Is a PayFac a merchant or a service provider under PCI DSS?

A service provider, because it processes or affects the security of card data on behalf of its sub-merchants. That brings the service provider requirements, such as segmentation testing every six months and annual validation by a Qualified Security Assessor at higher volumes, on top of the obligations it has toward its sponsor acquirer.

A service provider

A payment facilitator processes transactions on behalf of its sub-merchants, holds their onboarding data and often their card data flows, and can affect the security of cardholder data across many businesses. PCI DSS classifies that as a service provider, with obligations beyond those of a single merchant.

What the classification adds

• Annual validation by a Qualified Security Assessor, with a Report on Compliance, at the volume thresholds set by the schemes.
• Segmentation testing every six months, not every year.
• Quarterly external scans by an Approved Scanning Vendor and internal scans.
• A documented responsibility matrix with each customer, stating which requirements each party covers.

On top of the sponsor's requirements

The sponsor acquirer sets its own rules: how sub-merchants are validated, what reporting the PayFac provides, how incidents are escalated. Those come from the acquiring agreement, not from the standard, and are often stricter. A PayFac building on validated infrastructure reduces its own scope for card capture and storage, but keeps the service provider status for what it controls: the console, staff access, onboarding data and its own systems. The assessment calendar should align with the infrastructure provider's, so the two attestations tell one story.