Which statement best describes a Service Provider?

Which statement best describes a Service Provider?

• A. A business not a payment brand involved in processing, storage, or transmission of cardholder data on behalf of another entity
• B. A bank that issues cards
• C. A merchant acquiring service
• D. A payment brand

Answer: (A)

In PCI terms, a Service Provider is a business that is not a payment brand but is directly involved in processing, storing, or transmitting cardholder data on behalf of another entity. The statement describes exactly that: it’s a non-brand entity that handles card data for others. This matches the PCI DSS definition of a service provider, which includes entities like payment processors, data centers, or managed security providers that have access to cardholder data or affect the security of the cardholder data environment. The other roles described don’t fit this definition. A bank that issues cards is a card issuer and part of the payment brand ecosystem, not a service provider. A merchant acquiring service is involved in enabling merchants to accept card payments, but it’s not described here as the non-brand entity processing or storing card data on behalf of others. A payment brand itself is one of the brands like Visa or MasterCard, not a service provider.

In PCI terms, a Service Provider is a business that is not a payment brand but is directly involved in processing, storing, or transmitting cardholder data on behalf of another entity. The statement describes exactly that: it’s a non-brand entity that handles card data for others. This matches the PCI DSS definition of a service provider, which includes entities like payment processors, data centers, or managed security providers that have access to cardholder data or affect the security of the cardholder data environment.

The other roles described don’t fit this definition. A bank that issues cards is a card issuer and part of the payment brand ecosystem, not a service provider. A merchant acquiring service is involved in enabling merchants to accept card payments, but it’s not described here as the non-brand entity processing or storing card data on behalf of others. A payment brand itself is one of the brands like Visa or MasterCard, not a service provider.