Compliance Assessment Tool
Home › PCI compliance by business › Hotels and lodging

PCI compliance for hotels, motels, inns and vacation rentals

Short answer. A hotel usually takes cards several different ways, and each one is a separate payment method with its own PCI Self-Assessment Questionnaire (SAQ), not one SAQ for the whole property. A standalone front-desk terminal is often SAQ B-IP (or SAQ P2PE with a PCI-listed encrypted terminal), a booking engine that supplies the whole card form is usually SAQ A, and phone bookings typed into a provider's virtual terminal are usually SAQ C-VT. What usually pushes a hotel to the long SAQ D is keeping guests' card numbers in its own systems, not having several channels.

PCI DSS is the card industry's security standard. If your property accepts cards, your agreement with your payment processor requires you to follow it, and most small properties prove it once a year by filling in a Self-Assessment Questionnaire (SAQ), a checklist your processor or bank asks for.

Hotels take cards more ways than most businesses: at the front desk, through a booking engine, over the phone, on authorization forms, through online travel agencies, and later for incidentals and no-shows. Each of those is its own payment method. Work out the SAQ for each one separately, and most of them turn out to be short.

How hotels and lodging usually take cards, and the SAQ for each

Each way you take cards is its own payment method, and each one gets its own SAQ. Most businesses have two or three.

Payment methodUsuallyWhy
Front-desk card terminal on its own
A card machine at reception that guests tap or insert into, connected to your processor by Ethernet, Wi-Fi or cellular, and not linked to your property management system (PMS).		 SAQ B-IP / SAQ P2PE / SAQ B
SAQ B-IP; SAQ P2PE if it is part of a PCI-listed P2PE solution; SAQ B if it dials out over a phone line		 The terminal sends the card straight to your processor, and nothing else at the property touches the card number. P2PE (point-to-point encryption) means the card is encrypted inside the terminal under a solution PCI SSC has listed, which makes the SAQ shorter still.
Watch out: Putting the terminal on the same open network as guest Wi-Fi or office computers, or connecting it to the PMS, changes the answer.
Front-desk terminal connected to your PMS
Deposits, check-in authorizations and check-out charges run from the PMS screen, with the card reader linked to the PMS or a front-desk computer so the result posts to the guest folio.		 SAQ C / SAQ P2PE / SAQ D
Often SAQ C; SAQ P2PE if the readers are a PCI-listed P2PE solution and the PMS only receives tokens; SAQ D if card numbers are stored		 Once the reader is connected to the PMS or a front-desk computer, those systems become part of the payment, so SAQ B-IP no longer fits. What the PMS actually receives, a card number or only a token, decides the rest.
Watch out: Ask your PMS vendor whether full card numbers ever pass through or are stored in the PMS. SAQ C is for a single location, so several properties sharing one network usually means SAQ D.
Online booking on your own website
A Book Now button that opens your booking engine, where guests enter a card to guarantee or prepay the room.		 SAQ A / SAQ A-EP / SAQ D
SAQ A if the booking engine or payment provider supplies the whole card form and you never see full card numbers; SAQ A-EP if your own site builds the card form		 When every part of the card form comes from a PCI DSS compliant provider, on its own page or as its secure fields embedded in yours, card numbers never touch your website or computers.
Watch out: Some booking engines pass the full card number to the PMS or let staff view it so you can charge it later. If your staff can see full card numbers, this channel is no longer SAQ A; ask the vendor whether it can tokenize instead.
Phone reservations and card authorization forms
A guest calls and reads out a card number, or a company fills in a credit card authorization form to pay for a group or another guest.		 SAQ C-VT / SAQ C / SAQ D
SAQ C-VT if staff type cards into your provider's web-based virtual terminal; if they type them into the PMS or terminal, that system's SAQ covers it		 A virtual terminal is a payment web page your provider hosts. Typing card numbers into it one at a time, on one computer kept apart from the rest of your network, is what SAQ C-VT covers.
Watch out: Receiving card numbers by email, fax-to-email, text or chat, or saving scanned forms, means you take card data electronically, which rules out the short SAQs. A secure payment link from your provider, where the guest types the card in, is usually SAQ A.
Online travel agency bookings and virtual cards
Reservations from online travel agencies (OTAs) such as Expedia or Booking.com, either prepaid to the OTA, which then pays you with a virtual card, or paid at the hotel with guest card details the OTA passes to you.		 SAQ C / SAQ D
Covered by whichever system you charge the card through; copying card numbers out of an OTA extranet by hand usually rules out the shortest SAQs		 When the OTA charges the guest, protecting that card is the OTA's job. But a virtual card, or a guest card the OTA passes to you, is a real card number that you charge, so it is part of your PCI scope.
Watch out: Viewing card numbers on screen and retyping them means your computer handles card data you received electronically. A PMS, channel manager or payment provider integration that receives OTA cards as tokens keeps this much narrower.

Find out which SAQ fits each way you take payments, free

Describe how you take payments in your own words. We'll tell you which SAQ fits each one, free, before you pay anything.

Why one hotel usually has several SAQs

PCI SSC, the council that writes the card security standards, says a business with several payment channels may complete a separate SAQ for each channel, as long as each channel meets the conditions of its SAQ and the channels are kept separate from one another. That is the rule we apply: one SAQ per payment method.

So a property with a standalone terminal, a booking engine and a virtual terminal for phone bookings usually completes three short SAQs (for example SAQ B-IP, SAQ A and SAQ C-VT) rather than one long one. Having several channels is not, on its own, a reason to file SAQ D. Your acquirer, the bank behind your processor, has the final say on which forms it wants.

Your PMS decides more than you think

The property management system is at the center of most hotel payments, and how cards get into it matters more than anything else on this page. A PMS that only ever holds tokens (stand-in codes your payment provider issues in place of the card number) keeps your SAQ narrow. A PMS that holds or displays full card numbers brings itself, and the computers that use it, into scope, usually as SAQ D.

Your PMS vendor can answer this, but you have to ask. Questions to put to them:

Cards on file, incidentals and no-show charges

Charging a card later, for incidentals, damage, a late cancellation or a no-show, is not a separate SAQ on its own. It goes through whichever system holds the card, so it is part of that system's payment method. If your payment provider or PMS holds the card as a token, the charge stays inside that channel. If you keep card numbers yourself in the PMS, a spreadsheet, or a scanned folder, that electronic storage is what makes it SAQ D.

One rule applies everywhere: never keep the three- or four-digit security code. PCI SSC says card verification codes may not be kept once the transaction they were collected for is authorized, including for card-on-file or future charges, even with the guest's permission and even if encrypted. Ask your processor how to run no-show and incidental charges without it.

Authorization forms and card numbers on paper

Paper is allowed in the short SAQs, provided it stays on paper. A card number that arrives by email, is faxed into an inbox, or is scanned into a shared drive is card data you received electronically, and it moves that channel out of the short SAQs.

Guest Wi-Fi, the front desk and the terminal itself

Guest Wi-Fi should never share an open network with card terminals or the computers staff use for payments. A separate network used only by payment devices, or a cellular connection on the terminal, are common ways to keep them apart. A computer used for a virtual terminal should be used for that and nothing else.

Card terminals at a busy front desk are a target for tampering and swapping. PCI DSS asks businesses to keep a list of their terminals, inspect them regularly for signs of tampering, and train staff to spot it, for example by checking for unfamiliar attachments or broken seals and verifying anyone who says they have come to repair a terminal.

Your checklist

  1. List every way your property takes cards: front desk, booking engine, phone, authorization forms, OTAs, and later charges.
  2. For each one, note what system the card number goes into: a terminal, the PMS, a virtual terminal, a booking engine or an OTA extranet.
  3. Ask your PMS and booking engine vendors whether full card numbers ever reach your systems or only tokens.
  4. Ask your payment provider whether your terminals are a PCI-listed P2PE solution, and check the listing on the PCI SSC website.
  5. Stop accepting card numbers by email, text or chat; use your provider's secure payment links instead.
  6. Make sure no one keeps security codes after a charge is authorized, on paper or anywhere else.
  7. Lock up paper authorization forms and cross-cut shred them once they are no longer needed.
  8. Keep card terminals and payment computers off guest Wi-Fi.
  9. Inspect front-desk terminals for tampering on a regular schedule and show staff what to look for.
  10. Complete one SAQ for each payment method and submit them the way your processor asks.

Common questions

Do I need PCI compliance if my processor or PMS handles everything?

Yes. If your property accepts cards, your merchant agreement requires you to follow PCI DSS and usually to complete an SAQ each year. A good provider makes your SAQs short, because it does most of the work, but you still confirm how you use it, and your processor still expects the forms.

Does one SAQ cover my whole hotel?

Usually not. Each way you take cards is its own payment method with its own SAQ, so a front-desk terminal, a booking engine and phone bookings are typically three SAQs. PCI SSC allows a separate SAQ per channel when each channel meets that SAQ's conditions and the channels are kept separate. Your acquirer confirms which forms it wants.

Can we keep guests' card numbers to charge no-shows and incidentals?

Keep them as tokens with your payment provider or PMS rather than as card numbers in your own files. Storing card numbers electronically yourself puts you on SAQ D. Never keep the security code after the charge it was collected for is authorized; PCI SSC does not allow it for future or card-on-file charges.

Is it okay to have guests email a credit card authorization form?

Avoid it. A card number received by email is card data you have taken electronically, which rules out the shorter SAQs and leaves card numbers sitting in inboxes. Send the guest a secure payment link from your provider instead, or take the details by phone or on paper and shred the paper when you are done.

Expedia or Booking.com takes the payment. Do I need an SAQ for those bookings?

When the travel agency charges the guest itself, protecting that guest's card is the agency's job. But if the agency pays you with a virtual card, or passes you the guest's card details to charge, you are accepting a card, and it falls under whichever system you charge it through. Copying those card numbers by hand from an extranet is the riskiest way to do it, so ask about an integration that handles them as tokens.

I rent out a vacation home or run a small B&B. Does this apply to me?

If a listing platform takes the guest's payment and pays you out, you are not accepting those cards. If you take cards directly, for deposits, direct bookings or damage charges, each of those ways is a payment method with its own SAQ, and a small setup often means short ones such as SAQ A for a payment link or SAQ B-IP for a standalone terminal.

Why is there a PCI non-compliance fee on my statement?

Your processor has not received proof that your property completed its yearly PCI validation, meaning the SAQs and the signed Attestation of Compliance. The fee usually repeats every month until you send them the way your processor asks. Our guide at complianceassessmenttool.com/pci-non-compliance-fee explains how to stop it.

Ready to see your SAQs?

Describe how you take payments in your own words. We'll tell you which SAQ fits each one, free, before you pay anything.

Other businesses

Restaurants, bars and cafesRetail storesSalons, spas and barbershopsMedical, dental and veterinary officesSmall online storesContractors and home service prosNonprofits and charities

Sources

General guidance, not legal advice. Your acquirer or payment processor decides which SAQ you must file. PCI DSS v4.0.1; content checked 2026-10-23.