Also called: ROC, PCI Report on Compliance
What a Report on Compliance is
A Report on Compliance (ROC) is a detailed assessment of how your business meets the applicable Payment Card Industry Data Security Standard (PCI DSS) requirements. It reviews the systems, policies, and security controls involved in protecting cardholder data, including the systems that store, process, or transmit it.
A ROC records assessment results for individual requirements, such as whether a control is in place, not in place, or not applicable. It is different from an Attestation of Compliance (AOC), which summarizes the compliance result for the organization. A ROC is the detailed findings; the AOC is the formal attestation.
The ROC documents your security assessment; it is not a processing fee or a substitute for fixing open findings.
How the assessment works
A Qualified Security Assessor (QSA) examines the defined cardholder data environment, reviews evidence, and tests controls. The report includes an executive summary, assessment scope and methodology, findings for applicable requirements, and assessor sign-off. The organization then submits its compliance documents to the parties that require validation, such as its acquirer or a payment brand.
PCI DSS v4.0.1 is the current standard as of 2026. Its 51 future-dated requirements became mandatory on March 31, 2025, including controls for payment-page scripts and multi-factor authentication for access to the cardholder data environment. A ROC evaluates the requirements that apply to your environment, rather than treating every system at your company as automatically in scope.
Who needs a ROC
Under Visa’s Level 1 criteria, merchants processing over 6 million Visa transactions in a year must submit a ROC and an AOC. Visa, other card brands, your acquirer, or a customer can set validation requirements, so transaction volume alone does not determine every business’s reporting path. Some organizations can validate with a Self-Assessment Questionnaire (SAQ) instead.
A ROC is generally an annual requirement for organizations required to complete one. Your business’s validation method depends on its card-processing volume, role in handling card data, and the requirements imposed by the parties requesting validation. A QSA conducts the external assessment; an Internal Security Assessor (ISA) can be used where the applicable validation rules accept that route.
What it means for your costs
A ROC is a compliance report, not an interchange fee, network assessment, or per-transaction processor charge. The research available here does not establish a standard ROC price, so compare assessor proposals by scope, included testing, remediation support, and any separate retesting charges rather than relying on a supposed industry rate.
Processors commonly bill a monthly PCI non-compliance fee when a merchant has not validated compliance. That fee is separate from the ROC itself. If it appears on your processing bill, compare the billed months with your validation status and submitted compliance documents. The ROC does not lower card rates, but closing documented gaps can reduce the risk of continued non-compliance charges and security failures.
What the report tells you
The findings show which assessed requirements are in place, not in place, not applicable, or not tested. A report with open findings gives you a remediation list, while an attestation summarizes whether the required validation has been completed. PCI compliance requires meeting every applicable requirement, so one unresolved finding can affect the overall result.
Use the report to confirm which systems and payment-page components were included in scope, who owns each open item, and what evidence is needed to close it. For example, a payment-page script control finding should identify the relevant page and the control gap, not just label the website non-compliant.
What you can actually change
- Confirm your reporting path. Get your required validation method in writing from the party requesting compliance documents. Confirm whether your business needs a ROC and AOC or qualifies for an SAQ.
- Define the assessment scope. List the systems that store, process, or transmit cardholder data and confirm which are included in the cardholder data environment. Scope errors can leave important controls outside the assessment.
- Track every finding. Assign an owner and completion date to each item marked not in place or not tested. Keep evidence of fixes so the assessor can verify them.
- Review compliance charges. Compare any monthly PCI non-compliance fee on your processing statement with your validation status and submission dates. Do not treat the ROC assessment cost as a card-processing fee.
Frequently asked questions
Is a ROC the same as an AOC?
No. The ROC is the detailed assessment report, with findings for applicable PCI DSS requirements. The Attestation of Compliance summarizes the organization’s compliance status. Organizations required to submit a ROC also submit an AOC under the applicable validation process.
Does every business that accepts cards need a ROC?
No. Visa Level 1 merchants processing over 6 million Visa transactions a year must submit a ROC and AOC. Other businesses can have different validation requirements, and some qualify to use an SAQ. Your acquirer or payment brand determines the reporting path that applies.
Does a ROC appear as a fee on my merchant statement?
The ROC is an assessment report, not a card-processing fee, and it does not have a standard statement line. A separate monthly PCI non-compliance fee can appear when your business has not validated compliance. Compare that charge with your validation and submission records.
How often do you complete a ROC?
Organizations required to complete a ROC generally complete the assessment annually. The exact reporting requirements come from the applicable card-brand, acquirer, or customer rules, so confirm the required submission cycle for your business.