PCI DSS assessments for companies in Germany
1 Sequence Cyber Ltd is a PCI SSC-listed Qualified Security Assessor (QSA) company for Europe. Our QSAs, Ron Williams and Venkata Kamala Bandepalli, carry out PCI DSS v4.0.1 assessments for merchants and payment service providers in Germany, including ROC, AOC and SAQ support. Assessments are delivered in English. Scoping calls are free.PCI SSC-listed QSA company for Europe (verify on the PCI SSC QSA list) · ISO 27001 and ISO 9001 certified · Quarterly ASV scans through Qualys, a PCI SSC Approved Scanning Vendor
What is different in Germany
- girocard, Germany's domestic debit scheme run by the Deutsche Kreditwirtschaft, is not a PCI SSC member brand. Terminals and systems that also take Visa or Mastercard bring those flows into PCI DSS scope, and shared infrastructure usually brings in more. We help you draw that boundary.
- BaFin supervises payment and e-money institutions. Since 17 January 2025, DORA sets their ICT risk rules, and PCI DSS evidence can support DORA testing.
- The Federal Data Protection Act (BDSG) adds German rules to GDPR. Supervision is split between the federal commissioner (BfDI) and the state data protection authorities.
- Germany's NIS2 implementation law, in force since 6 December 2025, brings many more payment and digital service providers under BSI oversight.
How to choose a PCI DSS QSA in Germany
- Check the PCI SSC QSA list for the Europe region.
- Ask how the QSA treats girocard and other non-PCI flows when scoping.
- Ask whether German-language evidence can be reviewed, and whether your acquirer accepts an English ROC.
- If you are BaFin-supervised, ask how PCI DSS evidence will be reused for DORA.
Frequently asked questions
Is girocard in PCI DSS scope?
Not on its own, because it is not a PCI SSC brand. Shared systems that also process Visa, Mastercard, American Express, Discover or JCB are in scope.
Do you work in German?
Our assessments are delivered in English. Tell us at scoping if your evidence is mainly in German.