Compliance Assessment ToolWhich PCI SAQ do I need?
If your bank or card processor has asked for your "PCI compliance" or a "Self-Assessment Questionnaire", the right form depends on one thing: how you take card payments. Here is how to tell, in plain English.
Skip the guesswork — find yours free
Describe how you take payments in your own words. We'll tell you which SAQ fits each payment method, and why. No IT knowledge needed.
Find my SAQ — free →Answer three questions
- Do you take payments in person, online, or by phone/mail? Each way you take payments is checked separately.
- For online payments: whose page does the customer type their card into? Your payment provider's page usually means SAQ A. Your own page (even with the provider's card fields embedded) usually means SAQ A-EP.
- For in-person payments: what does your card machine connect to? A phone line → SAQ B. The internet, on its own → SAQ B-IP. A register or computer → SAQ C. A validated encrypted terminal → SAQ P2PE. A phone or tablet with a validated reader → SAQ SPoC.
Staff typing phone orders into a payment web page is SAQ C-VT. If card numbers ever land on your own systems — or you store them — it is SAQ D, the full assessment.
All nine merchant SAQs
| SAQ | Who it is for |
|---|---|
| SAQ A | SAQ A is for businesses that sell online or by mail/phone order but never touch card numbers themselves — the customer types their card into a checkout page run entirely by your payment provider. |
| SAQ A-EP | SAQ A-EP is for online stores whose own website shows the checkout page, even though the card number itself goes straight to the payment provider and never lands on your server. |
| SAQ B | SAQ B is for businesses whose card machine connects over a phone line (or that still use a manual imprint machine), with nothing connected to the internet or to your computers. |
| SAQ B-IP | SAQ B-IP is for businesses using a standalone card terminal that connects to the processor over the internet — with the terminal kept separate from your other computers. |
| SAQ C | SAQ C is for a single-location business whose point-of-sale system or payment software runs on a device connected to the internet — kept separate from everything else. |
| SAQ C-VT | SAQ C-VT is for businesses that take card details over the phone or by mail and type them into a virtual terminal — a payment web page provided by your processor. |
| SAQ P2PE | SAQ P2PE is for businesses whose card terminals are part of a PCI-validated point-to-point encryption solution — card data is encrypted inside the terminal, so your own systems never see it. |
| SAQ SPoC | SAQ SPoC is for businesses that take in-person card payments on a phone or tablet paired with a small secure card reader, using a payment solution validated by PCI SSC under the SPoC standard. |
| SAQ D | SAQ D is the full PCI self-assessment. It applies when card numbers reach your own systems — your website accepts them, or you store them — or when no shorter SAQ fits. |
Common questions
What is a PCI SAQ?
A Self-Assessment Questionnaire (SAQ) is the form the card brands' security standard, PCI DSS, uses to let smaller businesses check and attest to how they protect card payments. There are nine merchant SAQ types; which one you complete depends on how you take card payments.
Who tells me I need to complete one?
Usually your acquiring bank or payment processor. Smaller merchants typically validate once a year with an SAQ and a signed Attestation of Compliance (AoC); some processors charge a monthly non-compliance fee until you do.
I take payments more than one way. Which SAQ is mine?
Each way you take payments matters. A shop with a counter terminal and an online store may need to cover both channels — your acquirer confirms whether they want one combined SAQ or one per channel.
What is the shortest SAQ?
SAQ A, for businesses that fully outsource online payments to a hosted checkout. For in-person payments, SAQ P2PE and SAQ SPoC are short when you use a PCI-validated solution.
Seeing a "PCI non-compliance" charge on your statement? Here is what it means and how to stop it.
This guide helps you identify the right self-assessment questionnaire. Your acquiring bank or payment processor decides which SAQ you must submit — confirm with them if you are unsure. Compliance Assessment Tool helps you complete a PCI DSS self-assessment; we are not a Qualified Security Assessor (QSA) and do not certify compliance. Eligibility criteria are from PCI DSS v4.0.1 SAQ documentation published by the PCI Security Standards Council.