As a rule, every company that forwards, stores, or processes credit card data or cardholder data in any other way must comply with PCI DSS. This refers in particular to the full PAN (Personal Account Number), i.e. the credit card number, as well as to the cardholder’s other authentication data such as the checksum and the PIN. The requirements are fundamentally the same for all companies.
However, there are enormous differences in how PCI DSS compliance is attested - that is, in proving one’s own conformity with the standard. The attestation process does differ in some details between VISA, MasterCard & Co, but in broad strokes it is identical. Taking VISA Europe[1] as the baseline, a merchant must have its PCI DSS compliance attested by an independent auditor (QSA - Qualified Security Assessor) if it processes more than six million VISA transactions per year. It is then a so-called Level 1 merchant and has to commission, pay for, and successfully pass an on-site audit. Below the threshold of six million transactions, this attestation requirement is dropped. From merchant Level 2 onwards, filling out and signing a self-assessment questionnaire (SAQ - Self Assessment Questionnaire) suffices - an independent audit is no longer necessary. The merchant essentially attests its own PCI DSS compliance.
There are various SAQs - SAQ A, C-VT, C and D - where in SAQ A the merchant confirms that it never has any digital means of access to the PANs & Co. SAQ D is the full escalation and contains all PCI DSS requirements.
In both cases (merchant Level 1 and Level 2) the merchant must additionally have an external vulnerability scan performed by an ASV (Approved Scanning Vendor) accredited by the PCI Council, and must pass it without PCI-relevant vulnerabilities. In my opinion, however, this scan is not very telling: it can only find obvious vulnerabilities from the outside. And without a complete review of the IT landscape, it is very difficult to assess whether the entire address range was actually tested.
Merchants in particular who want access to the PAN themselves and/or do not want to fully outsource their payment processing are basically faced with the choice:
Either accept the technical, organizational, and personnel - and hence also financial - challenges of PCI DSS, or accept a (genuinely considerable) risk and not fill out SAQ C-VT, C or D truthfully.
The SAQ process is certainly inexpensive for merchants, but it represents a major weak point in the downward-branching chain of PCI DSS compliance. Even where a merchant intends correct compliance, they need independent internal control processes to ensure that compliance. And those controls must actually be effective.
As a rule, I consider an independent audit - or completely outsourcing payment processing to a service provider - to be the more sensible approach. The SAQs are an incalculable weak spot in the attestation of PCI DSS compliance.[1] http://www.visaeurope.com/en/businesses__retailers/payment_security/merchants.aspx