Knowledge center

Does an external provider remove my PCI DSS scope?

Not automatically. A provider can reduce the functions you perform, but your company still needs to understand the integration, manage responsibilities and confirm SAQ criteria.

Why it matters

Outsourcing payment is not the same as transferring every responsibility.

What to confirm

Provider’s exact function
Whether your site or people can affect payment
Provider AOC and covered services

Official PCI DSS documentation · PCI DSS v4.0.1 · reviewed 2026-07-31

This content is informational and is not legal advice. The applicable route and validation method depend on the operation and requesting party.

Identify your likely route Back to all questions