PCI compliance for small merchants, minus the confusion

The short answer

Any business that accepts credit or debit cards must follow the Payment Card Industry Data Security Standard (PCI DSS). As of 2026 the current version is PCI DSS v4.0.1; version 4.0 was retired at the end of 2024 and the requirements that had been future-dated became mandatory on March 31, 2025. Most small merchants prove compliance each year by completing a Self-Assessment Questionnaire (SAQ) and, for some setups, passing quarterly external vulnerability scans by an Approved Scanning Vendor.

Which SAQ you complete depends on how you take payments, and your payment processor or acquiring bank decides what you must submit. The most useful move for a small business is to reduce scope: keep card data off your own systems entirely by using hosted checkouts and validated payment terminals. That can turn a questionnaire of hundreds of items into a short one.

Who decides what you have to do

Three parties are involved, and knowing who does what removes most of the confusion.

• The PCI Security Standards Council writes the standard and the SAQs.
• The card brands (Visa, Mastercard and others) set merchant levels based on annual transaction volume and decide how compliance is validated and enforced. Visa, for example, assigns levels based on 12 months of total Visa volume.
• Your acquirer or payment processor tells you which level you are, which SAQ to submit and whether scans are needed. Many processors charge a monthly non-compliance fee until you submit.

Small merchants usually fall into the lowest volume level, which means self-assessment rather than an outside audit. Log in to your processor’s portal or call them to confirm your level and SAQ type before doing anything else.

The main SAQ types

The SAQ you qualify for depends on how card data flows. These are the common merchant SAQs under v4.0.1:

• SAQ A. Card-not-present merchants that fully outsource payment handling, for example an online store whose checkout is hosted entirely by the processor or embedded in an iframe from it. The shortest questionnaire.
• SAQ A-EP. E-commerce merchants whose website does not receive card data but controls how the payment page is delivered, such as a direct-post form. Much longer than SAQ A and usually requires quarterly scans.
• SAQ B. Merchants using only imprint machines or standalone dial-out terminals, with no electronic card storage.
• SAQ B-IP. Standalone, approved payment terminals connected over IP to the processor, with no electronic card storage.
• SAQ C-VT. Merchants that key one transaction at a time into a processor’s web-based virtual terminal on an isolated computer.
• SAQ C. Merchants with payment application systems connected to the internet, such as some point-of-sale systems, with no electronic card storage.
• SAQ P2PE. Merchants using only hardware terminals in a PCI-listed point-to-point encryption solution. Very short.
• SAQ SPoC. Merchants taking card-present payments on a phone or tablet with a secure card reader in a listed solution.
• SAQ D. Everyone else, including any business that stores card numbers electronically. Covers essentially the whole standard.

What changed for small online stores

In early 2025 the Council revised SAQ A. It removed two new v4.0 requirements about managing and monitoring payment page scripts (6.4.3 and 11.6.1) and replaced them with an eligibility condition: the merchant must confirm its site is not susceptible to attacks from scripts that could affect its e-commerce systems. The revised SAQ A was published in January 2025, ahead of the March 31, 2025 deadline for the future-dated requirements.

In practice, that means an online store still has to keep its website secure, because a compromised site can redirect shoppers to a fake payment page even when checkout is hosted. Keep your platform, theme and plugins updated, limit admin accounts, use MFA and use a host with malware monitoring. Our hosting and support includes constant automated monitoring and malware cleanup.

Not sure how much of your business is in PCI scope? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your IT operations, cybersecurity, backups and business continuity as controlled, needs attention, significant exposure or unknown, with a short list of next steps in order. It is yours to keep, with no obligation. Book your assessment.

How to reduce your scope

1. Never store card numbers. Not in spreadsheets, email, notebooks or your CRM. If you need repeat billing, use your processor’s tokenization or card-on-file feature.
2. Use a hosted or iframe checkout online. Hosted checkouts on platforms such as Shopify, or processor-hosted payment pages, keep card data off your server. Our Shopify vs WooCommerce comparison covers how each handles payments.
3. Use validated terminals in person. A P2PE-listed or processor-supplied encrypting terminal keeps card data out of your network.
4. Stop taking card numbers by email or phone notes. Send a payment link instead.
5. Separate payment devices from everything else. If a terminal or POS computer must sit on your network, keep it on its own segment, away from staff laptops and guest Wi-Fi.
6. Get proof from vendors. Ask your processor, POS provider and e-commerce platform for their PCI attestation of compliance and keep it on file.

Mistakes that put small merchants in a bigger SAQ

• Card numbers in email. A customer emails their card details and staff key them in. That email is now stored card data. Delete it securely and reply with a payment link.
• The old spreadsheet. A file of customer cards from years ago, kept for convenience, moves you toward SAQ D.
• A virtual terminal on a shared computer. SAQ C-VT assumes an isolated device. Using the bookkeeper’s everyday laptop breaks the assumption.
• Custom checkout code. A developer builds a payment form that posts card data from your site. That can move you from SAQ A to SAQ A-EP or further.
• Terminals on the guest Wi-Fi. Payment devices sharing a network with customers and staff devices widen the scope.

Each of these is cheaper to fix than to document. A short review of how cards actually flow through the business is usually the most valuable hour you can spend on PCI.

Annual compliance checklist

• Confirm your merchant level and SAQ type with your processor
• Map every way you accept cards: online, in person, phone, invoices
• Complete the SAQ honestly and sign the attestation
• Run quarterly external scans if your SAQ requires them, and fix failures
• Train staff never to write down or email card numbers
• Inspect card terminals for tampering and keep an inventory of devices
• Keep systems updated and use MFA on admin and remote access
• Keep an incident plan that says to contact your processor first if you suspect a breach

Our cybersecurity services cover the IT controls behind many SAQ answers: MFA, access reviews, same-day removal of leavers, endpoint protection, updates and email security. This article is general information; your processor and, where needed, a Qualified Security Assessor have the final word on your requirements.

Keep reading

• Florida data breach notification law: what businesses must do and when
• Georgia data breach notification law: what Atlanta businesses should know
• HIPAA compliant email: what it takes with Microsoft 365, Google Workspace and Gmail
• Microsoft 365 security settings every small business should check in 2026

Related services

• Cybersecurity services
• Free Technology Health Assessment
• Shopify vs WooCommerce in 2026