IATAN and ARC agencies, United States
PCI DSS for US travel agencies, prepared with you.
For IATAN and ARC accredited agencies that take card payments through their own merchant account: service fees, tours, cruises, hotels, insurance and deposits.
In short
When a US travel agency charges a card through its own merchant account, the bank that processes those payments (the acquirer) requires PCI DSS compliance and decides how it is validated; for most small agencies that is an annual Self-Assessment Questionnaire and Attestation of Compliance. For airline tickets charged through ARC, the airline is the merchant, not the agency. Wisepassenger works out which SAQ applies, fills in the official PCI SSC questionnaire with you and delivers it ready to sign, for a fixed US$250.
When PCI DSS applies to your agency
Airline tickets charged through ARC
For airline transactions processed through a GDS and ARC, the airline is the merchant for the card payment, not the travel agency.
Cards charged through your own merchant account
Service fees, tours, cruises, hotels, insurance or deposits charged by your agency, by terminal, virtual terminal or payment link: your agency is the merchant, and your acquirer decides how you validate PCI DSS.
Card data kept on paper, in email or in a system
Keeping card numbers widens what the questionnaire covers and can change which SAQ applies, so it is the first thing we check.
Source on ARC transactions and acquirer validation: ARC, Payment Card Industry Data Security Standard FAQs
What you get
Fixed price: US$250 per SAQ. Nothing to install.
- The SAQ type that matches how you take cards (A, A-EP, C-VT or D), with the eligibility criteria that decide it.
- The official PCI SSC questionnaire filled in with your answers, and the Attestation of Compliance ready to sign.
- A clear note of what to send your acquirer or processor, and quarterly ASV scans where your SAQ requires them.
Common questions
Do IATAN or ARC require PCI DSS?
The obligation comes from the card brands' rules, applied by the bank that processes your card payments. ARC's guidance on PCI DSS points agencies to their acquiring bank, which determines the validation requirements. For airline tickets charged through ARC, the airline is the merchant for those transactions.
Which SAQ does a US agency usually need?
It depends on how cards are taken: SAQ A for payment links or a website that hands the payment to the provider's page, SAQ C-VT for a virtual terminal typed by staff, SAQ A-EP when your own website builds the payment form, and SAQ D when card data is stored electronically.
What do you need from us?
Your legal and trading name, address, how you take card payments and through which provider, whether you keep card data, and who signs the attestation. Most of it is a short email reply.
Is Wisepassenger part of IATAN, ARC or IATA?
No. Wisepassenger is an independent consultancy and is not affiliated with IATA, IATAN or ARC.
Final call
Ready for departure?
First time or renewal, your PCI DSS prepared by specialists in travel agency compliance.
