Guide
The PCI level 4 self assessment for small merchants
A PCI level 4 self assessment is how most small merchants validate PCI DSS each year. So the work is usually a questionnaire, not an on-site audit, but it still needs honest answers.
- We prepare, a QSA assesses
- Published price ranges
- Written estimate, no call
Who files a PCI level 4 self assessment
Card brands set merchant levels by annual transaction volume. For Visa, level 4 covers fewer than 20,000 e-commerce transactions a year. It also covers merchants processing up to one million transactions in total. However, your acquirer has the final word on your level.
What the PCI level 4 self assessment includes
Most level 4 merchants file a Self-Assessment Questionnaire and an Attestation of Compliance. Also, quarterly external scans apply when you have internet-facing systems in scope.
| Item | Usually required? |
|---|---|
| Self-Assessment Questionnaire | Yes, the type matching how you accept cards. |
| Attestation of Compliance | Yes, signed by you. |
| Quarterly ASV scans | When in-scope systems face the internet. |
| On-site QSA assessment | Rarely, unless your acquirer asks. |
PCI level 4 self assessment check
Tick what you already know. Unknowns are fine to start with.
Your result appears here as you tick, so you can see what is still open.
Choosing the right PCI level 4 self assessment form
The form depends on payment flow, not size. For example, a fully hosted checkout often fits SAQ A, while a terminal on a phone line fits SAQ B.
Mistakes small merchants make
Many merchants pick the shortest form by habit. However, the wrong form can leave real gaps, and a breach exposes them. Also, answers must reflect what is true now, not last year.
Where we help
SAQ completion support runs $500 to $20,000, depending on complexity. We are not a QSA, so you sign your own attestation. Card brand guidance is on the Visa merchant compliance guidance page.
Also keep a short file for next year. For example, note which SAQ you chose and why, plus any changes to how you take cards. So the next PCI level 4 self assessment starts from facts, not memory. In addition, tell your acquirer promptly if your volumes grow, because a new level brings new validation rules.
PCI level 4 self assessment questions
Is a PCI level 4 self assessment mandatory?
Your acquirer decides, but most require annual validation.
Who signs the PCI level 4 self assessment?
An officer of your business signs the attestation.
How long does a PCI level 4 self assessment take?
It depends on the SAQ type and your evidence. Simple forms take far less time than SAQ D.
What happens if we skip it?
Acquirers can charge non-compliance fees, according to your merchant agreement.
Related guides
Get help with your PCI level 4 self assessment
Answer five questions and receive a written estimate, usually inside one business day. Nothing starts until you agree.
Get my written estimate