PCI DSS SAQ Selector
A Self-Assessment Questionnaire (SAQ) is the validation tool eligible merchants and service providers use to report their PCI DSS compliance. There is no single SAQ: the PCI Security Standards Council publishes several types, each covering the subset of requirements that fits a particular way of accepting card payments. Picking the right one matters because it decides how many requirements you have to meet. Use the questions below to find your likely SAQ, then confirm it with your acquiring bank or a QSA.
The SAQ types, in one line each
- SAQ A. Card-not-present (e-commerce or mail/telephone order) merchants that have fully outsourced all cardholder data functions to PCI DSS compliant third parties, with no electronic storage, processing or transmission of cardholder data on the merchant’s own systems.
- SAQ A-EP. E-commerce merchants that outsource payment processing to a PCI DSS validated third party but whose own website can affect the security of the transaction (for example a page that redirects or embeds the payment form). No electronic storage of cardholder data.
- SAQ B. Merchants using only imprint machines or standalone, dial-out terminals, with no electronic cardholder data storage. Not for e-commerce.
- SAQ B-IP. Merchants using only standalone, PTS-approved IP-connected point-of-interaction terminals, with no electronic cardholder data storage. Not for e-commerce.
- SAQ C. Merchants with payment application systems connected to the internet, with no electronic cardholder data storage. Not for e-commerce.
- SAQ C-VT. Merchants that key transactions one at a time into a web-based virtual terminal on an isolated computer, with no electronic cardholder data storage. Not for e-commerce.
- SAQ D for Merchants. All other merchants not covered by the SAQ types above — including any merchant that electronically stores cardholder data. It covers the applicable PCI DSS requirements.
- SAQ D for Service Providers. Service providers that are eligible to complete an SAQ (rather than a full Report on Compliance). It is the most comprehensive SAQ and addresses the service-provider requirements.
- SAQ P2PE. Merchants using a validated PCI SSC-listed Point-to-Point Encryption (P2PE) solution only, with no electronic cardholder data storage — a reduced set of requirements thanks to the P2PE solution.
Which PCI DSS SAQ do I need?
Answer a few questions to find the right Self-Assessment Questionnaire for your business. Takes about 60 seconds.
Does your business accept card payments only through a third-party payment processor where you never see, handle, or store cardholder data electronically?
This wizard is a guide only. Consult a QSA or your acquiring bank to confirm the right SAQ for your environment.
Frequently asked questions
What is a PCI DSS SAQ?
An SAQ (Self-Assessment Questionnaire) is a validation tool published by the PCI Security Standards Council that eligible merchants and service providers use to self-assess their compliance with the PCI Data Security Standard. Each SAQ type contains the subset of PCI DSS requirements relevant to a particular way of accepting payments, and is submitted together with an Attestation of Compliance. Which SAQ you may use, and to whom you submit it, is ultimately determined by your acquiring bank or the payment brands.
Which PCI SAQ do I need?
It depends on how you accept and handle cardholder data. Fully outsourced e-commerce or mail/telephone-order merchants typically use SAQ A; e-commerce merchants whose own website can affect the payment use SAQ A-EP; merchants with standalone dial-out terminals use SAQ B; standalone IP-connected terminals use SAQ B-IP; internet-connected payment applications use SAQ C; web-based virtual terminals use SAQ C-VT; validated P2PE solutions use SAQ P2PE; and any merchant that stores cardholder data electronically, or that does not fit the other categories, uses SAQ D. The selector on this page walks you through these questions, but confirm the result with your acquirer or a QSA.
What is the difference between SAQ A and SAQ A-EP?
Both are for card-not-present merchants that outsource payment processing and never store cardholder data electronically. The difference is how much your own website is involved. SAQ A applies when payment acceptance is fully outsourced — for example your site redirects the customer to a PCI DSS compliant provider or loads the payment form in an iframe served entirely by that provider. SAQ A-EP applies when your website itself can affect the security of the transaction, such as a page that creates or controls the payment form. SAQ A-EP has substantially more requirements than SAQ A.
When do I have to use SAQ D?
SAQ D is for all other merchants not eligible for one of the more specific SAQs, and for eligible service providers. In practice any merchant that electronically stores cardholder data, or whose environment does not match the narrower SAQ categories, completes SAQ D — it is the most comprehensive SAQ and covers the applicable PCI DSS requirements across all twelve requirement areas. Service providers use the service-provider version of SAQ D.
Is this SAQ selector official or a substitute for a QSA?
No. This selector is a free guide to help you narrow down the likely SAQ type based on the PCI SSC’s eligibility criteria. It is not an official determination. Your eligibility for a given SAQ, and your reporting obligations, are set by your acquiring bank and the payment brands, and a Qualified Security Assessor (QSA) can confirm your scope. Always download the current SAQ documents from the PCI Security Standards Council and validate the choice with your acquirer.