PCI DSS for travel agencies. Done for you.
For IATA and IATAN accredited agencies. We find the SAQ that fits how you take cards, complete the official form, run your ASV scans when you need them and remind you before it expires. You review and sign.
Every year, IATA agencies that accept cards on BSP sales have to show they comply with PCI DSS. Many do it alone, on a questionnaire written for every kind of business. We prepare it for them.
01 · Departures
Find your SAQ in one click.
Your SAQ type depends on how your agency takes card payments. Pick yours on the board and get your boarding pass.
Boarding passThe customer pays on the provider's page and card data never touches your systems: the shortest questionnaire, and no scans.
A guide, not a ruling: we confirm your SAQ type against the PCI SSC eligibility criteria before preparing anything.
02 · On autopilot
After take-off, we keep watch.
Quarterly ASV scans
When your SAQ requires external scans, an Approved Scanning Vendor recognised by the PCI SSC scans your website every quarter. We schedule each scan, follow up on findings and add every passing report to your file.
Renewals that never slip
We keep your answers and your dates. Sixty days before your SAQ expires, we contact you to renew it.
Official forms. Every time.
Your SAQ is the PCI Security Standards Council's own questionnaire, completed with your agency's details and ready to submit to IATA. Nothing rebuilt, nothing summarised.
03 · Flight plan
Three legs. You fly only the last one.
- Leg 1 · Check-in
Answer a short questionnaire
How you take cards, your agency's details and who signs. Once, by email or in your free account.
- Leg 2 · In flight
We prepare everything
The right SAQ on the official PCI SSC form, plus ASV scans scheduled when your SAQ requires them.
- Leg 3 · Arrival
You review, sign and submit
A PDF ready to submit to IATA, and a reminder before next year's renewal.
04 · Connections
The rest of your BSP work, in one place.
Specialists in IATA agency work for everything around your accreditation, and a free dashboard for your BSPlink reports with Wise Copilot inside.
Questions
PCI DSS for travel agencies, answered.
Do IATA travel agencies need PCI DSS?
Yes, if they accept payment cards for BSP sales. IATA asks accredited agents that take card payments to comply with PCI DSS and to validate that compliance every year, usually with a Self-Assessment Questionnaire (SAQ) and its Attestation of Compliance.
Which SAQ does a travel agency need?
It depends on how the agency takes cards. Payment links, or a website that redirects to or embeds the provider's payment page, usually mean SAQ A. A website that builds its own payment form means SAQ A-EP. Keying cards into a provider's virtual terminal means SAQ C-VT. Storing card numbers electronically means SAQ D. We confirm the type against the PCI SSC eligibility criteria before preparing it.
What is an ASV scan and when is it required?
An external vulnerability scan of your internet-facing systems, run by an Approved Scanning Vendor listed by the PCI Security Standards Council. It is required at least once every three months when your SAQ includes requirement 11.3.2: for example SAQ A for an agency whose website redirects to or embeds the payment page, and SAQ A-EP.
Do you submit the SAQ to IATA for us?
No. The SAQ is a declaration your agency makes, so an authorised person at the agency signs it and submits it. We deliver it completed and ready to sign, and tell you what to send.
How long does it take?
One to two weeks from the moment we have your answers, mostly driven by how quickly your team replies. Renewals for existing clients are usually done in days.
Do you work with IATAN agencies in the United States?
Yes. PCI DSS applies to any business that accepts payment cards, so the same SAQ and ASV work covers IATAN-accredited agencies.
Is Wisepassenger part of IATA?
No. Wisepassenger is an independent company and is not affiliated with IATA. We prepare your documentation; IATA's rules and your acquirer decide what you must file.
Final call
Ready for departure?
First time or renewal, your PCI DSS prepared by specialists in travel agency compliance.
