PCI DSS assessments across Europe
1 Sequence Cyber Ltd is a Qualified Security Assessor (QSA) company listed by the PCI Security Standards Council for Europe and the USA. Our QSAs, Ron Williams and Venkata Kamala Bandepalli, carry out PCI DSS v4.0.1 assessments for merchants and service providers across the EU and UK: scoping, gap assessments, ROC, AOC and SAQ support. Assessments are delivered in English. Scoping calls are free.PCI SSC-listed QSA company for Europe (verify on the PCI SSC QSA list) · ISO 27001 and ISO 9001 certified · Quarterly ASV scans through Qualys, a PCI SSC Approved Scanning Vendor
PCI DSS and EU rules
PCI DSS is a card-brand requirement, not EU law. In Europe it sits next to several laws that cover the same systems:
- PSD2 requires strong customer authentication (SCA) for most online card payments. SCA changes the checkout flow, but card data in that flow is still in PCI DSS scope.
- GDPR requires appropriate security for personal data, which includes cardholder names and card numbers. A card-data breach is usually also a GDPR breach, reportable within 72 hours.
- DORA has applied since 17 January 2025 to banks, payment institutions and e-money institutions. Its ICT risk and third-party rules overlap with PCI DSS requirements 6, 10, 11, 12.8 and 12.10.
- NIS2 brings banking, payment infrastructure and many digital service providers under national cyber-security laws.
We map PCI DSS evidence to these so one testing cycle supports several audits.
How to choose a PCI DSS QSA in Europe
- Check the PCI SSC QSA list. The company and its region (Europe) must be listed.
- Check language needs. Ask whether interviews, evidence review and the ROC will be in English or your local language. Some acquirers accept English ROCs; check yours.
- Ask about overlap. A QSA who knows GDPR, DORA and NIS2 can reuse evidence and save your team time.
- Ask about independence and v4.0.1: who signs your ROC, and how future-dated requirements are tested.
Frequently asked questions
Is PCI DSS required by EU law?
No. It is required by the card brands through acquirers. GDPR, PSD2, DORA and NIS2 are the laws that apply alongside it.
Do you deliver in local languages?
Our assessments are delivered in English. If your team or acquirer needs local-language material, tell us at scoping.