Merchant definition in PCI DSS terms is?

• A. Any entity that accepts payment cards for goods and/or services; may be a service provider if it stores, processes, or transmits cardholder data on behalf of others
• B. A merchant is only a retailer physically in a storefront
• C. A merchant is any company that issues payment cards
• D. A merchant never stores cardholder data

Answer: (A)

In PCI DSS terms, a merchant is any entity that accepts payment cards for goods and/or services. This broad definition covers not just traditional storefronts but online stores, mobile apps, or any business that takes card payments. The nuance is that the same entity can also be a service provider if it stores, processes, or transmits cardholder data on behalf of others. That means a company might act as a merchant when it accepts card payments, and also as a service provider when it handles card data for other merchants.

The other statements narrow or misstate the concept. A merchant isn’t limited to physical storefronts alone, and issuers aren’t merchants. Also, while there are strict rules about storing cardholder data, it isn’t true that a merchant never stores card data; storing is allowed under PCI DSS with proper protections.