SAQ (Self-Assessment Questionnaire)

A Self-Assessment Questionnaire (SAQ) is a compliance validation tool defined by the PCI SSC (PCI Security Standards Council) that allows merchants and service providers meeting certain eligibility criteria to validate their own PCI DSS compliance without engaging a QSA (Qualified Security Assessor) for a full on-site audit. Completing an SAQ and submitting the accompanying AOC (Attestation of Compliance) to the acquiring bank satisfies the compliance validation requirement for merchants below Level 1 (and some service providers).

There are multiple SAQ types, each designed for a specific payment acceptance environment and level of cardholder data exposure. The type a merchant must complete depends on their payment acceptance methods, whether cardholder data touches their systems, and how that data is handled. The most common SAQ types include:

**SAQ A**, for card-not-present merchants who have fully outsourced all cardholder data functions to PCI DSS compliant third parties, with no electronic storage, processing, or transmission of cardholder data on their own systems. This is the simplest SAQ and is available to merchants who collect card data exclusively through a third-party Hosted Payment Page or equivalent.

**SAQ A-EP**, for e-commerce merchants who do not store cardholder data electronically but whose website could affect the security of the payment transaction (for example, merchants who use a redirect but host their own checkout page that could be compromised by scripts).

**SAQ B**, for merchants using standalone dial-out terminals with no electronic cardholder data storage.

**SAQ D**, the most comprehensive SAQ type, for merchants and service providers that do not qualify for any other SAQ type. It covers all PCI DSS requirements.

Under PCI DSS v4.0.1 updates effective in early 2025, the eligibility criteria for SAQ A were revised, adding requirements around script security for e-commerce merchants embedding third-party hosted payment forms in iFrames.