PCI DSS assessments for companies in the Nordics
1 Sequence Cyber Ltd is a PCI SSC-listed Qualified Security Assessor (QSA) company for Europe. Our QSAs, Ron Williams and Venkata Kamala Bandepalli, carry out PCI DSS v4.0.1 assessments for merchants and payment service providers in Denmark, Sweden, Norway and Finland, including ROC, AOC and SAQ support. Assessments are delivered in English. Scoping calls are free.PCI SSC-listed QSA company for Europe (verify on the PCI SSC QSA list) · ISO 27001 and ISO 9001 certified · Quarterly ASV scans through Qualys, a PCI SSC Approved Scanning Vendor
What is different in the Nordics
- Denmark: Dankort, the national debit card, is not a PCI SSC member brand, but about half of Danish cards are co-badged, mostly Visa/Dankort. Shared terminals and systems are usually in PCI DSS scope.
- Norway: BankAxept, the national debit scheme, handles most in-store card payments, and almost all BankAxept cards are co-badged with Visa or Mastercard, which carry online and international payments. Co-badged flows bring PCI DSS into scope.
- Sweden: Swish moves money between bank accounts in real time, not through cards, so it sits outside PCI DSS. Merchants that offer both need a clear scope boundary.
- Each country has its own financial supervisor: Finanstilsynet in Denmark and in Norway, Finansinspektionen in Sweden, and the Finnish FIN-FSA. DORA has applied in the EU since 17 January 2025, and in Norway since 1 July 2025 through the Norwegian DORA Act.
- GDPR applies in all four countries, Norway included through the EEA Agreement, each with its own data protection authority.
How to choose a PCI DSS QSA in the Nordics
- Check the PCI SSC QSA list for the Europe region.
- Ask how co-badged Dankort and BankAxept cards, and account-to-account payments such as Swish, will be scoped.
- If you operate in several Nordic countries, ask whether one assessment can cover all of them and how local supervisors will be addressed.
- Ask whether local-language evidence can be reviewed, and whether your acquirer accepts an English ROC.
Frequently asked questions
Are Dankort and BankAxept in PCI DSS scope?
Not on their own, because neither is a PCI SSC brand. Systems that also process Visa or Mastercard, which most co-badged cards do, are in scope.
Does DORA apply in Norway?
Yes. Norway is outside the EU but in the EEA, and its DORA Act has applied since 1 July 2025.
Do you work in Nordic languages?
Our assessments are delivered in English. Tell us at scoping if your evidence is mainly in a local language.