Does building on a validated infrastructure make an operator compliant?

It reduces scope, it does not remove it. The operator still validates the systems and processes it keeps, such as staff accounts, console access and anything that could affect the security of card data. What changes is the size of that environment: when card capture, vaulting and tokenization run on a validated provider, far fewer controls fall on the operator.

Scope reduction, not transfer

When card capture, vaulting and tokenization run on a provider that holds a valid PCI DSS attestation, the operator's systems never see a card number. That removes most of the controls from the operator's environment. It does not remove the operator from the standard: it still has an environment, smaller, that must be validated.

What stays with the operator

• Staff accounts and access to the console, with authentication and logging.
• Any system that could affect the security of cardholder data, even without storing it.
• Policies, training and incident response.
• Its own assessment or questionnaire, referencing the provider's attestation for the outsourced parts.

How much changes

A great deal. An operator that stores card numbers faces hundreds of requirements across network, encryption, key management and testing. One that relies on a validated provider for everything that touches card data can often validate through a shorter questionnaire, with the provider's attestation covering the rest. The responsibility matrix between the two, which the standard requires, should be written down and kept current.