Guide
PCI SAQ types: how to tell which form is yours
The PCI SAQ types are self-assessment questionnaires for businesses that do not need a full assessor report. Which one applies depends entirely on how you take payments, so choosing correctly matters.
- We prepare, a QSA assesses
- Published price ranges
- Written estimate, no call
The main PCI SAQ types
Each form fits a payment method. The shortest runs a few pages, while the longest runs past 300 questions. The forms are in the PCI SSC document library.
| SAQ | Fits |
|---|---|
| A | Card-not-present, fully outsourced payment pages. |
| A-EP | E-commerce where your site affects the payment page. |
| B | Imprint machines or standalone dial-out terminals. |
| B-IP | Standalone terminals connected over IP. |
| C-VT | Manual entry into a provider's virtual terminal. |
| C | Payment applications connected to the internet, no storage. |
| P2PE | Validated point-to-point encryption terminals. |
| D | Everything else, including any storage of card data. |
Choosing between the PCI SAQ types
Start from the payment flow, not the business type. For example, an online shop using a redirect to a hosted page may fit SAQ A, while one that embeds payment scripts on its own page usually fits A-EP. Therefore draw the flow before choosing.
Which of the PCI SAQ types fits you?
Tick what describes your payments. It narrows the form quickly.
Your result appears here as you tick, so you can see what is still open.
Why the wrong form is expensive
Choosing a shorter form than you qualify for leaves gaps, so a bank or assessor may reject it. Choosing a longer one wastes effort. Also, using several payment channels can mean you need SAQ D, because combined channels rarely fit a short form.
If you take payments in several ways, ask your acquirer which form it expects. Their answer is the one that counts.
Who signs the questionnaire
You do. A consultant may help you understand and complete it, but your executive signs it. So the answers must be true, because the signature carries responsibility.
Our role with PCI SAQ types
We help you identify the right form, reduce scope where possible and prepare the evidence. However, we are not a QSA, and we do not sign anything on your behalf.
PCI SAQ types questions
Who decides which of the PCI SAQ types applies?
Your payment flow does, and your acquirer confirms it.
Can we use more than one SAQ?
Some businesses with separate channels do, although combined channels often mean SAQ D.
Do PCI SAQ types include scans?
Several forms require quarterly ASV scans, so check yours.
Can a consultant sign our SAQ?
No. Your executive signs it.
Related guides
Find the right form before you start
Describe how you take payments. We reply with the likely SAQ and a written readiness estimate.
Get my written estimate