PCI DSS by region
PCI DSS in the Philippines: compliance for merchants, BPOs and payment providers
What is different about PCI DSS in the Philippines: who sets your obligation, who assesses it, how it sits beside the Data Privacy Act and BSP expectations, and the local practice that shapes the scope.
Key points
- PCI DSS reaches Philippine businesses through contracts, not a Philippine statute: the acquiring bank sets the merchant's validation, and foreign clients write it into the agreements of the BPOs and service providers that handle their customers' cards.
- There is no Philippine accreditation body, register or certificate for PCI DSS. A QSA company qualified by the PCI Security Standards Council assesses, or you complete the SAQ your acquirer accepts, and the AOC is the document that counts.
- The Data Privacy Act of 2012 runs beside PCI DSS: card numbers are personal information, so the Act's security measures and the NPC's 72-hour breach notification apply alongside the card brand rules.
- Voice agents, chat channels and work-from-home floors decide most Philippine scopes, so where agents hear, see or type card numbers matters more than the data centre.
Why Philippine organisations pursue PCI DSS compliance
Two groups carry most of the demand. The first is the IT-BPM sector: contact centres, back offices and software houses in Metro Manila, Cebu, Clark and the provinces that take payments, handle refunds or resolve disputes for overseas brands. Their clients' vendor risk teams ask for a current AOC before a campaign goes live and at every renewal.
The second group is domestic: retailers, hotels, online sellers, payment facilitators and fintechs that accept cards themselves. Their acquiring bank decides which level applies, based on the card brands' programmes, and whether a Report on Compliance or a self-assessment questionnaire is expected. The decision guide on merchant levels and service providers explains how that choice is made.
Who assesses PCI DSS compliance for a Philippine company?
PCI DSS is validated, not certified. No Philippine accreditation body plays a role: QSA companies and scanning vendors are qualified or approved by the PCI Security Standards Council itself, which publishes both lists.
For a Philippine business the practical questions are three. Which acquirer, or which client contract, sets your obligation? Does it expect a ROC signed by a QSA or an SAQ signed by your own executive? And does the QSA company you are considering appear on the council's list, with assessors who can carry out fieldwork at your Philippine sites? Levels are set by the card brands on annual transaction volume and confirmed by your acquirer. The guide to choosing a QSA lists what to ask before you sign.
PCI DSS, the Data Privacy Act and BSP expectations
An AOC does not discharge the Data Privacy Act of 2012 (Republic Act No. 10173). Section 20 requires organisational, physical and technical measures for personal information, and NPC Circular 16-03 requires notification of qualifying breaches to the National Privacy Commission within 72 hours, a breach response team and an annual summary. A card compromise can start that clock alongside your acquirer's and client's notice duties, so one incident response plan should carry all three.
For banks and other BSP-supervised financial institutions, BSP Circular No. 982 of 2017, the Enhanced Guidelines on Information Security Management, sets the information security risk management framework examiners expect. PCI DSS controls for card data sit inside that framework rather than replacing it, and one risk register can serve both. The Data Privacy Act page covers the Act itself.
Local practice that changes a PCI DSS project
Voice and chat agents inside the scope
When agents take card numbers by phone, every workstation, call recording, screen capture and quality monitoring tool that touches them is in scope. Descoping methods that keep card numbers away from the agent, and a firm rule that card numbers are never typed into chat or sent by messaging, shrink the environment before any control is built.
Work from home and hybrid floors
Home-based agents taking payments bring home networks, personal devices and household visitors into the assessor's questions. Many providers keep payment work on site, or use hardened virtual desktops with no local storage, and document that choice in the scope confirmation.
Client-owned payment tools and group structures
The client often owns the CRM and the payment page and provisions access itself. The responsibility matrix must show which requirements the Philippine entity meets, which the client meets, and which sit with a third party. Economic zone locators under a foreign parent should decide early whether they carry their own AOC or sit inside the group's assessment.
Local items to check, and where
| Local item | What it means for your project | Where to verify it |
|---|---|---|
| Your validation obligation | Fixes the level, ROC or SAQ, and the date your AOC is due | Your acquiring bank, or the client's contract and vendor onboarding pack |
| The QSA company | Decides who assesses and whether fieldwork happens at your Philippine sites | The PCI Security Standards Council's list of qualified security assessors |
| Quarterly external scans | Scanning vendor chosen early so passing scans exist before the assessment | The council's list of approved scanning vendors |
| Data Privacy Act measures | Security measures and outsourcing duties that apply alongside PCI DSS | The Act and its implementing rules, published by the National Privacy Commission |
| Breach notification | A 72-hour NPC clock beside your acquirer's and client's notice duties | NPC Circular 16-03 on the National Privacy Commission's site |
| BSP information security guidelines | For supervised institutions, the framework your card controls sit within | BSP Circular No. 982 on the Bangko Sentral ng Pilipinas site |
How Sterling works in the Philippines
Sterling runs Philippine PCI DSS engagements from its Manila office, on site and remotely. Local services and contacts are on Sterling in the Philippines. The team draws on an international practice of 8,100+ client engagements in 60+ countries since 2003.
How Sterling supports Philippine merchants and service providers
PCI DSS compliance built around your agents, your acquirer and the Data Privacy Act
We trace every card data flow with your operations and IT leads, reduce the scope, run the gap analysis against all twelve requirements, remediate with your team, map the Data Privacy Act duties into the same control set, keep the evidence in Effivity, train your agents and run an internal assessment before the QSA arrives. The QSA company you engage assesses and attests; Sterling does not validate compliance.
Book a free discovery callPCI DSS in the Philippines: questions buyers ask
Is PCI DSS mandatory in the Philippines?
It is a contractual obligation rather than a Philippine law we have found. Your acquiring bank and the card brands require it of merchants, and your clients' contracts require it of service providers that handle their card data.
Who can do a PCI DSS assessment in the Philippines?
A QSA company qualified by the PCI Security Standards Council, listed on the council's website. Where your acquirer allows self-assessment, your own executive signs the SAQ and its AOC instead.
Does PCI DSS compliance cover the Data Privacy Act?
No. The controls support the Act's security duties, but the Act brings its own obligations to the National Privacy Commission, including 72-hour breach notification, that need their own records.
Where can we get PCI DSS support in Manila?
Sterling's Manila office runs PCI DSS engagements for Philippine merchants, BPOs and payment providers, from scoping to the assessment. An independent QSA company then assesses and signs the ROC and AOC.
PCI DSS by region
Every guide in the PCI DSS series is written for one question and links back to the hub for the whole picture.
- PCI DSS compliance in Australia
- PCI DSS compliance in India
- PCI DSS compliance in the Netherlands and Europe
- PCI DSS compliance in Singapore and South East Asia
- PCI DSS for small merchants and start-ups
- PCI DSS for SaaS, hosting and managed security providers
- The PCI DSS assessment
- PCI DSS compliance in the Philippines
- PCI DSS compliance in the United Kingdom
- PCI DSS timeline
- PCI DSS training
- PCI DSS compliance in the UAE and GCC
Keep exploring
Explore more about PCI DSS
Watch a video on how to implement PCI DSS here.
Watch a video on PCI DSS requirements here.
PCI DSS resources
Services for PCI DSS
Talk to a consultant
Plan your PCI DSS compliance in the Philippines with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice