Compliance › PCI DSS › Levels and SAQ
PCI DSS levels and SAQ typesPCI DSS levels and SAQ types: find yours and what you must submit
Two questions decide your PCI workload: which merchant level you are, and which Self-Assessment Questionnaire fits how you take cards. This guide explains both, who confirms them, and the mistakes that send people to the wrong form.
Free for buyers · provider-funded introductions · Updated October 2026
Levels and SAQs at a glance
Levels1 to 4, based on card transaction volume
Set byThe payment brands, applied through your acquirer
Level 1An assessor report (ROC) from a QSA
Levels 2 to 4A SAQ, in the Mastercard program
SAQ typesA, A-EP, B, B-IP, C-VT, C, P2PE and D
Who confirmsYour acquirer or payment brand
The short answer
How do I find my PCI DSS level and SAQ?
Your merchant level comes from how many card transactions you process, counted over a recent period, and the payment brands set the thresholds. Your SAQ comes from how you take cards: a fully outsourced payment page, a standalone terminal and a system that stores card data each point to a different questionnaire. Your acquirer confirms both, so ask for the answer in writing.
- The Council does not decide your level. Your acquirer and the brands do. See the PCI DSS hub.
- A hosted checkout can shrink your scope. It does not by itself decide your SAQ.
- Several channels can mean more than one SAQ, or a larger one. Confirm how your acquirer wants this reported.
Merchant levels
The four PCI merchant levels
The thresholds below are from Mastercard’s program. Other brands publish their own.
| Level | Threshold in the Mastercard program | Validation |
|---|---|---|
| Level 1 | More than 6 million combined Mastercard and Maestro transactions a year, or the merchant meets Visa Level 1, or Mastercard decides | An annual PCI DSS assessment ending in a Report on Compliance (ROC) |
| Level 2 | More than 1 million and up to 6 million transactions, or the merchant meets Visa Level 2 | An annual Self-Assessment Questionnaire (SAQ) |
| Level 3 | More than 20,000 and up to 1 million e-commerce transactions, or the merchant meets Visa Level 3 | An annual SAQ |
| Level 4 | All other merchants | An annual SAQ |
Mastercard says merchants count transactions over the most recent 52 weeks and should contact their acquirer for help, and that it may place any merchant at Level 1 at its own discretion. Source: Mastercard Site Data Protection program. Visa and other brands use similar but not identical figures, so check each brand you accept.
SAQ types
Which SAQ fits how you take cards
Match the way card data reaches you, not the product name on your checkout.
| SAQ | Typically for | Key limit |
|---|---|---|
| SAQ A | Card-not-present merchants (e-commerce, mail or phone) that hand all card-data functions to compliant third parties | No card data on your own systems |
| SAQ A-EP | E-commerce merchants that outsource payment processing in part, but whose web servers can affect the security of the payment | May process or transmit card data, but not store it |
| SAQ B | Merchants using standalone dial-out terminals | No electronic card data storage, no connection to other systems |
| SAQ B-IP | Merchants using standalone approved terminals that connect over the internet | No electronic storage, isolated from other systems |
| SAQ C-VT | Merchants who key card details into a web-based virtual terminal | Typically one transaction at a time, from an isolated device |
| SAQ C | Merchants with payment applications connected to the internet | No electronic card data storage |
| SAQ P2PE | Merchants using an approved hardware point-to-point encryption solution | No access to the clear-text card data |
| SAQ D | Everything else, including merchants that store card data electronically, and service providers | The most comprehensive questionnaire |
Each SAQ has its own eligibility criteria, and the Council clarified the criteria for SAQ A, A-EP and C-VT in the v4.0.1 update. Read the criteria in the current SAQ and confirm the choice with your acquirer before you start.
The paperwork
SAQ, ROC and AoC: what you actually submit
| Document | Who completes it | What it is |
|---|---|---|
| SAQ | You, with help if you want it | A questionnaire that records how you meet the requirements for your SAQ type |
| ROC | A QSA | The assessor report after an on-site assessment, used where your acquirer or brand requires one |
| AoC | You, or the QSA with a ROC | The signed Attestation of Compliance that summarizes your result and is what you usually submit |
Assessors and scans
When you need a QSA, an ISA or an external scan
- A QSA is a company qualified by the Council to assess you and write the ROC. In the Mastercard program, Level 1 merchants need one, and Level 3 and 4 merchants may use one in place of a SAQ.
- An ISA is a staff member trained under the Council program. Mastercard says Level 2 merchants using SAQ A, A-EP or D must engage a QSA or a certified ISA.
- An ASV scan is an external vulnerability scan by an Approved Scanning Vendor. Where it applies, it runs at least every three months, and your SAQ says whether it does.
Rules differ by brand and acquirer, so treat this as a map and not a ruling. To choose among providers, see who does what in PCI DSS.
Avoid rework
Common level and SAQ mistakes
- Assuming a hosted checkout means SAQ A: check the eligibility criteria against your actual page.
- Counting one brand only: each brand sets its own thresholds.
- Picking the shortest SAQ: choose by how card data flows, not by length.
- Ignoring a second channel: a terminal and a website can need different handling.
- Reusing an old SAQ version: the v4.0 SAQs retired on 31 December 2024.
- Assuming last year’s answers carry over: the v4.0.1 update added a requirement to SAQ A.
- Not asking the acquirer: the acquirer is who accepts the submission.
- Forgetting growth: volume or a new channel can change your level.
Keep reading
Related PCI DSS guides
FAQ
PCI levels and SAQ questions buyers ask us
What are the PCI DSS merchant levels?
Four levels, from 1 to 4, based on card transaction volume. In the Mastercard program Level 1 is over 6 million transactions a year, Level 2 is 1 to 6 million, Level 3 is 20,000 to 1 million e-commerce transactions and Level 4 is all other merchants. Other brands set their own figures.
Who decides my PCI level?
The payment brands set the thresholds and your acquirer helps you apply them. Mastercard says merchants count transactions over the most recent 52 weeks, and that it can place any merchant at Level 1 at its own discretion. Ask your acquirer for your level in writing.
What does a Level 1 merchant have to do?
In the Mastercard program, an annual PCI DSS assessment that ends in a Report on Compliance, performed by a QSA. Your acquirer tells you what else to submit.
What is a SAQ?
A Self-Assessment Questionnaire records how you meet PCI DSS requirements for your type of card acceptance. There are several types, such as SAQ A, A-EP, B, B-IP, C-VT, C, P2PE and D.
Which SAQ do I need?
It depends on how card data reaches you. A fully outsourced payment page points to SAQ A, a standalone terminal to SAQ B or B-IP, and a system that stores card data to SAQ D. Read the eligibility criteria in each SAQ and confirm with your acquirer.
Does using a hosted checkout mean I can use SAQ A?
Not automatically. It can shrink your scope, but eligibility depends on how the payment page is built and where card data goes. The Council clarified the SAQ A eligibility criteria in v4.0.1, so check the current text.
What is SAQ D?
The most comprehensive questionnaire. It applies to merchants that store card data electronically or that do not fit another SAQ, and to service providers.
What if I take cards in several ways?
You may fall under a larger SAQ, or need to report more than one. Ask your acquirer how it wants mixed channels reported.
Can I use a QSA instead of a SAQ?
In the Mastercard program, Level 3 and 4 merchants may optionally use a QSA to complete a ROC instead of a SAQ. It also says Level 2 merchants using SAQ A, A-EP or D must engage a QSA or an ISA. Check what your acquirer requires.
What is the difference between a SAQ, a ROC and an AoC?
A SAQ is a questionnaire you complete. A ROC is the assessor report written by a QSA. An AoC is the signed attestation summarizing your result, which is what you usually submit.
How often do I have to revalidate?
Validation is annual in the Mastercard program. Where external scans are required, they run at least every three months through an Approved Scanning Vendor. Your SAQ states whether scans apply.
Can my level or SAQ change?
Yes. Growth in transaction volume, a new payment channel, a change of provider or a change in how card data flows can all change them. Recheck with your acquirer when any of these happens.
Start here
Know your level and SAQ? Get matched with the right provider.
Level and SAQ→Scope→Price→Matched provider
Tell Us What You NeedFree for buyers · provider-funded introductions · Reviewed October 2026 by the ZCyberSecurity compliance team