If your business accepts card payments, you are expected to protect card data under the Payment Card Industry Data Security Standard (PCI DSS). The PCI Security Standards Council writes the standard, but the card brands and your acquirer, the bank that sponsors your merchant account, decide how you prove compliance. For most small merchants, that proof is a self-assessment questionnaire submitted on the schedule your acquirer sets, sometimes with quarterly external scans. How much of the standard applies to you depends mostly on how card data moves through your business.

Key takeaways

  • The Council writes PCI DSS. The card brands run the compliance programs, and your acquirer tells you what to submit.
  • Your level and paperwork depend on your transaction volume and your acquirer's rules, so ask them first.
  • The Self-Assessment Questionnaire (SAQ) you use depends on how you accept cards. Outsourcing card handling usually means a shorter SAQ, but it does not remove your responsibility.
  • PCI DSS v4.0.1 replaced v4.0, which the Council retired on 31 December 2024.

Who writes PCI DSS, and who enforces it?

The Council's PCI DSS page describes the standard as applying to every organization involved in card payments, including merchants, processors, acquirers, issuers and service providers, that stores, processes or transmits cardholder data or could affect its security. Cardholder data means the card number, plus details such as name and expiration date kept with it.

The Council maintains the standard but does not decide who must prove compliance. The same page says that decision belongs to the organizations that run compliance programs, such as a payment brand or acquirer. The Council's merchant resources page notes that each founding brand (American Express, Discover, JCB, Mastercard and Visa) has its own compliance program, and tells merchants to contact their acquirer or the brand about validation and reporting.

Visa's Account Information Security program page says Visa manages enforcement and that acquirers must make sure their merchants validate at the right level. For a small business, the acquirer, or the processor acting for it, is usually the party that asks for your paperwork.

What are merchant levels?

Card brands sort merchants into levels, mainly by transaction count. Visa states that a merchant's total Visa transaction volume over a 12-month period determines its level, and the level shapes what validation the acquirer asks for. Each brand sets its own thresholds, so ask your acquirer which level you are and what it expects.

Which self-assessment questionnaire applies to you?

An SAQ is the Council's validation tool for merchants allowed to assess themselves. Each SAQ covers only the requirements that fit one way of accepting cards. When the Council published the SAQs for PCI DSS v4.0.1 in October 2024, it advised merchants to confirm every eligibility criterion before starting and to check with the organization that will receive the SAQ.

The table shows the SAQ types as the Council described them in 2015, under PCI DSS v3, in Understanding the SAQs for PCI DSS version 3. It may not match the current set. The v4.0.1 SAQs revised several eligibility criteria, and the current list and wording are in the v4.0.1 SAQ Instructions and Guidelines and the SAQs themselves, found with the "SAQ" filter in the PCI SSC Document Library.

SAQSetup it was designed for (2015 description)
AOnline, mail or phone merchants that fully outsource card handling to PCI DSS validated providers
A-EPOnline merchants that outsource processing but whose website affects how the payment page is delivered
BImprint machines or standalone dial-out terminals, no electronic card data storage
B-IPStandalone, PTS-approved terminals connected over IP, no electronic storage
C-VTCard details keyed one at a time into a virtual terminal hosted by a validated provider
CPayment application systems connected to the internet, no electronic storage
P2PEHardware terminals only, inside a validated point-to-point encryption solution
DEvery merchant that does not fit the descriptions above

A PTS-approved terminal is on the Council's list of approved PIN Transaction Security devices. With a point-to-point encryption (P2PE) solution, card data is encrypted at the terminal and stays protected while it crosses your network.

How does outsourcing card handling reduce your scope?

Scope is the set of your people, systems and processes that PCI DSS applies to. The less card data touches your systems, the smaller your scope and, usually, your SAQ.

The Council's 2015 SAQ overview gives an online example. If your site sends shoppers to a validated provider's hosted payment page, or shows that page in an inline frame, SAQ A may fit. If your site builds the payment form itself, or loads scripts that control how card data reaches the processor, SAQ A-EP may apply instead, because your website can still affect the payment.

The v4.0.1 SAQ A has revised eligibility criteria for these setups, as the October 2024 bulletin notes. A February 2025 Council post explains that a site embedding a provider's payment form must be confirmed safe from script attacks, through its own protections or its provider's confirmation; sites that redirect shoppers are not covered by that criterion. Read the current criteria before choosing SAQ A.

The same logic applies in a store. The Council's Questions to Ask Your Vendors guide (2016) says a standalone terminal is simpler to secure than a system linked to many others, and that integration increases PCI DSS scope. If you are weighing integrated payments, knowing which provider does which job helps you see where card data will go.

Outsourcing does not end your responsibility. You are still expected to check that the providers handling card data for you are compliant, and the vendor guide suggests asking for their Attestation of Compliance: the signed document a provider receives after its PCI DSS assessment.

What changed with PCI DSS v4.0.1, and do you need scans?

The Council published PCI DSS v4.0.1 in June 2024 as a limited revision with no added or removed requirements. Version 4.0 was retired on 31 December 2024, leaving v4.0.1 as the supported version. The Council also said 51 of the 64 new requirements in v4.x were future-dated and took effect on 31 March 2025. These dates are as of September 2026; check the Council's site for later revisions.

Some merchants also need external vulnerability scans of their internet-facing systems, run by an Approved Scanning Vendor (ASV), a company the Council has qualified for this work. The Council's ASV resource guide explains that Requirement 11.3.2 calls for passing scans at least once every three months. It notes that v4.x added this to SAQ A for the first time, limited to the system hosting the page that redirects to, or embeds, the provider's payment form. Whether scans apply to you depends on your SAQ and your acquirer.

What should you ask your processor?

Questions drawn from the Council's vendor guide, plus a few about validation:

  1. Which level am I, which SAQ do you expect, and how and when do I submit it?
  2. Do I need quarterly ASV scans?
  3. Can you provide your PCI DSS Attestation of Compliance, and does it cover the service I use?
  4. Are my terminals PTS-approved or part of a validated P2PE solution?
  5. Does anything store card data at my location, and do you need remote access to my payment system?

For an overview of how card security fits into processing, see the site's PCI compliance page. If a breach leads to card misuse, disputes follow their own process, covered in Chargebacks explained.

Frequently asked questions

Is PCI DSS a law?

It is an industry standard applied through the card brands' programs and your merchant agreement. Separate legal obligations may also apply to your business, so ask a qualified advisor.

Do I still need to comply if I never see card numbers?

Usually yes, with a lighter load. Fully outsourced setups often fit a shorter SAQ, and you still validate as your acquirer directs.

Who decides which SAQ I use?

Each SAQ's eligibility criteria define what fits. Confirm your choice with your acquirer before you begin.

Where do I find the official requirements?

The PCI SSC Document Library holds the standard, the SAQs and the SAQ Instructions and Guidelines. Your acquirer tells you what to submit and when.

Sources