PCI Compliance for Small Business: Which SAQ Do You Need?
PCI compliance for small business, simplified: match your card setup to the right SAQ, handle scans, and stop paying monthly non-compliance fees.
Photo: Pixabay
On this page 7 sections
- What PCI Compliance for Small Business Actually Requires
- PCI SAQ Types: Choosing by How You Accept Cards
- PCI Non-Compliance Fees and How to Remove Them
- Vulnerability Scans: Who Needs Them
- Reducing Scope With Hosted Checkout and Tokenization
- How to Become PCI Compliant Every Year: Annual Renewal Checklist
- Next Steps
Key takeaways
- Your SAQ depends on whether card data touches systems you control. Your business size and industry don't decide it.
- A monthly PCI non-compliance fee usually stops once you finish a validation, but confirm the timing with your processor.
- Hosted checkout, tokenization and encrypted terminals can shrink your scope and shorten your questionnaire.
- Revalidate every year, and re-check your SAQ whenever you change equipment, software or sales channels.
You may have a "PCI non-compliance" charge on your processing statement, or an email from your processor asking you to "validate." Either way, you're dealing with PCI compliance for small business. For most low-risk merchants, the security work is not the hardest part. The hardest part is figuring out which self-assessment questionnaire (SAQ) matches the way you take cards. This guide covers what the standard asks of small merchants, how to pick your SAQ based on your actual setup, when vulnerability scans apply, how to get non-compliance fees removed and how to keep the annual renewal painless.
A note before you start: The PCI Security Standards Council maintains PCI DSS and revises the SAQ forms and their eligibility criteria over time. This article is a plain-English summary for general information. It is not the official criteria and not legal or security advice. Confirm the current form version in your processor's compliance portal or on the PCI Security Standards Council website. If your setup is complex, talk to a qualified security professional.
What PCI Compliance for Small Business Actually Requires
PCI DSS (the Payment Card Industry Data Security Standard) is a set of security requirements created by the major card brands. It is not a government regulation. You are bound to it through your merchant agreement, so your processor is the one who asks you to prove compliance.
The card brands sort merchants into levels based on annual transaction volume. Most small businesses fall into the lowest level. At that level, you can usually self-assess with an SAQ instead of paying for an on-site audit. Your processor can tell you which level applies to you.
For a typical small merchant, validation comes down to three tasks:
- Complete the correct self-assessment questionnaire. This is a set of yes/no/not-applicable questions about how you handle card data.
- Pass external vulnerability scans, if your SAQ requires them.
- Sign an Attestation of Compliance (AOC). This is your formal statement that the answers are accurate. It is often built into the portal.
You repeat all three every year.
Keep in mind the difference between validating and being compliant. Validation is the paperwork. Compliance is how you operate every day: who can access your terminals, whether staff write card numbers on sticky notes, whether your Wi-Fi is locked down. The SAQ is only useful if your answers describe what really happens.
PCI SAQ Types: Choosing by How You Accept Cards
One question decides your SAQ: does cardholder data pass through or get stored on any system you control? Your industry doesn't decide it, and neither does your size. Your payment flow does.
Here is a simplified overview of the main merchant SAQ types:
| SAQ | Generally For | Small-Business Example |
|---|---|---|
| A | Card-not-present merchants that fully outsource payment handling to a PCI-compliant provider | Online store using a checkout page hosted entirely by the gateway or platform |
| A-EP | E-commerce sites that don't receive card data but control how the payment page is delivered | Your own site's payment form posts directly to the gateway or loads its scripts |
| B | Merchants using only imprint machines or standalone dial-out terminals, with no electronic storage | A shop with an analog phone-line terminal |
| B-IP | Merchants using only standalone, approved terminals that connect to the processor over IP | A countertop terminal on your internet connection, not tied to a POS |
| C-VT | Merchants keying one transaction at a time into a web-based virtual terminal | Staff entering phone orders into a browser-based terminal |
| C | Merchants with payment software or POS systems connected to the internet, with no stored card data | A POS computer that handles card data before sending it to the processor |
| P2PE | Merchants using only terminals from a validated point-to-point encryption solution | Encrypted terminals listed under a validated P2PE program |
| D | Everyone else, including anyone who stores card data electronically | A business keeping card numbers in a spreadsheet or customer database |
Newer acceptance methods, such as taking payments on a phone or tablet, may use other forms. Ask your processor if that describes you.
Common Setups Matched to an SAQ
Retail stores. A standalone countertop terminal connected over your network often points to SAQ B-IP. If the terminal belongs to a validated P2PE solution, you may qualify for the shorter P2PE questionnaire. Integrated POS systems are different. If card data flows through POS software on an internet-connected computer, you're typically in SAQ C territory. Many modern setups send card data straight from the terminal to the processor, so the POS never sees it. Ask your provider how your equipment handles that.
Restaurants and bars. The terminal logic is the same as retail, with a few extra risk points. Pay-at-table handhelds keep the card in the guest's sight, which helps. Phone-in takeout orders matter more. If staff key numbers into a virtual terminal on a dedicated device, that usually maps to C-VT. If they jot card numbers on order tickets, that paper is in scope and the practice should stop. For tabs, a proper preauthorization flow is safer than writing down card details. Our guide to bar tab preauthorization and closing tabs safely covers the workflow.
Low-risk e-commerce. Checkout design drives everything here:
- Hosted checkout or a gateway-served iframe: generally SAQ A.
- Your page hosts the form and posts card data directly to the gateway: generally A-EP, because your site affects the security of the transaction.
- Your server receives card numbers: SAQ D.
Professional services. Firms that email invoices with processor-hosted payment links are often in SAQ A territory. Staff who take card numbers over the phone and enter them into a virtual terminal for phone and mail orders usually fit C-VT, as long as the device is used for little else. Keeping client card numbers in files, a CRM or a spreadsheet pushes you into SAQ D. Tokenized card-on-file is the better answer.
Mixed channels. If you sell in person and online, ask your processor whether they want one SAQ that covers everything or a separate form for each channel. The difference between the two is explained in our breakdown of card-present vs. card-not-present rules.
PCI Non-Compliance Fees and How to Remove Them
A PCI non-compliance fee is a recurring charge many processors add when they don't have a current validation on file for your account. Your processor sets the amount and the billing frequency, so check your statement and merchant agreement for the exact terms.
Don't confuse it with other PCI-related charges:
| Charge | What It Usually Means | Goes Away When You Validate? |
|---|---|---|
| PCI non-compliance fee | Penalty-style charge for missing or expired validation | Typically yes. Confirm timing. |
| PCI program or annual compliance fee | Fee some processors charge for portal access, scanning tools or support | Usually no. It's part of your pricing. |
If you're not sure which one you're paying, our guide to merchant services fees you need and ones to skip can help you read the line items.
Steps to Stop the Monthly Charge
- Find the line item on your statement and note when it started.
- Locate your compliance portal login. It's often in your welcome email or listed on your statement. If you can't find it, call your processor.
- Answer the setup questions honestly. Most portals ask how you accept cards and then assign an SAQ.
- Complete the questionnaire and fix anything you can't truthfully answer "yes" to.
- Run and pass scans if your SAQ requires them.
- Sign the AOC and download copies of everything.
- Confirm with your processor when the fee will stop, then check your next statement.
You can ask whether past non-compliance fees can be credited. Policies vary, so don't count on it.
Don't answer your way into an easier SAQ. Picking answers just to get a shorter form misrepresents your environment. If a breach happens, an inaccurate attestation can leave you exposed. If your real setup lands you in a longer SAQ, change the setup instead. The next section shows how.
Vulnerability Scans: Who Needs Them
An external vulnerability scan checks the internet-facing parts of your environment, such as your website or the public IP address of your store network, for known weaknesses. An Approved Scanning Vendor (ASV) must run it, you must pass it, and it repeats on a schedule set by the standard. Your compliance portal will show your due dates.
General guidance by SAQ:
| SAQ | Scans Typically Required? |
|---|---|
| A | Check your current version. Requirements for e-commerce sites have changed in recent revisions. |
| A-EP | Yes |
| B | No (no internet-connected payment systems) |
| B-IP | Typically yes |
| C-VT | Typically no |
| C | Yes |
| P2PE | No |
| D | Yes |
Confirm against the current form, because requirements can change between versions.
When a Scan Fails
Common causes include outdated website software, unnecessary open ports, weak encryption settings and default router configurations. Send the report to your web host, IT provider or internet service provider. Have them fix the issues, then rescan. If you believe a finding is a false positive, most ASVs have a dispute process that requires documentation.
Reducing Scope With Hosted Checkout and Tokenization
The smaller your scope (the systems that touch card data), the shorter your questionnaire and the lower your risk. Practical ways to shrink it:
- Use hosted checkout pages. Payment gateways with hosted checkout options keep card numbers off your web server entirely.
- Tokenize card-on-file. Store a token from your gateway instead of the card number. This suits retainers, deposits and repeat clients.
- Choose encrypted terminals. Smart payment terminals that encrypt card data at the point of entry, especially within a validated P2PE solution, can sharply reduce in-store scope.
- Isolate the virtual terminal. Use a dedicated device for keyed transactions. No personal browsing, no email.
- Close side doors. Never accept card numbers by email, text or chat. Shred any paper that holds card data.
- Separate networks. Keep guest Wi-Fi off the network your payment devices use.
How to Become PCI Compliant Every Year: Annual Renewal Checklist
Use this list each year before your validation expires:
- Put your expiration date on the calendar, with a reminder a few weeks ahead.
- Re-confirm how you accept cards in every channel: counter, tableside, phone, online and invoices.
- Check that your SAQ still matches. New equipment, a new website platform or a new sales channel can change it.
- Update router, POS and website software. Change any default passwords.
- Inspect terminals for tampering and keep an inventory of devices and serial numbers.
- Remind staff about card-handling rules, especially around phone orders.
- Run any required scans early enough to fix problems before the deadline.
- Complete the SAQ, sign the AOC and save copies with your business records.
- Confirm your processor shows you as compliant, and check that no non-compliance fee appears on your next statement.
If your setup changed midyear, don't wait for renewal. Read our guide on when to tell your payment processor about business changes.
Next Steps
PCI compliance for small business is manageable once you match your real payment flow to the right SAQ. Simpler, more contained setups usually mean shorter forms, fewer scans and fewer surprise charges.
If you're shopping for new equipment or online checkout, MannyPay offers POS systems, card terminals, virtual terminals and gateway integrations. You can request a free quote from MannyPay, and a specialist will respond within one business day. Bring your questions about how a new setup could affect your SAQ.
This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.
