NORBr, the white-label payment infrastructure for PayFacs, PSPs, ISOs and ISVs, is listed on the Visa Global Registry of Service Providers after an independent PCI DSS validation by a Qualified Security Assessor. For operators building on NORBr, the listing shortens security due diligence with acquirers, schemes and their own merchants, because anyone can verify it on Visa's site.
NORBr first appeared on the registry in July 2025, after a PCI DSS assessment that closed without findings. The listing has since been renewed: the current Attestation of Compliance runs from June 2026 to June 2027. This article, updated in October 2026, explains what the registry is, what PCI DSS validation covers, what the listing changes for the operators running on NORBr, how security is designed beyond the standard, and where partners and their auditors can get the evidence.
What is the Visa Global Registry of Service Providers?
The Visa Global Registry of Service Providers is Visa's public list of third-party companies that store, process or transmit card data and have validated their compliance with the Payment Card Industry Data Security Standard (PCI DSS). Acquirers, payment facilitators and merchants use it to check a provider before connecting it to their card flows.
A provider is listed only after an independent assessment by a Qualified Security Assessor (QSA) and registration by a sponsoring Visa client, and the listing has to be renewed every year with a new validation. NORBr's entry reads: NORBr B.V., Netherlands, service provider type Merchant Servicer, validation type PCI DSS, assessor CNPP Cybersecurity, valid through June 30, 2027. The registry has no direct profile link: search for "NORBr B.V." to see it.
What does PCI DSS validation cover?
PCI DSS is the global standard for protecting cardholder data, and a service provider validation checks all twelve of its requirements against the provider's real architecture and processes. They cover network security controls and segmentation, protection of stored data and encryption in transit, secure development, access control and strong authentication, logging and monitoring, regular testing, and the policies and incident response that hold it together.
The version that applies is PCI DSS v4.0.1: according to the PCI Security Standards Council, v4.0 was retired on December 31, 2024, and the requirements that were future-dated became mandatory on March 31, 2025. One of them matters directly to operators: external vulnerability scans by an Approved Scanning Vendor at least every quarter. NORBr runs those scans weekly and has them certified far more often than the quarterly minimum.
What does NORBr's listing change for PayFacs, PSPs and ISOs?
For an operator, the listing turns a long vendor questionnaire into a check it can do in a minute, and it gives the evidence the operator itself needs. Under PCI DSS, a PayFac or PSP must manage the third-party service providers that touch its card data and know which requirements each one covers; a listed provider with a current Attestation of Compliance answers most of that question.
In practice, that means easier vendor onboarding with acquirers and schemes, faster security due diligence when the operator signs regulated platforms or enterprise merchants, and an answer the operator can pass on to its own merchants' security teams. It removes friction exactly where a white-label model needs it: the operator's brand is on the payment experience, so the operator is the one its merchants and partners ask. The Platform Operations & Security page summarizes the compliance posture, and the PCI DSS guide for PayFacs covers what remains on the operator's side.
How does NORBr design security beyond PCI DSS?
PCI DSS sets a floor, and NORBr treats security as a design principle rather than an audit to pass: isolation between environments, strict access policies, data minimization and continuous monitoring are built into the platform, and the infrastructure and internal processes are audited regularly. Personal data is handled under the General Data Protection Regulation (GDPR), encrypted in transit and at rest, and kept only as long as the business purpose requires.
Some choices are visible to every operator. Single Sign-On is available out of the box at no extra cost, unlike the vendors listed on the SSO Wall of Shame, and we recommend turning it on. Merchant documents collected at onboarding stay inside the merchant file, with every partner decision timestamped, instead of circulating by email, as described in the multi-acquirer onboarding article. Scheme programs and mandates are followed on the platform side through Scheme Ready, so operators do not rebuild them per merchant. The aim stays the same: make risk harder to introduce and easier to detect.
Where can partners and auditors verify NORBr's compliance documents?
The fastest check is public: search for "NORBr B.V." on the Visa Global Registry. For the documents themselves, the NORBr Trust Center gives clients, partners and their auditors access to the current PCI DSS Attestation of Compliance and to the certified ASV scan reports, executive summaries for all users and technical reports on request.
Prospects can request access through the contact form and receive a time-limited invitation; clients and partners get an account through their NORBr support team. That is how an operator building on NORBr can show payments without the PSP burden to its own partners: the evidence is already there, under one search and one sign-in.
_%2520a%2520game%2520changer%2520for%2520digital%2520transactions_-Cover.webp){kind=spacer}
