What Are the Service Provider Levels

Alastair Stewart
|
Senior Consultant at URM
|
PUBLISHED on
5 Aug
2022

In this blog, we turn our attention to service providers.  The PCI Security Standards Council defines a service provider a ‘business entity that is not a payment brand, directly involved in the processing, storage, or transmission of cardholder data.  This also includes companies that provide services that control or could impact the security of cardholder data’.  So yes, a payment processor is a service provider!  Other examples include managed service providers (MSPs) that provide managed network devices (firewalls, IDS), as well as any organisation that processes payments on behalf of others, for example, organisations offering fundraising services.

It’s important to note that a merchant that accepts payment cards as payment for goods and/or services can also be a service provider if the goods and/or services sold result in the storing, processing or transmitting of cardholder data (CHD) on behalf of other merchants or service providers.  For example, an Internet service provider (ISP) is a merchant that accepts payments for the provision of Internet access i.e., its own services, but may also be considered a service provider if it provides hosting services to merchants processing their own payments.

Service providers, on the other hand, don’t always know that they are service providers and consequently, are not aware of their responsibilities.  As we said above, a service provider is a business entity that is not a payment brand, directly involved in the processing, storing or transmitting of CHD on behalf of another entity.

The processes involved in the validation of compliance for service providers vary according to payment card brand.  Validation and reporting requirements for service providers are defined according to the service provider level (i.e,. the transaction volume and/or type of service provider).

Visa, Mastercard, American Express, UnionPay and Discover categorise service providers according to these criteria.  Additionally, these same brands have two or more distinct service provider levels that are defined by transaction volume.  JCB does not categorise service providers according to transaction volume.

In general, there are 2 ways in which a service provider can validate its PCI compliance:

If a service provider processes, stores and/or transmits transactions for JCB, or if the service provider processes, stores and/or transmits more than 300,000 Visa, Mastercard, American Express, UnionPay or Discover transactions, it is considered a Level 1 service provider.  These Level 1 service providers must obtain an annual RoC, prepared by a QSA, and undergo quarterly vulnerability scanning by an ASV.

If the service provider processes, stores and/or transmits fewer than 300,000 Visa, Mastercard, American Express, UnionPay or Discover transactions, it is considered a Level 2 service provider.  These service providers must validate their PCI compliance by preparing SAQ D (variant specific to service providers) and undergo quarterly vulnerability scans by an ASV.

So, hopefully, that has provided some much-needed clarity.  The key point is to understand what you are i.e., a merchant or service provider, and then your transaction levels per brand.  It is important that you don’t just look at the volume of transactions you are doing today.  What are your growth plans?  Do you expect to fall into the next bracket next year?  If yes, focus your compliance programme on the next level up.

Alastair Stewart
Senior Consultant at URM
Alastair is one of the most experienced and proficient Payment Card Industry Qualified Security Assessors (PCI QSAs) in the UK. He has completed in excess of one hundred successful reports on compliance (RoCs) against different PCI DSS versions along with supporting the completion of self-assessment questionnaires (SAQs).
Read more

Are you looking for help preparing for a PCI DSS assessment?

As a PCI QSA, URM can assist you with a range of services, including conducting gap analyses, helping you reduce your CDE scope and conducting penetration tests.
Thumbnail of the Blog Illustration
Information Security
Published on
13/6/2022
PCI DSS v4 – Changes at a Glance

After several years wait, and to surprisingly little fanfare, the PCI SSC released the new version of the PCI Data Security Standard (DSS).

Read more
Thumbnail of the Blog Illustration
Information Security
Published on
5/8/2022
PCI DSS Reduction and Assessment

The Payment Card Industry Security Standards Council (PCI SSC) defines scoping as “the process of identifying all system components....

Read more
Thumbnail of the Blog Illustration
Information Security
Published on
15/2/2023
PCI DSS v4.0 and Multi-Factor Authentication

After the recent changes to PCI DSS v4.0 we're examining factors behind the greater utilisation of MFA, and what the key changes are in requirements.

Read more
We cannot thank URM enough for their help in ensuring our business is GDPR compliant. Both the gap analysis conducted and the in-depth assistance with the ROPA were made much easier and understandable with URM’s help. I would like to give particular thanks to URM's Consultant for providing us with the best guidance and making a famously complex topic comprehensive, and to our Account Manager for helping make sure all our needs were covered.
contact US

Let us help you

Let us help you in your compliance journey by completing the form and letting us know how we can best support you.