Inside the PCI Attestation of Compliance (AOC)
By Sam Rivera, Founder, SentinelPanda · June 17, 2026 · 2 min read · PCI DSS
The SAQ is the work. The AOC is the one signed page that proves you did it — and the document your acquirer actually files.
SAQ vs AOC
The Self-Assessment Questionnaire (SAQ) is the long form: every applicable PCI DSS requirement, answered yes / no / not-applicable with a short justification. The Attestation of Compliance (AOC) is the short form that sits on top of it — a standardized cover document where you declare the overall result, identify your environment, and sign.
They are not interchangeable. Validation means submitting both: the completed SAQ as the evidence, and the signed AOC as the formal attestation. The SentinelPanda SAQ wizard produces the answered questionnaire; the AOC is the attestation you sign against it.
What the AOC contains
- Merchant / service-provider details and the assessed business function.
- The SAQ type you completed (A, A-EP, B, B-IP, C, C-VT, P2PE, D) and the PCI DSS version.
- A description of your cardholder-data environment and in-scope payment channels.
- The compliance status: compliant, non-compliant, or compliant with a remediation plan / legal exception.
- Acknowledgement of any ASV scans (for the SAQ types that require them) and their pass status.
- Signatures: the merchant executive, and a QSA/ISA only if one was involved.
Who signs it
For a self-assessed SAQ, the signer is an authorized officer of your own organization — typically the person accountable for the cardholder-data environment. No Qualified Security Assessor signature is required for the self-assessment paths; that is the entire point of the SAQ. A QSA only signs when you engage one, or when your acquirer requires it for your merchant level.
What your acquirer checks
Acquirers rarely read every SAQ answer. They check that the AOC exists, that the SAQ type matches how you actually take payments, that the status is compliant (or has an accepted remediation plan), and that it is signed and current. A mismatch between your real payment flow and the SAQ type on the AOC is the fastest way to have it rejected.
Common mistakes
- Submitting the SAQ without the signed AOC — or the AOC without the SAQ.
- Choosing a lighter SAQ type than your payment flow justifies (under-scoping).
- Leaving the compliance status blank or marking compliant with open "no" answers and no remediation plan.
- Letting the attestation go stale — it is an annual obligation, not a one-time filing.