PCI DSS for travel agencies. Done for you.
For IATA and IATAN accredited agencies. We find the SAQ that fits how you take cards, complete the official form, run your ASV scans when you need them and remind you before it expires. You review and sign.
Join the travel agencies that already work with us
Every year, IATA agencies that accept cards on BSP sales have to show they comply with PCI DSS. Many do it alone, on a questionnaire written for every kind of business. We prepare it for them.
01 · Departures
Find your SAQ in one click.
Your SAQ type depends on how your agency takes card payments. Pick yours on the board and get your boarding pass.
Boarding passThe customer pays on the provider's page and card data never touches your systems: the shortest questionnaire, and no scans.
A guide, not a ruling: we confirm your SAQ type against the PCI SSC eligibility criteria before preparing anything.
Agency in the United States, accredited by IATAN or ARC? PCI DSS for US travel agencies
Beyond travel
Not a travel agency? The same service works for any business that takes cards.
PCI DSS applies to every business that stores, processes or transmits payment card data, whatever its industry, and the SAQ types and official PCI SSC questionnaires are the same for all of them. Our method was built on travel agencies, where cards arrive through BSP, merchant accounts, virtual terminals and payment links. Shops, hotels, online stores, clinics, professional firms and software companies follow the same steps: we look at how you take cards, choose the SAQ, fill in the official form with you and deliver it ready to sign, at the same fixed price.
Tell us how you take cards02 · On autopilot
After take-off, we keep watch.
Quarterly ASV scans
When your SAQ requires external scans, an Approved Scanning Vendor recognised by the PCI SSC scans your website every quarter. We schedule each scan, follow up on findings and add every passing report to your file.
Renewals that never slip
We keep your answers and your dates. Sixty days before your SAQ expires, we contact you to renew it.
Official forms. Every time.
Your SAQ is the PCI Security Standards Council's own questionnaire, completed with your agency's details and ready to submit to IATA. Nothing rebuilt, nothing summarised.
03 · Flight plan
Three legs. You fly only the last one.
- Leg 1 · Check-in
Answer a short questionnaire
How you take cards, your agency's details and who signs. Once, by email or in your free account.
- Leg 2 · In flight
We prepare everything
The right SAQ on the official PCI SSC form, plus ASV scans scheduled when your SAQ requires them.
- Leg 3 · Arrival
You review, sign and submit
A PDF ready to submit to IATA, and a reminder before next year's renewal.
04 · Connections
The rest of your BSP work, in one place.
Specialists in IATA agency work for everything around your accreditation, and a free dashboard for your BSPlink reports with Wise Copilot inside.
05 · Learning material
BSP and IATA, explained every week.
A new article each week on the BSP, BSPlink, ADMs, refunds and accreditation, written from IATA and BSP reference documents with the source of every rule. Summaries are open; the full articles are free with an account.
BSP essentials for travel agents new to IATA accreditation
The BSP is the system that issues ticket documents and settles sales between airlines and accredited agencies. Learn who takes part, how billing and remittance work, and where BSPlink, ADMs and refunds fit.
Read the articleFull text free with an account
BSPlink reports to check each period before remittance
Each period, download the billing files from BSPlink, reconcile the Agent Billing Details, confirm the Agent Remittance Summary and check rejected documents. Details vary by market.
Read the articleFull text free with an account
How a refund works in BSPlink: applications, notices and billing
Refunds go through BSPlink as a Refund Application, or a Refund Notice for enhanced agents. The airline authorizes or rejects, and an approved amount lands in the billing of its approval period.
Read the articleFull text free with an account
Questions
PCI DSS for travel agencies, answered.
Do IATA travel agencies need PCI DSS?
Yes, if they accept payment cards for BSP sales. IATA asks accredited agents that take card payments to comply with PCI DSS and to validate that compliance every year, usually with a Self-Assessment Questionnaire (SAQ) and its Attestation of Compliance.
Which SAQ does a travel agency need?
It depends on how the agency takes cards. Payment links, or a website that redirects to or embeds the provider's payment page, usually mean SAQ A. A website that builds its own payment form means SAQ A-EP. Keying cards into a provider's virtual terminal means SAQ C-VT. Storing card numbers electronically means SAQ D. We confirm the type against the PCI SSC eligibility criteria before preparing it.
What is an ASV scan and when is it required?
An external vulnerability scan of your internet-facing systems, run by an Approved Scanning Vendor listed by the PCI Security Standards Council. It is required at least once every three months when your SAQ includes requirement 11.3.2: for example SAQ A for an agency whose website redirects to or embeds the payment page, and SAQ A-EP.
Do you submit the SAQ to IATA for us?
No. The SAQ is a declaration your agency makes, so an authorised person at the agency signs it and submits it. We deliver it completed and ready to sign, and tell you what to send.
How long does it take?
One to two weeks from the moment we have your answers, mostly driven by how quickly your team replies. Renewals for existing clients are usually done in days.
Do you work with IATAN agencies in the United States?
Yes. PCI DSS applies to any business that accepts payment cards, so the same SAQ and ASV work covers IATAN-accredited agencies.
Do you prepare PCI DSS for businesses that are not travel agencies?
Yes. PCI DSS applies to every business that stores, processes or transmits payment card data, in any industry, and the SAQ types and official PCI SSC questionnaires are the same. Travel agencies are our specialism, so the examples on this site come from travel; for a shop, a hotel, an online store or a professional firm we follow the same method and the same fixed price: we identify how cards are taken, choose the SAQ, complete the official form and deliver it ready to sign.
Is Wisepassenger part of IATA?
No. Wisepassenger is an independent company and is not affiliated with IATA. We prepare your documentation; IATA's rules and your acquirer decide what you must file.
Final call
Ready for departure?
First time or renewal, your PCI DSS prepared by specialists in travel agency compliance.
