PCI DSS assessments for companies in Belgium
1 Sequence Cyber Ltd is a PCI SSC-listed Qualified Security Assessor (QSA) company for Europe. Our QSAs, Ron Williams and Venkata Kamala Bandepalli, carry out PCI DSS v4.0.1 assessments for merchants and payment service providers in Belgium, including ROC, AOC and SAQ support. Assessments are delivered in English. Scoping calls are free.PCI SSC-listed QSA company for Europe (verify on the PCI SSC QSA list) · ISO 27001 and ISO 9001 certified · Quarterly ASV scans through Qualys, a PCI SSC Approved Scanning Vendor
What is different in Belgium
- Bancontact, Belgium's domestic debit scheme, is not a PCI SSC member brand. Most Bancontact cards are co-badged with Visa Debit or Debit Mastercard, so shared terminals and systems are usually in PCI DSS scope.
- The National Bank of Belgium (NBB) supervises payment and e-money institutions. DORA has applied to them since 17 January 2025.
- Belgium's NIS2 law (Law of 26 April 2024) has been in force since 18 October 2024, with the Centre for Cybersecurity Belgium (CCB) as the authority.
- The Data Protection Authority (GBA/APD) enforces GDPR in Belgium.
How to choose a PCI DSS QSA in Belgium
- Check the PCI SSC QSA list for the Europe region.
- Ask how Bancontact and co-badged cards will be scoped.
- Ask whether Dutch- or French-language evidence can be reviewed, and whether your acquirer accepts an English ROC.
- If you are supervised by the NBB, ask how PCI DSS evidence will be reused for DORA and the NIS2 law.
Frequently asked questions
Is Bancontact in PCI DSS scope?
Not on its own, because it is not a PCI SSC brand. Systems that also process Visa or Mastercard, which most co-badged Bancontact cards do, are in scope.
Do you work in Dutch or French?
Our assessments are delivered in English. Tell us at scoping if your evidence is mainly in Dutch or French.