PCI DSS for small businesses: Level 4 and choosing your SAQ
Most small businesses that take cards are Level 4 merchants. They prove PCI DSS compliance with a Self-Assessment Questionnaire (SAQ) each year, not a full audit, and their acquirer decides exactly what to submit. The right SAQ depends on how you take payments, and the simplest is SAQ A. 1 Sequence Cyber Ltd, a PCI SSC-listed QSA company, helps small merchants choose the right SAQ and find gaps before they sign it, with quarterly ASV scans delivered through Qualys, a PCI SSC Approved Scanning Vendor.Last reviewed: 11 November 2026
Are you a Level 4 merchant?
Visa and Mastercard define Level 4 as merchants processing fewer than 20,000 e-commerce transactions a year, and all other merchants processing up to 1 million transactions a year. American Express, Discover and JCB set their own levels. Your acquirer confirms your level and what you must submit.
Which SAQ fits your business
| How you take card payments | Usual SAQ |
|---|---|
| Online, with payment fully outsourced to a PCI DSS-compliant provider (redirect or iframe) | SAQ A |
| Online, where your website affects the payment page but a provider takes the card details | SAQ A-EP |
| Standalone dial-out terminals, or imprint machines only | SAQ B |
| Standalone terminals connected over IP | SAQ B-IP |
| A virtual terminal on a web browser, keyed by staff | SAQ C-VT |
| A payment application connected to the internet, with no electronic card storage | SAQ C |
| A PCI-validated point-to-point encryption (P2PE) solution | SAQ P2PE |
| Anything else, including storing card data | SAQ D |
Each SAQ has eligibility criteria, and you must meet all of them. Since 31 March 2025, SAQ A also requires you to confirm your site is not susceptible to attacks from scripts that could affect your e-commerce systems.
What small merchants usually get wrong
- Choosing SAQ A when the website loads scripts that can change the payment page. That points to SAQ A-EP.
- Forgetting card data taken by phone or email, which is still in scope.
- Not checking that each payment provider has a current Attestation of Compliance.
- Missing quarterly ASV scans where the SAQ requires them.
Frequently asked questions
Do small businesses need to be PCI DSS compliant?
Yes. Every business that accepts card payments must comply. Smaller merchants prove it with an SAQ instead of a full Report on Compliance.
Do Level 4 merchants need a QSA?
Usually not. Your acquirer sets the requirement. Many small merchants use a QSA to choose the right SAQ, check gaps before they sign it, or arrange quarterly ASV scans.
What changed for SAQ A in 2025?
From 31 March 2025, Requirements 6.4.3, 11.6.1 and 12.3.1 were removed from SAQ A, and a new eligibility criterion about script attacks was added.