Tool · PCI DSS v4.0.1
Which SAQ do I need?
There are eight self-assessment questionnaires, and picking the wrong one wastes weeks. Answer a few questions about how you take payments and get an answer in about 30 seconds.
Your SAQ is decided by how card data reaches you, not by the size of your business. Hosted checkout → SAQ A. Embedded fields on your own page → SAQ A-EP. Card data on systems you control, or stored at all → SAQ D.
Which SAQ do I need?
answer belowTick everything that applies to how you take payments. The answer updates as you go.
Your result will appear here.
This tool gives an indication based on common setups. It is not a substitute for the official SAQ eligibility criteria — confirm your type with your acquirer before you file. Requirements differ by SAQ and change over time.
Why the right SAQ matters more than anything else
Almost every expensive PCI mistake traces back to scope. Pick the wrong questionnaire and one of two things happens: you spend months on controls that never applied to you, or you attest to something you do not actually do — which is far worse, because your attestation is what protects you when something goes wrong.
The single biggest lever is architectural. Moving from a checkout where card data touches your servers to a fully hosted one can take you from SAQ D down to SAQ A. That is the difference between a project and a form.
The three things that most often decide it
- Where does the customer type their card? If it is entirely on the provider’s page, you are usually in SAQ A territory. If those fields are embedded in your page, it is A-EP. If it is your own form, it is D.
- Does card data ever live on a system you control? Storage of any kind — database, spreadsheet, CRM, ticket — pushes you to SAQ D. The usual fix is to stop storing it.
- What happens in person? Standalone terminals land in SAQ B or B-IP depending on how they connect. Internet-connected POS setups move you to SAQ C, which is substantially more work.
What to do once you know your SAQ
- Work the checklist. The PCI compliance checklist walks through scope, tasks, evidence and a cost worksheet in order.
- Check what it should cost. See the 2026 cost breakdown before you accept any quote — especially for scans and pen tests.
- Look at your processor statement. If you are paying a monthly “PCI fee”, it is usually a non-compliance penalty that disappears once your SAQ is filed.
Take the checklist with you
The printable checklist and cost worksheet, in one place — so you can work through your SAQ without re-reading the standard.
No spam. Unsubscribe anytime.No spam. Unsubscribe anytime.FAQ
What is a SAQ?
A Self-Assessment Questionnaire — the form most merchants complete each year to attest that they meet the PCI DSS requirements that apply to them. There are several types, and which one you file depends on how card data reaches you.
How do I know which SAQ applies to me?
It comes down to how you take cards. A fully hosted checkout usually means SAQ A. Embedded fields on your own page usually means SAQ A-EP. If card data reaches systems you control, or you store it, expect SAQ D.
Can I just pick the easiest SAQ?
No. Your SAQ eligibility is defined by your setup, not your preference. Filing the wrong one is a common and expensive mistake — it can invalidate your attestation and leave you exposed after a breach.
What if more than one SAQ applies to me?
That is common — for example, a hosted online store plus a shop terminal. You generally have to meet the requirements of each applicable SAQ, or restructure so each channel is cleanly scoped.
Do I need ASV scans with my SAQ?
It depends on the type. SAQ A generally does not require ASV scans. SAQ A-EP, B-IP, C and D typically do, and most Level 3 merchants do too. Check the current SAQ document for your type.
Reviewed October 2026. General information, not legal or compliance advice. Confirm your SAQ type against the current PCI DSS documentation or with your acquirer. Corrections welcome.