If you’ve ever heard the term SAQ (sometimes pronounced like “sack”), they are referring to a Self-Assessment Questionnaire.

PCI allows merchants who only process a certain number of transactions annually to complete a SAQ.

If you are a service provider and are able to self-assess, the only SAQ you are allowed to use is SAQ D (Service Provider).

Merchants are required to submit one or more SAQs based on the payment channel or channels that you support. You should always get confirmation from your acquiring bank on which SAQ or SAQs they need you to submit. Especially if you have multiple payment channels.

Each SAQ has a set of criteria that you must meet in order to use that SAQ. If you do not meet these criteria, you will need to use a different SAQ. If you aren’t sure, please contact your bank. For every SAQ except D, you must confirm that you do not store any cardholder data. A data discovery tool (for example, card scanning) can be used to demonstrate that you do not store cardholder data.

The table below provides a quick summary of each of the SAQs.

SAQ Summary of Applicable Channel Allows Storage of CHD
A Card-not-present merchants that have fully outsourced all cardholder data functions to PCI DSS validated third-party service providers. No storage, processing, or transmission of cardholder data on the merchant systems or premises. No
A-EP E-commerce merchants who outsource all payment processing to PCI DSS validated third parties and who have one or more websites that don’t directly receive cardholder data but can impact the security of the payment transaction. No storage, processing, or transmission of cardholder data on the merchant systems or premises. No
B Merchants using either imprint machines and/or standalone, dial out terminals. No electronic storage of cardholder data. No e-commerce. No
B-IP Merchants using standalone PTS-approved payment terminals with an IP connection to the payment processor. No electronic storage of cardholder data. No e-commerce. No
P2PE Merchants using only hardware payment terminals included in and managed via a PCI SSC listed P2PE solution. No electronic storage of cardholder data. No e-commerce. No
C Merchants with payment application systems connected to the internet. No electronic storage of cardholder data. No e-commerce. No
C-VT Merchants who manually enter a single transaction at a time via a keyboard into an internet-based virtual terminal solution provided and hosted by a PCI compliant third party service provider. No electronic storage of cardholder data. No e-commerce. No
D All other merchants not included in the descriptions above. Merchants with multiple payment channels. Merchants that store cardholder data. If Protected