Does NORBr's listing make an operator's merchants compliant?

No. The listing shows that NORBr's own systems are validated against PCI DSS. Compliance is shared: the operator and each merchant remain responsible for what they control, such as their websites, scripts, staff and own systems. The PCI DSS guide for PayFacs covers what stays on the operator's side, and merchants still complete their own validation.

Shared responsibility

NORBr's listing on the Visa Global Registry of Service Providers shows that NORBr's own systems have been validated against PCI DSS by a Qualified Security Assessor. It covers what NORBr controls: the platform, the vault, the hosted checkout, the infrastructure. It does not cover what operators and merchants control.

What stays with the operator

• Its own systems, staff accounts and access to the console.
• Its onboarding data and how it is handled.
• Its own assessment or questionnaire, referencing NORBr's attestation for the outsourced parts.

What stays with merchants

Their websites and the scripts running on them, their staff, their own systems, and their annual self-assessment. A merchant using NORBr's hosted checkout has a much smaller scope, usually SAQ A, but still a scope. The responsibility matrix between NORBr and each operator states which requirements each party covers, and operators should keep it with NORBr's attestation on file. The PCI DSS guide for PayFacs on this site details what remains on the operator's side and how to track sub-merchant validations.