12.8.2 TPSP contracts acknowledging account data responsibility

The entity must hold written agreements with every TPSP that receives its account data or could influence CDE security, and each agreement must contain the TPSP's acknowledgment that it answers for protecting the account data it holds, stores, processes or transmits for the entity, or to whatever extent it could affect the entity's sensitive authentication data or cardholder data. Applicability: exact wording depends on the service and allocated responsibilities and need not match the requirement text. An AOC, website declaration, policy statement, responsibility matrix or other evidence outside a written agreement does not count as a written acknowledgment. Objective under the customized approach: records exist of every TPSP's acknowledgment of its duty to protect account data.

Source: PCI DSS v4.0.1, 12.8.2. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open PCI DSS v4.0.1 in the compliance library.

Version 4.0.1 is the active version; 4.0 has been retired. Appendix A1 applies only to multi-tenant service providers, A2 only to card-present POS POI terminals that still use SSL or early TLS, and A3 only when a payment brand or acquirer requires it. Which requirements apply to you follows your validation type.