Clarify payment-provider responsibilities

Editorial update: 21 September 2026. Introductory learning material.

Before using a payment service, establish the scope of its service and your organization’s responsibilities. A padlock or TLS certificate alone does not demonstrate PCI DSS compliance.

• Ask the provider for relevant validation evidence and its covered services.
• Confirm how payment details, tokens and recurring payments are handled.
• Agree access, authentication, incident contacts and notification responsibilities.
• Document who monitors transactions and investigates discrepancies.
• Confirm the merchant validation process with the acquiring bank or payment brand as applicable.

Activity: Prepare a responsibility checklist for your existing provider and identify unanswered questions.

Reference: PCI SSC merchant payment-processing resources. Check the source and your system provider’s current instructions before implementation.