PCI DSS Compliance Audits
PCI DSS assessments for companies in France
1 Sequence Cyber Ltd is a PCI SSC-listed Qualified Security Assessor (QSA) company for Europe. Our QSAs, Ron Williams and Venkata Kamala Bandepalli, carry out PCI DSS v4.0.1 assessments for merchants and payment service providers in France, including ROC, AOC and SAQ support. Assessments are delivered in English. Scoping calls are free.PCI SSC-listed QSA company for Europe (verify on the PCI SSC QSA list) · ISO 27001 and ISO 9001 certified · Quarterly ASV scans through Qualys, a PCI SSC Approved Scanning Vendor
What is different in France
- Most French cards are Cartes Bancaires (CB) co-badged with Visa or Mastercard, so one card can travel on either network. Because the same card number serves both, CB flows usually sit in PCI DSS scope with the international brand.
- The ACPR supervises payment and e-money institutions, and the Banque de France oversees the security of payment means. DORA has applied to these institutions since 17 January 2025.
- The CNIL, France's data protection authority, enforces GDPR. Its recommendation on card payments (deliberation 2018-303) requires the customer's consent before a merchant keeps a card number for later purchases.
How to choose a PCI DSS QSA in France
- Check the PCI SSC QSA list for the Europe region.
- Ask how co-badged CB cards and CB-only flows will be scoped.
- Ask whether French-language evidence can be reviewed, and whether your acquirer accepts an English ROC.
- If you are ACPR-supervised, ask how PCI DSS evidence will be reused for DORA.
Frequently asked questions
Are Cartes Bancaires transactions in PCI DSS scope?
In practice, usually yes, because CB cards are co-badged with Visa or Mastercard and share the card number.
Do you work in French?
Our assessments are delivered in English. Tell us at scoping if your evidence is mainly in French.