Do sub-merchants of a PayFac need their own PCI DSS validation?

Yes, but usually a light one. Each sub-merchant validates its own compliance, often with a self-assessment questionnaire whose type depends on how it captures card data. The PayFac collects and tracks those validations as part of its risk program and its acquirer's requirements.

Yes, scaled to their integration

Each sub-merchant is a merchant under scheme rules and must validate its own compliance. Most do so through a self-assessment questionnaire whose type depends on how they capture card data: SAQ A for a hosted page or redirect, SAQ A-EP for a form on their own site, others for terminals or direct integrations. Small sub-merchants rarely need an assessor.

The PayFac's role

• Determine the SAQ type for each sub-merchant from its integration.
• Collect the completed questionnaire and attestation at onboarding and annually.
• Track validation status across the portfolio and report it to the sponsor acquirer.
• Follow up on non-compliant sub-merchants, up to suspension if the sponsor requires it.

Why it is a data problem

With thousands of sub-merchants, tracking validations by email does not work. The PayFac needs the integration method, SAQ type, validation date and status on each merchant file, with reminders and reporting. Offering sub-merchants a hosted checkout keeps most of them in SAQ A, which shortens their questionnaire and reduces the follow-up work. The validation remains theirs; the tracking is the PayFac's.