Insight
Worldpay PCI compliance: what merchants are asked to validate
Worldpay PCI compliance requests usually arrive as an annual prompt to validate. So merchants need to know which questionnaire fits, and what evidence to keep ready.
- Not a QSA, stated first
- Introductions to independent QSAs
- Written answers, no call
Why Worldpay PCI compliance requests arrive
Acquirers answer to the card brands for their merchants. Therefore Worldpay, like other acquirers, asks merchants to validate PCI DSS each year.
The request is not a sales pitch. It reflects the acquirer's own obligations, so ignoring it rarely ends well.
What Worldpay PCI compliance validation usually involves
Most small and mid-size merchants complete a Self-Assessment Questionnaire. Also, some need quarterly external scans, depending on their setup.
| Item | When it applies |
|---|---|
| Self-Assessment Questionnaire | Most merchants, every year |
| Attestation of Compliance | Signed with the questionnaire |
| Quarterly ASV scans | When in-scope systems face the internet |
Worldpay PCI compliance check
Tick what you have ready for this year's validation.
Your result appears here as you tick, so you can see what is still open.
Fees and Worldpay PCI compliance
Some merchant agreements include fees when validation lapses. However, terms differ between contracts, so read your own agreement and statements rather than relying on general claims.
In addition, check whether a validation programme fee appears separately. Merchants often confuse the two.
Choosing the right form
The questionnaire follows how you accept cards. For example, hosted checkout pages and validated terminals often allow shorter forms.
- Online checkout fully hosted by the provider
- Standalone terminals
- Phone orders keyed into a virtual terminal
- A mix of channels, which may need several forms
Where Winslow helps
We confirm your questionnaire, organise evidence and prepare the submission. We are not a QSA and we do not represent Worldpay. Gap analysis generally runs $8,000 to $40,000. Forms are in the PCI SSC document library.
Also keep one folder for each year. For example, store the questionnaire, the attestation, scan reports and any correspondence together. So next year's validation starts from a complete record. In addition, note any change in how you take cards, because that may change the form. As a result, renewals take less time each cycle.
Worldpay PCI compliance questions
Is Worldpay PCI compliance mandatory?
Annual validation is normally required by your merchant agreement.
Why was I charged a Worldpay PCI compliance fee?
Check your statement and agreement, because fees depend on your contract terms.
Which SAQ fits Worldpay PCI compliance?
It depends on how you take cards, not on the acquirer.
Does Worldpay validate for us?
No. The merchant completes and signs its own attestation.
Related guides
Prepare your Worldpay PCI compliance submission
Tell us how you take cards. We reply in writing, usually within one business day, with no phone number needed.
Ask us anything