PCI DSS Compliance Audits
PCI DSS assessments for companies in Spain
1 Sequence Cyber Ltd is a PCI SSC-listed Qualified Security Assessor (QSA) company for Europe. Our QSAs, Ron Williams and Venkata Kamala Bandepalli, carry out PCI DSS v4.0.1 assessments for merchants and payment service providers in Spain, including ROC, AOC and SAQ support. Assessments are delivered in English. Scoping calls are free.PCI SSC-listed QSA company for Europe (verify on the PCI SSC QSA list) · ISO 27001 and ISO 9001 certified · Quarterly ASV scans through Qualys, a PCI SSC Approved Scanning Vendor
What is different in Spain
- Spanish card payments run on Visa and Mastercard. Bizum, the popular mobile payment service, moves money between bank accounts, not cards, so it sits outside PCI DSS. Merchants that offer both need a clear scope boundary.
- Banco de España supervises payment and e-money institutions. DORA has applied to them since 17 January 2025.
- The AEPD, Spain's data protection agency, enforces GDPR together with the LOPDGDD (Organic Law 3/2018).
How to choose a PCI DSS QSA in Spain
- Check the PCI SSC QSA list for the Europe region.
- Ask how card flows will be separated from Bizum and other account-to-account payments.
- Ask whether Spanish-language evidence can be reviewed, and whether your acquirer accepts an English ROC.
- If you are supervised by Banco de España, ask how PCI DSS evidence will be reused for DORA.
Frequently asked questions
Is Bizum in PCI DSS scope?
No. Bizum is an account-to-account service, not a card payment. Shared systems that also handle card data are in scope.
Do you work in Spanish?
Our assessments are delivered in English. Tell us at scoping if your evidence is mainly in Spanish.