Which PCI self-assessment questionnaire fits how you take cards
How card payment setups map to the PCI DSS self-assessment questionnaires, and the documents each one leaves you with.
A business that takes credit or debit cards agrees, through its bank or payment company, to follow PCI DSS, the card industry's data security standard. Most small merchants show this each year with a self-assessment questionnaire (SAQ). Which SAQ fits depends on how your business takes cards. Your bank (the acquirer) or payment company confirms which applies. PCI DSS explained.
The questionnaires, by how you take cards
| Questionnaire | Fits | Source |
|---|---|---|
| SAQ A | Online sellers whose whole payment page comes straight from a PCI DSS validated payment company, by redirect or by an embedded iframe form, with no part of the page coming from the seller's own site. | source ↗ |
| SAQ A-EP | Online sellers whose own website produces some or all of the payment page and passes card details straight to the payment processor, for example direct post. | source ↗ |
| SAQ B-IP | Businesses whose only card systems are PCI PTS-approved payment terminals that connect to the processor over an IP network, kept apart from other systems. | source ↗ |
| SAQ P2PE | Businesses that take cards only through a validated solution on the PCI SSC list of P2PE solutions and keep no card data in electronic form. | source ↗ |
| SAQ C-VT | Businesses that key one transaction at a time into a web-based virtual terminal run by a PCI DSS validated provider, on a computer kept apart from other systems, including mail and phone orders keyed this way, with no electronic storage. | source ↗ |
| SAQ C | Businesses using payment application systems, such as point-of-sale systems, connected to the Internet and not connected to other systems, with no electronic storage of card data. | source ↗ |
| SAQ D for Merchants | Merchants that store card data in electronic form, encrypted or not, since every other SAQ requires the merchant to attest that it does not. | source ↗ |
A business taking cards in several ways can either fill in a separate SAQ for each channel or one SAQ covering all of them combined. Separate SAQs work only if each channel meets its own SAQ's criteria and the channels are walled off from each other on the network. The acquirer or card brand confirms which SAQ or SAQs apply, and the AOC describes every environment covered. source ↗
What you end up with
- The completed SAQ: The merchant answers each requirement in the SAQ that fits its setup and completes every section. source ↗
- Attestation of Compliance (AOC) for that SAQ: The signed form stating the SAQ was done and giving the result. It comes inside each SAQ and also as a separate document; FAQ 1568 says it is meant to be shared with entities that ask for it. source ↗
- Quarterly ASV external vulnerability scan reports: Scans of the merchant's internet-facing systems by a PCI SSC Approved Scanning Vendor, every quarter, where the questionnaire includes the scan requirement. A public PCI SSC page confirms this for SAQ A; for the other questionnaires, the questionnaire itself says whether scans apply. source ↗
- Attestation of Scan Compliance (from the ASV): The official form an Approved Scanning Vendor issues for the quarterly scan. PCI SSC names it alongside the SAQ, the AOC and the Report on Compliance, and American Express names it for its Levels 2 to 4. source ↗
- P2PE Instruction Manual (PIM) from the P2PE solution provider: Not a filing, but SAQ P2PE eligibility requires the merchant to have put in place every control in it. source ↗
- Other documents the acquirer or card brand asks for: The filing goes to the acquirer or card brand and can include more than the SAQ, AOC and scan reports if they ask. source ↗
PCI SSC recognizes only its own official forms; certificates from vendors or assessors do not count as validation. source ↗
Merchant levels
Each card brand sets merchant levels by yearly transaction count, and the level decides how a business validates.
Visa
| Level | Transactions a year | What it validates |
|---|---|---|
| 1 | More than 6 million Visa transactions a year across all channels, or a global merchant named Level 1 by any Visa region | Each year, a Report on Compliance by a QSA (or by an internal resource if signed by a company officer) plus an Attestation of Compliance |
| 2 | 1 million to 6 million Visa transactions a year across all channels | Each year, complete and submit an SAQ |
| 3 | Fewer than 1 million Visa transactions a year (Visa's wording: 'Less than 1 million Visa ecommerce transactions annually across all channels') | Each year, complete and submit an SAQ |
Visa sets the level from the business's total Visa volume over 12 months, counted per country or per acquirer, and the acquirer makes sure the merchant validates at that level and collects the documents. source ↗
American Express
| Level | Transactions a year | What it validates |
|---|---|---|
| 1 | 2.5 million or more American Express card transactions a year, or named Level 1 by American Express | Annual on-site assessment, Report on Compliance with its AOC, by a QSA or self-certified; a STEP attestation is also accepted |
| 2 | 50,000 to 2.5 million American Express card transactions a year | Annual self-assessment (SAQ) plus ASV external scan report and Attestation of Scan Compliance every 90 days; reporting required |
| 3 | 10,000 to 50,000 American Express card transactions a year (merchants only) | SAQ yearly plus ASV scan every 90 days; reporting only if American Express requires it |
| 4 | Fewer than 10,000 American Express card transactions a year (merchants only) | SAQ yearly; reporting only if American Express requires it. The document list still names the ASV scan report |
American Express sets the level from American Express card volume and may designate a business Level 1. Businesses report to American Express directly through its program administrator, even if they already report to their bank for Visa and Mastercard. source ↗
Discover
| Level | Transactions a year | What it validates |
|---|---|---|
| 1 | 6 million or more Discover Network card transactions a year, or named Level 1 by Discover, or required to validate as Level 1 by another brand or acquirer | On-site assessment by a QSA, quarterly ASV external scan; report the AOC from the Report on Compliance |
| 2 | 1 million to 6 million Discover Network card transactions a year | SAQ, quarterly ASV external scan; report the AOC from the SAQ |
| 3 | All other merchants | SAQ, quarterly ASV external scan; the AOC from the SAQ is sent only when Discover asks |
Discover sets the level from annual volume, the level set by other brands and, in some cases, its own discretion. Where to report depends on whether the business contracts with Discover directly or through an acquirer. source ↗
Mastercard merchant levels are not in our data yet.
Your payment company
Visa's list of registered agents, such as processors and other service providers, that serve Visa clients and merchants and whose PCI DSS validation Visa has on file; a service provider needs QSA validation before it can be listed. Visa Global Registry of Service Providers ↗
Checked against PCI SSC and card brand pages on October 17, 2026.
Get your own answer by email
Need a hand implementing it?
Find a Consultant Who Does This Work
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
From the publisher
Keep Your Written Policies in One Place
Whatever you are working toward, AllyMatter gets your policies approved, keeps every version and records who has read each one.