PCI DSS in Singapore and South East Asia: acquirers, QSAs, the PDPA and regional teams

Why organisations in Singapore and South East Asia need PCI DSS

Many payment facilitators, e-commerce platforms, travel businesses and shared-service centres serving South East Asia are headquartered in Singapore. The entity that signs the merchant agreement or the processing contract is often the Singapore company, and that agreement is where PCI DSS arrives: the acquirer asks for an annual validation, and enterprise clients of a service provider ask for its Attestation of Compliance before they route card data through it.

Global brands also write PCI DSS into supplier contracts for outsourced contact centres in Kuala Lumpur, Jakarta or Ho Chi Minh City. And financial institutions supervised by the Monetary Authority of Singapore work to MAS's Technology Risk Management Guidelines, so a provider serving them should expect card-data controls to be reviewed alongside wider technology risk. Levels and validation types are covered in the PCI DSS decision guide.

Acquirers, QSAs and validation in the region

PCI DSS is a validation route, not a certification, so nothing in Singapore or its neighbours accredits it. The card brands set merchant and service-provider levels by annual transaction volume, and your acquirer confirms which applies and what it wants to receive.

Three facts decide the local shape of the work. First, who your acquirers are: a group selling online in Singapore, Malaysia and Indonesia may hold a merchant account in each, and each bank may ask for its own copy of the AOC on its own date. Second, which QSA company will assess you: check it on the PCI SSC's public QSA list, ask which of its assessors will do the fieldwork and whether they will visit sites outside Singapore, and check your scanning vendor on the ASV list. Third, whether to train an Internal Security Assessor to run internal assessments and manage the QSA relationship; whether an ISA can sign your validation is for your acquirer and the card brands to decide. Sterling does not validate compliance; the QSA assesses and attests.

Local practice that changes a PCI DSS project

The PDPA and card data

The Personal Data Protection Act 2012, administered by the Personal Data Protection Commission, applies to any organisation collecting personal data in Singapore, whether or not it has a local presence. A breach affecting 500 or more individuals, or likely to cause significant harm, is notifiable, and the organisation must tell the Commission no later than three calendar days after deciding that it is. Your PCI DSS incident response plan under Requirement 12 should therefore include the PDPA assessment and notification steps, not run in parallel to them. A contact centre taking card payments for a client under a written contract is a data intermediary and must notify that client.

Operations in Malaysia, Indonesia and Vietnam

PCI DSS in Malaysia raises the same acquirer and QSA questions, plus local law: the Cyber Security Act 2024 (Act 854) places duties on national critical information infrastructure entities, so check whether your Malaysian operation falls within it. Indonesia's Law No. 27 of 2022 on Personal Data Protection governs personal data processed there, including cardholder names. Where records, scripts or screenshots are in Bahasa Malaysia, Bahasa Indonesia or Vietnamese, agree early whether your QSA's team needs translations.

Scope across borders

Many regional groups run payments from Singapore, a contact centre in Malaysia or the Philippines and development in Vietnam. Each location that stores, processes or transmits card data, or can affect its security, is in scope. Tokenisation or a hosted payment page at the Singapore end can take whole offshore teams out of scope. The scoping and segmentation guide explains the techniques, and Philippine operations have their own guide, PCI DSS compliance in the Philippines.

Local items to check, and where

How Sterling works in Singapore and South East Asia

Sterling supports regional PCI DSS programmes from its offices in Singapore, Kuala Lumpur, Jakarta and Ho Chi Minh City, drawing on 8,100+ client engagements in 60+ countries since 2003.

PCI DSS in Singapore: questions buyers ask