It's not really that complex.
There's one metric that's the decisive factor - are you handling credit-card information?
That's why fully off-site payments have always been a big issue. Cause with 6.2 finally offering us full offsite payment we're finally able to comply.
Each payment provider might have a different subset of regulations and paperwork for certain cards they're accepting, but instead of having to be fully pci-compliant yourself like any brick-and-mortar store has to be with all their software and hardware, an e-commerce website can get away by outsourcing all the sensitive stuff to an offsite payment provider.
For sec e-commerce, in combination with an off-site payment provider who's PCI-DSS compliant you're only required to fill in SAQ A. It's a self assessment form, where you acknowledge all credit-card information is handled by a compliant 3rd party and you do not store this yourself.
The standards say:
PCI DSS applies to any entity that stores, processes or transmits cardholder data.
If a merchant outsources all their payment operations, the applicable PCI DSS requirements for the protection of account data would apply to the environment(s) where the data is actually stored, processed and transmitted, such as third party service providers, payment gateways, etc.
However, it is the responsibility of the merchant to ensure that the data they share with third parties is properly handled and protected – just because a merchant outsources all payment processing does not mean that the merchant won’t be held responsible by their acquirer or payment brand in the event of an account data compromise.
Additionally, the merchant’s acquirer or payment brand may still require the merchant to validate their PCI DSS compliance status.
For example, the merchant may be required to complete SAQ A in which the merchant attests that they have outsourced all payment processing services, do not store account data, and that they are compliant with PCI DSS Requirement 12.8.
PCI DSS Requirement 12.8 states that merchants must have written agreements with their service providers that include the service provider’s acknowledgement of their responsibility for securing the data in their possession, and also requires that merchants monitor their service provider’s compliance at least annually.
Merchants should check with their acquirer or payment brand to determine their compliance obligations when all payment processing is outsourced.
Quoted from: https://www.pcisecuritystandards.org/faq/
So by filling out a self-assessment questionnaire, using a qualified 3rd party payment provider some possible annual paper checks and signatures and we're good to go...