A merchant that accepts payment cards for goods or services can also be a service provider if which condition is met?

• A. It cannot be a service provider
• B. Only if it issues cards
• C. It stores, processes, or transmits cardholder data on behalf of other merchants or service providers
• D. It uses a service provider

Answer: (C)

In PCI DSS terms, a service provider is a business that stores, processes, or transmits cardholder data on behalf of merchants or other service providers. The statement that fits this definition is the one where the entity handles cardholder data for other merchants or service providers. That means, even if it’s a merchant by default, it becomes a service provider whenever it takes on card data for external clients, not just for its own transactions.

If a merchant only issues cards, that describes card issuing rather than becoming a service provider. If a merchant relies on or uses a service provider to handle card data, that does not make the merchant a service provider itself; it simply means the merchant is a customer of a service provider. An example of a service provider would be a processor or data vault service that stores, transmits, or processes card data for multiple other merchants.