AOC (attestation of compliance)
Also called attestation of compliance, PCI AOC.
The official PCI SSC form a merchant or service provider signs to attest to the results of its PCI DSS assessment.
Last updated
What it is.
The PCI SSC glossary defines the AOC as the official form for merchants and service providers to attest to the results of a PCI DSS assessment, as documented in an SAQ or a Report on Compliance (ROC).
Merchants send it to their acquirer or payment provider. Service providers that touch card data, such as payment gateways, hosting providers in the card data path or call-centre platforms, share theirs with customers as proof of compliance.
Why it matters
When you choose a vendor that sits in your card data path, its AOC is the evidence that it meets PCI DSS for the services you use. When you are the vendor, customers will ask for yours during procurement.
In a product build
When a build connects to a payment provider or gateway, collecting that provider's AOC is part of the launch checklist for the client's PCI evidence.
Common mistakes.
- 01
Accepting an AOC that does not cover the specific services you use.
- 02
Not checking the date. AOCs are tied to an assessment period.
- 03
Assuming a vendor's AOC covers your own systems too.
Read the official text.
Primary sources this definition is based on.
- PCI Security Standards Council glossarychecked 2026-10-25
- PCI SSC document library (PCI DSS and SAQs)checked 2026-10-25
Work it out with a tool.
Related terms.
- SAQ (self-assessment questionnaire)The PCI DSS form that eligible merchants and service providers use to document the results of their own assessment.
- PCI scopeEvery system, person and process that PCI DSS applies to, because it handles card data or can reach systems that do.
- Cardholder data environment (CDE)The people, processes and systems that store, process or transmit payment card data, plus the systems connected to them.
- SOC 2 Type IIAn independent audit report on whether a service organisation's controls were designed well and worked over a period of time.
Guides and pages
Browse the full glossary or read answers to common questions.
