Also called: AOC
What an Attestation of Compliance is
An Attestation of Compliance is a formal record of your organization’s assessment against the Payment Card Industry Data Security Standard (PCI DSS). It identifies the organization and assessment scope, states the compliance result, and includes the required sign-offs. The AOC is evidence of an assessment, not a guarantee that every system is secure or that a breach cannot occur.
The AOC is not the detailed assessment itself. A Report on Compliance (ROC) contains the findings from a full assessment, while the AOC summarizes the result. For a self-assessment route, you complete the applicable Self-Assessment Questionnaire (SAQ) and the related AOC. The right form depends on your role and PCI DSS validation requirements.
An AOC records your assessment result and scope; it does not replace the assessment or make an old validation current.
How it works
First, your business identifies the systems, locations, payment channels, and service providers in scope for card data. You then complete the required assessment, address gaps, and document the result in the matching AOC form. A merchant using an SAQ route completes the applicable documents and obtains the required authorized signature. A QSA-led assessment includes a ROC and an AOC signed by the assessor and an authorized company representative.
The AOC records the assessment method, scope, and compliance status. Requirements can be marked as in place, not in place, or not applicable. If requirements remain unmet, the form can include a remediation plan with the steps and expected completion dates. Your acquirer, payment brand, or business customer can review the document as evidence of your PCI DSS status.
What it means for your costs and risk
The AOC itself is not a card-processing fee, and the research provides no standard AOC charge or set price. Costs come from the work behind validation, such as an assessment, security tools, scans, and staff time. A processor can bill a monthly PCI non-compliance fee when your business has not validated compliance, so distinguish that charge from the AOC document.
An outdated or inaccurate AOC can delay a bank review, vendor onboarding, or a customer contract. Incorrect scope can also leave systems or payment channels outside the assessment. PCI DSS v4.0.1 is the current version as of 2026. Keep your validation current against the requirements that apply to your business, rather than treating an old AOC as proof of present-day compliance.
What a reviewer checks
A reviewer looks for your legal business name, assessment date, validation method, systems and locations covered, and the final status and signatures. For a service provider’s AOC, the form also identifies services in scope and relevant third-party providers. Compare those details with the service you use and the payment environment your business actually operates.
An AOC does not normally appear as a transaction or processing-fee line on your merchant statement. If you see a monthly PCI compliance or non-compliance charge, review the line description and your validation status. The document can help establish that validation occurred, but it does not explain the amount or basis of a statement fee.
What you can actually change
- Get the right form. Confirm whether your validation uses an SAQ or a QSA-led assessment, then obtain the matching AOC. Merchant and service-provider forms are not interchangeable.
- Check the scope. Compare the AOC’s business name, assessment date, payment channels, systems, locations, and named services with your current setup. Correct gaps before sharing it as proof.
- Track renewal dates. PCI validation is annual. Record the next assessment date and keep evidence of completed validation so a missing document does not trigger a PCI non-compliance fee.
- Separate fees from proof. If your statement has a PCI compliance charge, identify the exact line and confirm whether it is a validation fee or a non-compliance charge. The AOC itself does not set processing rates.
Frequently asked questions
Is an AOC the same as a PCI DSS certificate?
An AOC is a signed record of your PCI DSS assessment, including its scope and compliance status. It summarizes the result and is distinct from the detailed ROC or the SAQ used for a self-assessment.
Does every merchant need to submit an AOC?
The required validation route and documents depend on your role and PCI DSS requirements. Merchants using an SAQ route complete the applicable SAQ and AOC; a QSA-led assessment produces a ROC and AOC. Your acquirer or payment brand can specify what it requires.
Does an AOC have a standard fee?
No standard AOC document fee is identified in the research. Assessment work, scans, security tools, and staff time can have costs. A monthly PCI non-compliance fee is a separate processor charge that can apply when a merchant has not validated compliance.
How often should you renew an AOC?
PCI DSS compliance validation is annual, so plan to refresh your assessment and AOC each year. Keep the document’s scope aligned with your current payment channels, systems, and service providers.