Which payment service providers are PCI DSS and PSD2 compliant?
Which documents prove a provider is PCI DSS and PSD2 compliant, and how to check them before you sign.
Last reviewed: October 2026
A payment service provider is PCI DSS compliant when it holds a current Attestation of Compliance (AOC), and PSD2 compliant when it applies strong customer authentication (SCA) to in-scope payments. Since 31 December 2024, PCI DSS v4.0.1 has been the only active version of the standard.
Key takeaways
- PCI DSS is a card scheme requirement that acquirers and card brands enforce by contract. It is not law.
- PSD2 is a European regulation. In the UK, the FCA states that SCA rules have applied since 14 September 2019.
- PCI DSS v3.2.1 retired on 31 March 2024, and the future-dated requirements in v4.x became mandatory on 31 March 2025.
- Ask every provider for its current AOC and a written description of how it applies SCA before you sign.
- Nuvei states that it has met the requirements for a PCI DSS Level 1 Service Provider.
Every time a customer taps pay online or completes a credit card payment in a mobile app, sensitive customer data crosses networks. Data breaches can damage customer trust and trigger heavy fines. Knowing which providers meet PCI DSS (Payment Card Industry Data Security Standard) and PSD2 (Payment Services Directive 2) is part of choosing a partner for payment processing.
What is PCI DSS compliance for a payment service provider?
PCI DSS is the globally recognized benchmark for securing cardholder data. It is an industry security standard set by the major card schemes to protect cardholder data and maintain data security across electronic payments.
PCI DSS compliance is a card scheme requirement, contractually enforced by acquirers and card brands. It is not law.
The standard outlines key requirements, including:
- Secure network architecture: Protecting systems that store, process, or transmit payment card data.
- Strong access control measures: Limiting access to sensitive information to authorized personnel.
- Encryption and tokenization: Encryption keeps stored and transmitted card data unreadable if intercepted, and tokenization is an optional way to reduce scope.
- Regular monitoring and testing: Keeping communication channels secure and spotting vulnerabilities before they become breaches.
- Comprehensive policies: Enforcing security and compliance protocols across your organization.
Meeting PCI DSS requirements helps prevent fraud and reduce risk, and shoppers are more likely to trust a merchant that prioritizes payment security.
Which PCI DSS version applies to providers today?
Version 3.2.1 retired on 31 March 2024, according to the PCI Security Standards Council. The council also states that v4.0 retired on 31 December 2024, which leaves v4.0.1 as the only active version, and that the effective date of 31 March 2025 for the new requirements did not change with v4.0.1. Ask providers for an AOC that reflects the current version.
What does PSD2 require from a payment service provider?
PSD2 is a European regulation designed to enhance digital payments and strengthen customer protection. It legally governs payment services and requires measures such as Strong Customer Authentication (SCA). The EBA publishes the regulatory technical standards on SCA under PSD2.
SCA applies to payer-initiated electronic payments, with exemptions and out-of-scope cases. For a merchant, the practical question is how a provider decides when to challenge a customer and when to apply an exemption.
How do you check that a provider is PCI DSS and PSD2 compliant?
Request documents, not marketing claims. The table below lists what to ask for and what to check.
| Document to request | What it shows | What to check |
|---|---|---|
| PCI DSS Attestation of Compliance (AOC) | The provider's PCI DSS validation status | That it is current and covers the services you will use |
| Written SCA description | How the provider applies SCA to your payments | How it handles exemptions and challenges |
| Security and audit policies | How the provider monitors and tests its systems | How often audits run and who owns the findings |
| Market coverage statement | Which regions the provider's compliance covers | That your target markets are included |
- PCI DSS Attestation of Compliance (AOC): shows the provider's PCI DSS validation status. Check that it is current and covers the services you will use.
- Written SCA description: shows how the provider applies SCA to your payments. Check how it handles exemptions and challenges.
- Security and audit policies: show how the provider monitors and tests its systems. Check how often audits run and who owns the findings.
- Market coverage statement: shows which regions the provider's compliance covers. Check that your target markets are included.
PCI DSS certification
Providers must undergo formal audits and obtain PCI DSS validation (Attestation of Compliance, AOC), which demonstrates their ability to protect cardholder data. This includes secure network infrastructure, encryption of payment card data, and regular vulnerability testing. Merchants should always request the provider's current AOC.
PSD2 compliance and strong customer authentication
Compliance with PSD2 means a provider implements multi-factor authentication, secure access controls, and measures to prevent fraud in electronic payments. Good authentication also affects your approval rates, because unnecessary challenges lose legitimate customers.
Ongoing audits and monitoring
Regular audits and monitoring of communication channels maintain compliance and identify risks before they escalate into data breaches.
Transparent policies and documentation
Providers need clear policies on data security, fraud prevention, and regulatory compliance, so you can see how your payments are handled.
Cross-border capabilities
If you sell internationally, a compliant provider should support cross-border payments while meeting local and international data security standards.
Which providers publish their PCI DSS status?
Providers publish compliance details in different places. These two state their PCI DSS status on their own sites:
- Stripe: Stripe states that a PCI-certified auditor certified it to PCI Service Provider Level 1.
- Nuvei: Nuvei states that it has met the requirements set for a Level 1 Service Provider under PCI DSS.
For any other provider, ask for the AOC directly and confirm its date.
How Nuvei handles PCI DSS and PSD2
Nuvei states that it has met the requirements set for a Level 1 Service Provider under PCI DSS. Its site lists descoping PSD2 compliance among the benefits of its fraud and risk tools. Nuvei is best for enterprise merchants that want local acquiring in 52 markets with PCI DSS and PSD2 handled in the same consolidated infrastructure. See how authorization optimization works alongside SCA.
What to do next
List the providers on your shortlist, request each AOC and SCA description, and compare them against the table above. Read more about payment security measures for your business or talk to a Nuvei expert about your compliance requirements.
Frequently asked questions
What does PCI DSS compliant mean for a payment service provider?
It means an assessor has validated the provider against the PCI DSS and the provider holds a current Attestation of Compliance (AOC). Ask for the AOC and check that it covers the services you plan to use.
Is PCI DSS a law?
No. PCI DSS is a card scheme requirement that acquirers and card brands enforce by contract. PSD2 is a regulation, which is a different kind of obligation.
Which PCI DSS version applies now?
PCI DSS v4.0.1 applies. The PCI Security Standards Council retired v3.2.1 on 31 March 2024 and v4.0 on 31 December 2024, and the new requirements took effect on 31 March 2025.
What should you ask a provider about PSD2 and SCA?
Ask how it applies strong customer authentication, how it uses exemptions, and how it treats payments that fall outside SCA. Ask for the answer in writing.
Is Nuvei PCI DSS compliant?
Nuvei states on its website that it has met the requirements set for a Level 1 Service Provider under PCI DSS. Ask for the current AOC during your due diligence.
