The Attestation of Compliance is the document that most organizations, clients, and partners actually encounter when discussing PCI DSS compliance — not the full ROC or completed SAQ, but the one-to-two page attestation that summarizes the compliance finding. Understanding what the AoC represents, what it does not represent, and how to use it appropriately is essential for any organization in the PCI DSS ecosystem.
What the AoC Actually Is
The AoC is a short standardized form produced by the PCI SSC that summarizes the compliance assessment outcome. It contains: the organization's name and the assessed service or merchant environment, the assessment type (ROC or SAQ), the assessment date and period, the compliance status (compliant / compliant with requirements identified for remediation), the scope of the assessment (brief CDE description), the QSA Company and lead assessor's name and signature (for ROC-based AoCs), and the organization's senior management signature.
| KEY IDEA | The AoC is not the same as the compliance report — it is a signed summary of the compliance report. When a client asks "Do you have PCI DSS compliance?" and you provide an AoC, you are providing them with the attestation of your compliance status, not the full evidence of how your controls were tested. This is appropriate for most client relationships — the full ROC should only be shared under NDA when genuinely required. |
AoC Types — Merchant vs. Service Provider
| AoC Type | Who Uses It | Key Contents | Where Submitted |
|---|---|---|---|
| Merchant AoC (from SAQ) | Level 2–4 merchants | SAQ type completed, compliance status, merchant signature, no QSA signature | Acquiring bank annually |
| Service Provider AoC (from SAQ D-SP) | Level 2 service providers | SAQ D-SP completion, compliance status, SP management signature | Acquiring bank / card network |
| Merchant AoC (from ROC) | Level 1 merchants | Assessment period, scope, QSA signature + company, management signature, compliance status | Acquiring bank / card network |
| Service Provider AoC (from ROC) | Level 1 service providers | As above; listed on Visa/MC service provider compliance lists | Card network programs, customers |
Signing the AoC — Who Must Sign
For the organization, the AoC must be signed by a senior officer — typically the Chief Information Security Officer, Chief Technology Officer, Chief Compliance Officer, or equivalent C-level executive. The signatory is attesting that the information in the assessment is accurate and that the organization has implemented PCI DSS controls. This is a legal attestation with personal accountability.
| IMPORTANT | The executive signature on an AoC is not a formality. The signatory is personally attesting that the compliance information is accurate and that the described controls are actually in place. Signing an AoC that does not accurately reflect the organization's security controls — particularly in the event of a subsequent breach — can expose the individual signatory to personal liability. This is why internal readiness review before signing matters. |
The AoC Validity Period
An AoC is valid for 12 months from the end of the assessment period. The assessment period end date (for ROC-based assessments) is the date fieldwork concluded and the compliance determination was made. Acquirers and card networks track AoC expiration and will contact organizations approaching expiration.
Sharing the AoC With Clients and Partners
The standard practice for sharing PCI DSS compliance evidence is to share the AoC — never the full ROC or SAQ. The AoC contains sufficient information for a client to: confirm your compliance status, verify the assessment type (SAQ or ROC), confirm the assessment period is current (not expired), and identify the QSA Company that performed the assessment.
Service Provider Compliance Registries
Visa and Mastercard maintain public registries of compliant service providers. Visa's Global Registry of Service Providers lists all Level 1 service providers with current AoCs. If your organization is a Level 1 service provider, being listed on these registries is a significant trust signal to enterprise clients and partners — and listing requires submitting your AoC to the card networks through your acquirer.
| Indonesian PSPs and payment gateways that seek to expand internationally increasingly need to be on the Visa Global Registry and Mastercard SDP (Site Data Protection) compliant service provider list. This requires a Level 1 ROC (not SAQ D-SP) assessment and submission to the card networks through your principal member bank. Bitlion assists Indonesian service providers with the card network registration process as part of the compliance program. |