Also called: SAQ, SAQ A, SAQ D
What a Self-Assessment Questionnaire is
A Self-Assessment Questionnaire, or SAQ, is a set of yes-or-no questions used by eligible merchants and service providers to assess and report how they meet applicable PCI DSS requirements. Each questionnaire is designed for a particular way of accepting payments and handling cardholder data.
An SAQ is a validation tool, not a security certification that removes your responsibility. Payment brands set their own compliance programs, and your acquirer or the relevant payment brand determines which validation and reporting route applies to your business.
Choose the SAQ that matches your actual payment setup, because outsourcing does not erase your compliance responsibility.
How to choose the right SAQ
Your payment setup determines which form fits. SAQ A is for card-not-present merchants that outsource all cardholder-data functions to PCI DSS-compliant third parties. Your systems and premises must not electronically store, process, or transmit cardholder data. It does not cover face-to-face sales.
SAQ A-EP covers certain e-commerce setups where your website does not receive cardholder data but can affect payment security. SAQ B and B-IP address specific standalone terminals or imprint machines. SAQ C-VT covers staff entering one transaction at a time into an internet-based virtual terminal hosted by a validated provider. SAQ D covers merchants that do not fit another questionnaire, as well as eligible service providers.
The questions track applicable PCI DSS requirements. If you answer “no,” the questionnaire can require a remediation date and planned actions. The selected questionnaire comes with an Attestation of Compliance, which records your validation.
Why the right form matters to your business
The SAQ does not set your interchange, network fees, or processor markup. Its financial impact comes from compliance work and the consequences of failing to validate: processors commonly bill a monthly PCI non-compliance fee when a merchant has not validated compliance.
Outsourcing payment handling can reduce the number of PCI DSS requirements that apply, but it does not remove your compliance responsibility. A PCI-listed point-to-point encryption solution can also reduce applicable requirements, while systems that encrypt, decrypt, or manage encryption keys remain in scope. As of 2026, PCI DSS v4.0.1 is current, and 51 future-dated requirements became mandatory on March 31, 2025.
Where it appears on your statement
The SAQ itself is a validation form, not a card-processing charge. Look for a line labeled “PCI non-compliance fee” or a similar PCI fee, then compare the charge with your validation status. A monthly fee for an unvalidated account is separate from the SAQ and does not complete it for you.
What you can actually change
- Map your payment setup. List each way you accept cards, including in-person terminals, hosted checkout, and staff-entered virtual terminal payments. Use the applicable SAQ eligibility criteria for each environment.
- Confirm your form. Match your setup to the SAQ descriptions, then confirm the required validation and reporting route with your acquirer or payment brand. Do not choose a shorter questionnaire just because it seems easier.
- Track validation and fees. Keep your completed SAQ and Attestation of Compliance. If your statement shows a PCI non-compliance fee, compare it with your current validation status and the reporting requirement for your account.
Frequently asked questions
Does every merchant have to complete an SAQ?
PCI DSS applies to entities involved in payment-card processing, but SAQs are for merchants and service providers eligible to use them. Payment brands set their compliance programs, and your acquirer or relevant payment brand determines the validation and reporting requirement for your business.
What is the difference between SAQ A and SAQ D?
SAQ A applies to qualifying card-not-present merchants that outsource all cardholder-data functions and do not electronically store, process, or transmit cardholder data on their systems or premises. SAQ D is for merchants that do not fit another SAQ description and for eligible service providers.
Does completing an SAQ remove my PCI DSS responsibility?
No. The SAQ documents your self-assessment for the applicable requirements. Outsourcing payment functions or using a validated point-to-point encryption solution can reduce applicable requirements, but neither removes PCI DSS applicability or your responsibility to validate.
Is a PCI non-compliance fee the cost of the SAQ?
No. The SAQ is a validation tool, and the research does not specify a standard fee for the questionnaire itself. A processor may bill a monthly PCI non-compliance fee when your business has not validated compliance; check your statement for that separate charge.