PCI DSS v4.0.1

Which PCI SAQ Do I Need?

Pick your payment channels and get the likely Self-Assessment Questionnaire, merchant level, and fee exposure.

What is a PCI SAQ?

A Self-Assessment Questionnaire (SAQ) is how smaller merchants and some service providers validate PCI DSS compliance themselves, instead of having a Qualified Security Assessor write a Report on Compliance. Each SAQ type covers one way of taking cards, and asks only about the PCI DSS requirements that apply to it. The current standard is PCI DSS v4.0.1; v4.0 was retired on 31 December 2024.

The SAQ types

SAQ	Who it is for
A	Card-not-present merchants that fully outsource all card data functions, for example e-commerce through a redirect or a payment page hosted in an iframe by a PCI DSS compliant provider
A-EP	E-commerce merchants whose own website affects the security of the payment, for example card fields delivered by JavaScript or posted directly from your page to the provider
B	Merchants using imprint machines or standalone dial-out terminals, with no electronic card storage
B-IP	Merchants using standalone, approved payment terminals with an IP connection to the processor
C-VT	Merchants keying card details, one transaction at a time, into a provider's web-based virtual terminal
C	Merchants with payment application systems connected to the internet, with no electronic card storage
P2PE	Merchants using only a validated point-to-point encryption solution
SPoC	Merchants accepting PIN entry on commercial devices, such as phones, through a validated software-based PIN entry solution
D	Everyone else, including any merchant that stores card numbers electronically. There is a separate SAQ D for service providers

If you take cards in more than one way, the heaviest channel usually decides, and your acquirer may ask for one SAQ D instead. The selector above covers the common merchant cases (A, A-EP, B, C-VT, C and D); check the official instructions for B-IP, P2PE and SPoC.

The January 2025 SAQ A change

PCI SSC removed requirements 6.4.3, 11.6.1 and 12.3.1 (the payment-page script controls) from SAQ A. In exchange, a merchant must now confirm, as an eligibility condition, that its site is not susceptible to attacks from scripts that could affect its e-commerce systems. If you cannot confirm that, SAQ A is not the right questionnaire.

Merchant levels

Card brands set validation levels by annual transaction volume. Visa's levels are the usual reference:

Level	Visa transactions a year	Typical validation
1	More than 6 million	Report on Compliance by a QSA
2	1 to 6 million	SAQ, or as your acquirer directs
3	20,000 to 1 million e-commerce	SAQ
4	Fewer than 20,000 e-commerce, or up to 1 million in total	SAQ, as your acquirer directs

Your acquiring bank makes the final decision on which SAQ you file, so confirm with them before you attest.

How to make your SAQ smaller

Never store card numbers. Storing them puts you in SAQ D.
Use a provider's hosted payment page or iframe, so card data never touches your servers.
Keep scripts on your checkout pages under control, so you can meet the SAQ A eligibility condition.
Separate card-handling systems from the rest of your network.

We test and harden the systems around your payment flow. See eCommerce security and VAPT.

Sources

Facts checked against the sources above on 22 October 2026. General information, not legal advice.

How this is calculated

Each payment channel you tick maps to the lightest SAQ it could qualify for: redirect or hosted iframe to SAQ A; JavaScript or direct-post fields on your page to SAQ A-EP; a card form posted to your server to SAQ D; a standalone terminal to SAQ B; card details keyed into a provider’s virtual terminal (mail or phone orders) to SAQ C-VT; an internet-connected payment app to SAQ C.
With several channels, the heaviest one wins, ranked A, B, C-VT, A-EP, C, D.
Two answers override the channel: storing card numbers (PAN) electronically forces SAQ D, and not fully outsourcing card-data functions turns SAQ A or A-EP into SAQ D.
Merchant level comes straight from the transaction band you pick (Level 1 over 6 million, Level 2 1-6 million, Level 3 20,000-1 million, Level 4 under 20,000), following Visa’s published levels.

Constants the tool uses

Unless a value names a study, it is VITI Security's working estimate for budgeting - not taken from a statute or a dated study - so treat it as an adjustable assumption.

Ranking used when channels mix: A < B < C-VT < A-EP < C < D

Worked example

The calculator run on its default inputs:

How do you accept cards? (select all): E-commerce - redirect / hosted iframe (Stripe Checkout, Razorpay, etc.)
Do you store cardholder data (PAN) anywhere?: No
Are all cardholder-data functions fully outsourced to PCI-compliant providers?: Yes
Annual card transactions: 20,000-1 million

Likely SAQ A

Distinguishing rule: SAQ A - all cardholder-data functions outsourced; customers redirected to (or payment page iframed from) a PCI-compliant provider, and your site never touches card data.
Merchant level (approximate): Level 3 - annual SAQ plus quarterly ASV scans (Visa counts e-commerce transactions for this level).
Non-compliance consequences: Card brands can assess the acquirer, which usually passes charges on under your merchant agreement; the amounts are not public. After a breach, expect forensic (PFI) and fraud-loss costs too.

With the defaults (a redirect or hosted payment page only, no stored card numbers, all card-data functions outsourced, 20,000-1 million transactions a year) the result is SAQ A and Level 3: an annual SAQ plus quarterly ASV scans.

Sources

PCI SSC - PCI DSS v4.0.1 published; v4.0 retired 31 December 2024 - which version of the standard is current
PCI SSC - SAQs for PCI DSS v4.0.1 (bulletin) - the SAQ set and what changed in v4.0.1
PCI SSC - Important updates for merchants validating to SAQ A - the January 2025 SAQ A change (script-attack eligibility criterion; 6.4.3, 11.6.1 and 12.3.1 removed)
Visa - compliance validation and merchant levels - Level 1-4 definitions and validation requirements
Visa - security compliance programs - non-compliance assessments are made to the acquirer

Sources last checked September 2026.

Limitations

The selector does not cover SAQ B-IP, SAQ P2PE, SAQ SPoC or the service-provider SAQ, and SAQ eligibility has more conditions than five questions can capture. Card brands count transactions per brand (and Level 3 counts e-commerce only), while this tool uses one total. Your acquirer decides which SAQ you file. This is an indicative estimate for education and planning, not legal advice. Laws and published figures change, and regulators and courts apply discretion no calculator can model - confirm with a qualified legal or compliance professional before acting on a result.