Which PCI SAQ Do I Need? All SAQ Types Explained (v4.0.1)

The PCI SAQ you need depends on how you take card payments. Fully outsourced online or phone-order payments usually mean SAQ A. A website that controls the payment form means SAQ A-EP. Standalone terminals mean SAQ B or B-IP, payments keyed into a virtual terminal mean SAQ C-VT, an internet-connected till or payment application means SAQ C, a PCI-listed P2PE solution means SAQ P2PE, and anyone who stores card data electronically needs SAQ D. Your acquirer has the final say.

This guide compares every Self-Assessment Questionnaire (SAQ) under PCI DSS v4.0.1, gives you a short set of questions to find yours, and lists the mistakes we see most often. For an answer with a prioritised fix list, take our free PCI compliance check.

Key takeaways

• Your SAQ is decided by your payment channels and whether card data touches your systems.
• Every SAQ has eligibility criteria, and you must meet all of them.
• Several channels can mean several SAQs, or a single SAQ D.
• SAQ A changed in January 2025, so e-commerce merchants should re-check eligibility.
• SAQ B, B-IP, C and C-VT never cover e-commerce and only work if payment devices are isolated from your other systems.

What is a PCI SAQ?

A PCI SAQ, or PCI self-assessment questionnaire (often called a PCI compliance questionnaire), covers the PCI DSS requirements that apply to one type of payment set-up. It comes with an Attestation of Compliance (AOC), signed by an officer of your business, and you submit both to your acquirer or whoever runs its PCI programme.

Not everyone can self-assess. Level 1 merchants and larger service providers validate with a Report on Compliance from a Qualified Security Assessor instead. Our guide to PCI compliance levels explains the thresholds, and our explainer on the ROC, AOC and SAQ shows how the documents fit together.

The customised approach introduced in v4.0 cannot be used with an SAQ. Self-assessing organisations use the defined approach, with compensating controls where there is a legitimate constraint.

What are the PCI SAQ types?

None of the SAQs except D allow electronic storage of card data, and our guide to PCI SAQ D explains who needs it and how to move down to a shorter questionnaire. The full eligibility criteria are in each SAQ in the PCI SSC SAQ library.

Which PCI SAQ do I need? Answer these questions

Work down the list and stop at the first “yes” that is true for every transaction in that channel. Repeat for each payment channel you have.

Before you sign, read the eligibility criteria in the SAQ itself and confirm you meet each one.

Can I fall into two different PCI SAQs?

Yes, and many businesses do. A retailer with shop terminals and a website, or a hotel taking card-present and telephone payments, has two channels that may each map to a different SAQ. Some acquirers accept one SAQ per channel. Others ask for a single SAQ D that covers the whole environment. Ask before you start, so you only complete it once.

SAQ A or SAQ A-EP?

The question is not whether you use a payment provider, but how the payment page reaches the customer. If every element comes from the provider through a redirect or iframe, SAQ A may apply. If your site builds the form, loads scripts that interact with it, or posts card data straight to the provider, SAQ A-EP applies. Our PCI compliant payment gateway guide maps Stripe, PayPal and Square integrations to an SAQ.

In January 2025 the PCI SSC removed Requirements 6.4.3 and 11.6.1 from SAQ A and replaced them with an eligibility criterion: you must confirm your site is not susceptible to attacks from scripts that could affect your e-commerce systems. Our guide to PCI SAQ A and SAQ A-EP explains what that means.

Who can use SAQ B, B-IP, C or C-VT?

These four questionnaires cover card-present and telephone payments where card data never touches your other systems and is never stored electronically. None of them can be used for e-commerce.

SAQ B

SAQ B covers merchants whose only card payments are taken on imprint machines or standalone terminals that dial out over a phone line, not connected to the internet or any other system. Many dial-up terminals are being replaced with IP or mobile models, so check how yours actually connects.

SAQ B-IP

SAQ B-IP covers standalone terminals approved under the PCI PIN Transaction Security (PTS) programme, listed on the PCI SSC website and connecting to the processor over IP. They must be isolated from your other systems (segmentation can achieve this) and must not rely on a computer, phone or tablet to connect, so secure card readers that plug into another device are excluded. If your terminals are in a PCI-listed P2PE solution, SAQ P2PE is usually shorter: see point to point encryption.

SAQ C

SAQ C covers a payment application or till connected to the internet, such as an integrated EPOS. The payment system must be isolated from other business systems and serve a single site, so multi-site retailers on a shared network, and tills on the same flat network as office computers, usually fall outside it.

SAQ C-VT

SAQ C-VT covers transactions keyed one at a time into a virtual terminal hosted by a PCI DSS validated provider and opened in a browser, which often suits mail and telephone orders. The computer must be isolated at one location, with no card readers or software that stores card data, and card details may be kept only on paper (never the security code). Card numbers received by email or typed into a spreadsheet make you ineligible.

Our guide to taking card payments over the phone compares virtual terminals with other phone payment options, and larger teams should read our PCI IVR guide.

What changed in the SAQs for v4.0.1?

The SAQs were updated to match PCI DSS v4.0.1. Depending on your SAQ, check for:

• Roles and responsibilities documented for the requirements that apply to you.
• Targeted risk analyses where the SAQ lets you set your own frequency for a control.
• Third-party service providers, with a list of each provider, its compliance status and which requirements it covers.
• Security awareness training that covers phishing and social engineering, where Requirement 12.6 applies.
• Payment page scripts (6.4.3 and 11.6.1) for SAQ A-EP and SAQ D e-commerce merchants.

For the wider picture, see what changed in PCI DSS 4.0.1.

Do SAQs require scans and penetration testing?

Several do. SAQs that cover internet-facing systems, including A, A-EP, C and D, require quarterly external vulnerability scans by a PCI SSC Approved Scanning Vendor, with passing results. Our PCI ASV scans are delivered through our PCI SSC Approved Scanning Vendor partner, and our guide on how to pass a PCI ASV scan covers the usual failures.

SAQ D includes internal and external penetration testing, and SAQ A-EP external penetration testing, at least every 12 months and after significant change. SAQ D, A-EP, B-IP and C also include segmentation testing (11.4.5) if you rely on segmentation to reduce scope. Our PCI DSS penetration testing is scoped to Requirement 11.4. Your SAQ itself confirms exactly what applies.

Three SAQ mistakes to avoid

• Choosing SAQ A because a payment provider is used, without checking how the payment page is delivered.
• Forgetting a secondary channel, such as phone payments taken by an accounts team.
• Keeping card numbers in email or spreadsheets while claiming no electronic storage.

Our guide to common PCI SAQ mistakes covers eight in detail.

Do I need help to complete an SAQ?

If your set-up is simple and clearly fits one SAQ, you may not. If you have several channels, a checkout that sits between SAQ A and A-EP, or any doubt about scope, a short scoping review is worth the time. It is far easier to fix scope before you submit than after your acquirer questions it. Our PCI DSS consultancy covers SAQ selection, evidence review and completion support, and our guide to PCI compliance cost shows what drives the effort. If you run a small business, our guide to PCI compliance for small businesses covers merchant levels, annual steps and cutting scope.

If your acquirer asks for a QSA-signed SAQ, our guide on how to choose a PCI QSA covers what to check.

How Sovereign Secure can help

As a PCI SSC-approved QSA company, we help merchants confirm scope and choose the right SAQ, and we carry out a full PCI compliance audit where your acquirer requires a Report on Compliance or a QSA-signed SAQ. Tell us how you take payments and we will tell you which questionnaire applies. Advisory and assessment work are kept separate, as the PCI SSC expects of a QSA company.