's SAQ requires them. An acquirer may also ask a merchant to re-validate after a significant change in how it takes payments.

Who decides which SAQ a merchant uses?

The acquirer. A tool can determine the likely SAQ for each payment method from how the merchant describes taking cards, but the acquirer sets validation requirements and can accept, reject or override that choice, for example by asking for one combined SAQ or one per payment channel.

Does a PayFac's own PCI DSS validation cover its sub-merchants?

No. A payment facilitator validates its own PCI DSS compliance as a service provider. Its sub-merchants are merchants with their own obligations, and the PayFac monitors their compliance. The PayFac's responsibility matrix shows which PCI DSS requirements it covers for them, which often shortens their SAQ, but does not replace it.

Can a bank run a white-label merchant PCI program itself?

Yes. A bank can offer Compliance Assessment Tool to merchants under its own brand by REST API, MCP, an embeddable iframe or a platform redirect, and see a portfolio funnel and CSV export across its merchants. ISOs and PayFacs it sponsors can run the same program under their brands.

Sources

This page is general information, not legal advice. Card-brand rules and your sponsor or acquirer agreements set your obligations and each merchant's validation requirements; the acquirer decides which SAQ applies. Compliance Assessment Tool facilitates merchant PCI DSS self-assessment under PCI DSS v4.0.1. It is not a Qualified Security Assessor and does not certify or guarantee compliance. Third-party names are trademarks of their owners.