Guide
ROC vs SAQ: which PCI report applies to you
The ROC vs SAQ choice is usually made for you. Your acquirer or card brand sets which validation applies, mostly based on transaction volume and how you take payments.
- We prepare, a QSA assesses
- Published price ranges
- Written estimate, no call
ROC vs SAQ in one table
Both lead to an Attestation of Compliance. However, they differ in who performs the work.
| ROC | SAQ | |
|---|---|---|
| Who completes it | A QSA, or a qualified internal assessor where allowed | The merchant or service provider |
| Who must use it | Usually level 1 entities | Most smaller merchants |
| Depth | Full assessment of every requirement in scope | Questionnaire for the channel type |
| Output | Report on Compliance plus AOC | Completed SAQ plus AOC |
Who decides ROC vs SAQ
Your acquirer decides, following card brand rules. So ask in writing which validation it expects. Also ask again when volume grows.
Because the rules differ by brand and acquirer, a written answer protects you.
ROC vs SAQ: your check
Tick what you have confirmed.
Your result appears here as you tick, so you can see what is still open.
When an SAQ fits
SAQs suit smaller merchants. The type depends on the payment channel, for example a hosted payment page or a terminal. Then the questionnaire covers only the matching requirements.
However, an SAQ is still a signed statement. So the answers must be backed by evidence.
ROC vs SAQ for service providers
Service providers have their own levels. Larger ones usually need a ROC. Meanwhile, smaller ones may use the service provider SAQ.
Also customers often ask service providers for their AOC, whichever route applies.
Moving from SAQ to ROC
Growth can push you to a ROC. So plan a year ahead. A QSA assessment needs more evidence and more time than a questionnaire.
As a result, starting with a gap analysis is common.
Where Ashcroft helps
We confirm which validation applies, support SAQ completion and prepare you for a QSA when a ROC is needed. SAQ support runs $500 to $20,000. We are not a QSA. The forms are in the PCI SSC document library.
ROC vs SAQ questions
Who chooses ROC vs SAQ?
Your acquirer, following card brand rules.
Is ROC vs SAQ only about volume?
Mostly volume, but breaches and acquirer rules can also matter.
Do both ROC vs SAQ routes produce an AOC?
Yes. Each ends with an Attestation of Compliance.
Can we choose a ROC voluntarily?
Yes. Some merchants do, often for customer assurance.
Related guides
Settle the ROC vs SAQ question
Tell us your volume and payment channels. We reply with a written estimate, usually inside one business day.
Get my written estimate