The PCI Self-Assessment Questionnaire (SAQ) is how eligible merchants validate the PCI DSS controls that apply to them. The catch: the right SAQ depends on how you actually take payments, not on which form looks shortest.
Retail is a real target. The 2025 Verizon DBIR counted 837 retail incidents, with payment data compromised in 12% of retail breaches. This guide covers the retail-relevant SAQ types, how they differ, and what to check before you pick one.
Key Takeaways
- An SAQ reports your validation; it doesn't replace PCI DSS or guarantee security.
- Channel, terminal connectivity, outsourcing, data storage, and P2PE or SPoC use decide your SAQ.
- Multichannel retailers may not qualify for the simplest form.
- Confirm your choice with your acquirer or processor, and reassess after any system change.
What Is a PCI SAQ and Why Is It Important for Retail Merchants?
What Is a PCI SAQ?
The PCI Security Standards Council (PCI SSC) defines SAQs as validation tools for eligible merchants and service providers to perform and report their PCI DSS self-assessment. Three documents work together:
- PCI DSS is the security standard itself.
- The SAQ reports your assessment against the requirements that apply to your environment.
- The Attestation of Compliance (AOC) declares your eligibility for that SAQ and attests to the results.
Completing an SAQ documents your validation. It doesn't remove your security responsibilities.
Why Is a PCI SAQ Important for Retail Merchants?
Retail environments carry practical risks:
- Exposed terminals
- Poorly secured networks
- Unauthorized access
- Vulnerable integrations
- Card data kept by accident
The SAQ forces you to look at each one.
Your acquiring bank or payment brand decides what you must submit. Merchant level, based on brand-specific transaction volume, shapes the validation method. Volume alone does not replace technical eligibility.
Before choosing a form, map how card data enters, moves through, and leaves your business. This matters most when you combine in-store POS, online ordering, mobile sales, and phone orders. PCI DSS calls for account-data flow diagrams and scope confirmation at least every 12 months and after any significant change.
Types of PCI SAQs for Retail Merchants
Eligibility comes from your exact payment architecture. Don't pick the shortest questionnaire, or the one similar businesses use. Current merchant forms (v4.0.1) include A, A-EP, B, B-IP, C, C-VT, P2PE, SPoC, and D.
SAQ A and SAQ A-EP for Online and Other Card-Not-Present Payments
SAQ A fits e-commerce or mail/telephone order merchants that fully outsource card processing to compliant third parties. Nothing is electronically stored, processed, or transmitted on your systems or premises.
SAQ A-EP is for e-commerce merchants whose website doesn't receive card data but controls how customers are redirected to the payment page. Because your site can affect transaction security, more controls apply.
Key differences:
- With SAQ A, payment-page elements come only from the compliant provider. With A-EP, they may come from you.
- SAQ A-EP carries heavier website security duties.
- Both require quarterly ASV scans.
The January 2025 revision of SAQ A, effective March 31, 2025, removed requirements 6.4.3, 11.6.1 and 12.3.1 from the form. It also added a criterion: you must confirm your site isn't susceptible to script attacks.
PCI SSC FAQ 1588 limits that criterion to embedded payment pages such as iframes, not redirects. Verify current criteria before you attest.
SAQ B and SAQ B-IP for Standalone Payment Terminals
SAQ B covers narrow setups: imprint machines or standalone dial-out terminals on a phone line. They connect to no other merchant system or the internet, and nothing is stored electronically.
SAQ B-IP covers standalone, PCI-listed PTS terminals connected to the processor over IP. The terminal must be isolated from other merchant systems, and the only data transmission is terminal to processor. That adds network considerations, and ASV scans apply.
A small shop with one dedicated terminal fits well. Add a POS integration, a shared network, or a connected computer, and eligibility can change.
SAQ C and SAQ C-VT for Internet-Connected Payment Applications
SAQ C fits merchants whose payment application or POS connects to the internet, with no electronic card storage. The system must be isolated from other merchant systems, and the LAN must serve one store only.
SAQ C-VT is for merchants who manually key card data into a browser-based virtual terminal hosted by a compliant provider. A retailer taking phone orders is the classic case. The computer must be isolated in one location.
Watch the operational risks:
- Shared workstations
- Call recording that captures card numbers
- Weak access control
- Card data written down and kept
C-VT differs from a fully outsourced flow like SAQ A, because your staff handle the data themselves.
SAQ P2PE-HW and SAQ SPoC for Validated Payment Solutions
SAQ P2PE applies when all processing runs through a PCI-listed P2PE solution, using only that solution's terminals. You must implement every control in the P2PE Instruction Manual.
SAQ SPoC applies to attended, card-present transactions using a PCI-listed solution on a commercial phone or tablet with its approved secure card reader. It excludes unattended, MOTO, and e-commerce.
"Encrypted," "secure," or "P2PE-ready" isn't enough. Confirm the exact listed solution, version, approved hardware, and deployment conditions on the official P2PE and SPoC lists.
A listing alone doesn't establish your compliance.
SAQ D for Merchants
SAQ D for Merchants is the broadest form. It applies when you're eligible to self-assess but don't meet another SAQ's criteria, including when you store, process, or transmit card data directly.
Having a POS, multiple stores, or an online presence doesn't automatically mean SAQ D. The full cardholder-data environment decides.
SAQ D for Service Providers is a separate form, not meant for retail merchants. Confirm the distinction with your acquirer or assessor.
How to Choose the Right PCI SAQ
Fit, scope, and documented eligibility decide the form. Popularity, convenience, and question count don't. Work through these steps:
- Map every channel. Include in-store terminals, mobile checkout, online ordering, recurring payments, mail and phone orders, refunds, and marketplaces.
- Trace the data. Note whether card data is entered, processed, transmitted, or stored by your POS, computers, servers, website, network, or phone system.
- Review terminals and networks. Are terminals standalone, IP-connected, integrated with the POS, on shared wireless, or part of a P2PE or SPoC solution?
- Check third-party duties. Request current compliance documentation from processors, gateways, POS vendors, and hosts. Requirement 12.8.5 expects you to know which controls the provider manages, which you manage, and which are shared. A compliant provider doesn't make you compliant.
- Weigh ongoing effort. Consider staffing, documentation, scans, vendor management, and growth, not just which form looks easier.
Multiple channels add a wrinkle. Per PCI SSC FAQ 1082, separate SAQs can cover separate channels if each meets its criteria and the channels are adequately segmented. Otherwise one SAQ may need to cover the combined scope. Record covered environments in AOC Part 2.
POS choice matters too. AMS Retail Solutions provides NCR Voyix Counterpoint as a single-source POS for specialty retailers. But a POS brand doesn't decide SAQ eligibility. Evaluate the complete payment and network configuration with your processor or assessor.
What to Check Before Finalising a PCI SAQ Type
What to Check Before Finalizing a PCI SAQ Type
Run through these before you submit:
- Confirm exact eligibility. Check electronic storage, payment-page control, terminal connectivity, and validated-solution requirements. Don't assume.
- Look for scope creep. New online ordering, extra locations, mobile devices, POS integrations, shared networks, and third-party software can change your form.
- Plan recurring work. ASV scans at least every three months apply to SAQs A, A-EP, B-IP, C, and D. Also budget for vendor documentation, access reviews, incident response, and updates after system changes.
- Get a second opinion. Have your acquirer, processor, payment brand, or a qualified PCI professional confirm the SAQ. Ask what documents, scans, attestations, and remediation records to keep.
Note that SAQ instructions set no universal retention period for completed SAQs, so ask your acquirer.
Conclusion
PCI SAQs help eligible retailers validate the controls relevant to their payment environment. They only work when the form matches how you really accept and handle payments.
Different SAQs serve different mixes of online, in-person, virtual-terminal, IP-connected, P2PE, SPoC, and direct-handling scenarios. Document your payment flows, confirm eligibility with your acquirer or processor, and reassess whenever you add a channel, terminal, integration, or new payment process.
Frequently Asked Questions
What is a PCI SAQ?
A PCI SAQ is a validation tool for eligible merchants to assess and report on applicable PCI DSS requirements. Completing it doesn't end your broader security responsibilities.
How much does it cost to complete a PCI SAQ?
Costs vary with your environment. They can include internal labor, ASV scans, remediation, professional help, and processor fees. Some processors charge for noncompliance, so ask your acquirer what applies.
What are the 12 PCI DSS requirements?
They span network security, data protection, access control, monitoring and testing, and security policies (12 in total). Each SAQ includes only the requirements that fit its eligible environment.
Which PCI SAQ is right for a retail merchant?
It depends on your channels, terminal and network setup, outsourcing, data storage, and any P2PE or SPoC solution. Confirm the result with your acquirer or processor.
Can a retail merchant need more than one PCI SAQ?
Possibly. Separate channels can use separate SAQs if each is eligible and properly segmented. Otherwise assess the combined scope, and follow your acquirer's required method.
How often do retail merchants complete a PCI SAQ?
Validation is commonly annual, and may be needed after major changes or incidents. Follow the schedule and submission instructions from your acquirer or payment brand.
