{"head":{"title":"What Is a PCI AOC (Attestation of Compliance)? | OceanLab","description":"A PCI AOC is the official form a merchant or service provider signs to attest to its PCI DSS assessment results. Who asks for it and what it shows.","canonical":"https://oceanlab.in/glossary/aoc"},"crumbs":[{"name":"Home","path":"/"},{"name":"Glossary","path":"/glossary"},{"name":"AOC","path":"/glossary/aoc"}],"slug":"aoc","term":"AOC (attestation of compliance)","aka":["attestation of compliance","PCI AOC"],"category":"Payments and fintech","short":"The official PCI SSC form a merchant or service provider signs to attest to the results of its PCI DSS assessment.","body":[["The PCI SSC glossary defines the AOC as the official form for merchants and service providers to attest to the results of a PCI DSS assessment, as documented in an ",{"href":"/glossary/saq","text":"SAQ"}," or a Report on Compliance (ROC)."],["Merchants send it to their acquirer or payment provider. Service providers that touch card data, such as payment gateways, hosting providers in the card data path or call-centre platforms, share theirs with customers as proof of compliance."]],"why":["When you choose a vendor that sits in your card data path, its AOC is the evidence that it meets PCI DSS for the services you use. When you are the vendor, customers will ask for yours during procurement."],"example":["A subscription business picks a billing platform. Its security team asks for the platform's current service provider AOC, checks that it covers the services they will use and that it is in date, and files it with their own PCI evidence."],"inBuild":["When a build connects to a payment provider or gateway, collecting that provider's AOC is part of the launch checklist for the client's PCI evidence."],"mistakes":[["Accepting an AOC that does not cover the specific services you use."],["Not checking the date. AOCs are tied to an assessment period."],["Assuming a vendor's AOC covers your own systems too."]],"related":[{"href":"/glossary/saq","label":"SAQ (self-assessment questionnaire)","detail":"The PCI DSS form that eligible merchants and service providers use to document the results of their own assessment."},{"href":"/glossary/pci-scope","label":"PCI scope","detail":"Every system, person and process that PCI DSS applies to, because it handles card data or can reach systems that do."},{"href":"/glossary/cardholder-data-environment","label":"Cardholder data environment (CDE)","detail":"The people, processes and systems that store, process or transmit payment card data, plus the systems connected to them."},{"href":"/glossary/soc-2-type-ii","label":"SOC 2 Type II","detail":"An independent audit report on whether a service organisation's controls were designed well and worked over a period of time."}],"tools":[{"href":"/tools/pci-dss-saq-picker","label":"PCI DSS SAQ picker","detail":"Free tool"}],"links":[{"href":"/compliance/pci-dss","label":"PCI DSS guide","detail":"Card data rules and how to shrink your scope."},{"href":"/software/payments","label":"Software for payments","detail":"Payment systems and the compliance work they bring."}],"sources":[{"title":"PCI Security Standards Council glossary","url":"https://www.pcisecuritystandards.org/glossary/","checkedAt":"2026-10-25"},{"title":"PCI SSC document library (PCI DSS and SAQs)","url":"https://www.pcisecuritystandards.org/document_library/","checkedAt":"2026-10-25"}],"legal":true,"updatedAt":"2026-10-25"}