Yes. PCI DSS applies tois intended for any entity that stores, processes or transmits cardholder data, or transmits cardholder data — regardless of whether these activities are conducted directly or by a third-party service provider.

If a merchant outsources all their payment operationsWhen a merchant outsources its payment processing to a third party and does not store, the applicableprocess, or transmit cardholder data, many PCI DSS requirements for the protection of account data may not apply directly to the merchant’s environment. Howould apply to the enevironment(s) where the data is actually storeder, processed and transmitted, such as third party serthis does not removice providers, payment gateways, etc. However, it is thee the merchant’s responsibility of the merchant to ensure that the data they share with third parties is properly handled and protected ? justto ensure account data is properly protected because a merchant outsources all payment processing does not mean that the merchant won?t be held responsible by their acquirer or payment brand in the event of an account data compromisey the third party.

Additionally, the merchant?s acquirer or payment Merchants remain responsibrand may still require the merchant to le for:

Ensuring the provalidate theirider is PCI DSS compliance status. For examplet for the services offered, the merchant may
Maintaining written agreements with the provider that include acknowledgment of their responsibe rilities (Required to complete SAQ A in which the merchant attests that they have outsourced all payment processing services, do not store account data, and that they are compliant with PCI DSS Requirement ment 12.8. PCI DSS 2),
Monitoring the provider’s compliance status at least annually (Requirement  12.8 states that merchants must have written agreements with their service providers that include the service provider?s acknowledgement o.4),
Clearly def theirining and understanding any shared responsibility for securing the data in their possession, and also requires that merchants monitor their service provider?s compliance at least annuallyies.

Merchants should checkare still required to validate PCI DSS compliance, typically through a Self-Assessment Questionnaire (such as SAQ A). Merchants should confirm their compliance obligations with the organization(s) that manage their compliance program—such as their acquirer or payment brand to determine their compliance obligations when all payment processing is outsourced—also referred to as compliance-accepting entities.