Guide
The PCI AOC: the short attestation your bank actually wants
The PCI AOC, or Attestation of Compliance, is the short document confirming your compliance status. It is usually what your bank or business customer asks to see, rather than the full report behind it.
- We prepare, a QSA assesses
- Published price ranges
- Written estimate, no call
What the PCI AOC contains
The AOC summarises the assessment: the business, the scope, the result and the signatures. Therefore it travels easily, while the detailed report stays private. Templates are in the PCI SSC document library.
Who signs it
The signers depend on the route you take.
| Route | Who signs the AOC |
|---|---|
| Self-assessment questionnaire | Your executive. |
| Report on Compliance by a QSA | The QSA, plus your executive. |
| Internal assessor (merchants only) | Your internal assessor, plus your executive. |
PCI AOC readiness check
Tick what applies.
Your result appears here as you tick, so you can see what is still open.
PCI AOC versus the Report on Compliance
The Report on Compliance is the full assessment, often hundreds of pages. The AOC, by contrast, is a short summary. So banks and customers usually want the AOC, while the assessor holds the full detail.
Why customers ask for your AOC
Businesses that send you card data, or rely on you to handle it, must check their service providers. So they ask for your AOC each year. Keep it current, because an expired one stalls renewals.
Most requests come at contract renewal time. Therefore keep a current copy ready to send, rather than searching for it when a customer asks.
Our role with the PCI AOC
We prepare you so the assessment behind the AOC goes smoothly. However, we never sign or issue an AOC, because we are not a QSA.
Also note which version of the standard your AOC references. Customers increasingly check that it reflects version 4.0.1, so an older attestation may prompt questions even if it is still within twelve months, so plan the next assessment early.
PCI AOC questions
How long is a PCI AOC valid?
Assessments are annual, so customers expect an AOC from the last twelve months.
Can a consultant sign our AOC?
No. Only you, and the assessor on the assessor route, sign it.
Is the PCI AOC the same as a certificate?
No. There is no PCI certificate; the AOC attests to the assessment result.
Who gets a copy?
Your acquirer, and customers who rely on you.
Related guides
Prepare for the assessment behind your AOC
Tell us your route and dates. We reply with a written readiness estimate, and we introduce a QSA if needed.
Get my written estimate