Merchants that accept cards from Visa, Discover, Mastercard, JCB or American Express must protect card data and comply with the card industry’s security rules, known as PCI DSS. This standard is managed by the PCI SSC. The standard’s latest release is PCI DSS 4.0.1, which was published by PCI SSC on June 11, 2024. All requirements took effect on March 31, 2025. This includes 51 requirements that PCI SSC labeled as “Future-dated” in PCI DSS 4.0, which was released in March 2022.
When it comes to this compliance standard, the size of the business does not affect the obligation. It defines how a business demonstrates this compliance. The smallest businesses that accept payment cards, per Visa’s published merchant levels, demonstrate compliance by completing a SAQ or by other means defined by the acquiring bank.
This PCI compliance checklist includes the definition of an SAQ, the compliance controls for terminals, networks and staff, as well as the timing for compliance, including quarterly and annual activities, what records to keep, and actions that are taken for noncompliance.
PCI DSS is an industry standard. The card brands have operational rules that include enforcement of PCI DSS. The acquiring banks have merchant agreements in which they implement PCI DSS. The rules of Visa have the acquirer responsible for the PCI DSS compliance of the merchants and the service providers of the merchants. The small business compliance page of Visa requires that a small business be fully compliant at all times, citing Visa Core Rules ID’s 0002228 and 0008031.
The latest PCI DSS release includes 12 requirements that a small business is required to implement. The 12 requirements include: secure network, secure storage, secure cryptography, protection of data from malware, secure systems and software, least privilege, user ID and authentication, physical and logical security, monitoring and logging, testing and security policies, procedures and practices. A small business usually does not answer questions concerning all 12 requirements. The SAQ (Self Assessment Questionnaire) that is applicable to a small business payment setup would determine the requirements a small business would have to answer.
Visa groups merchants into one of four levels depending on the total number of Visa transactions the merchant processes in one year, whether they be credit, debit, or prepaid transactions. Level 1 business merchants handle more than 6 million Visa transactions annually. Level 2 merchants handle anywhere from 1 million to 6 million transactions; Level 3 merchants handle anywhere from 20,000 to 1 million e-commerce transactions; and Level 4 merchants process less than twenty thousand e-commerce transactions in a year, as well as all other merchants that process up to one million Visa transactions in a year.
Visa requires Levels 2 and 3 merchants to complete an SAQ (Self Assessment Questionnaire) every year and an Attestation of Compliance (AOC). Level 4 merchants can complete an Annual SAQ or an alternative validation exercise defined by the acquirer.
Level 1 merchants of Visa need to complete a yearly Report on Compliance with the Cardholder Data Environment (or payment transaction data) processed or stored by the merchant, prepared by a certified QSA (Qualified Security Assessor), or by an Internal Resource, if signed off by a Company Officer.
Figure 1: Visa merchant levels and the annual validation for each level’s files
PCI SSC releases multiple SAQ versions for merchants. Each one begins with eligibility requirements. A merchant who does not meet any of the requirements is moved to a longer questionnaire. SAQ D is the catch-all form. It includes all the requirements for merchants. The table below summarizes the merchant SAQs a small business is likely to meet.
Table 1: PCI DSS v4.0.1 merchant SAQs and their eligibility limits
| SAQ | Payment setup it covers | Main eligibility limit |
| A | Card-not-present sales (e-commerce, mail or telephone order) with all account data functions outsourced to PCI DSS compliant 3rd parties | Card data kept only on paper. Since March 31, 2025, the merchant must confirm its site is not susceptible to script attacks |
| A-EP | E-commerce where a 3rd party provides the payment page, but the security of the transaction can be affected by the merchant’s website | No electronic storage of card data |
| B | Imprint machines/ standalone terminals that dial out over a phone line | Terminals not connected to the internet or other systems. No electronic storage |
| B-IP | Standalone, PTS-approved terminals with an IP connection | Terminals isolated from other systems. No electronic storage |
| C-VT | Manual entry, one transaction at a time, into a virtual terminal hosted by a PCI DSS compliant provider | Entry device isolated from other systems. No electronic storage |
| P2PE | Hardware terminals inside a PCI-listed point-to-point encryption solution | No electronic storage |
| D | Any merchant that does not qualify for another SAQ | None. All applicable requirements apply |
SAQ A and SAQ B are the shortest paths. SAQ A is related to a sales channel where the merchant hands off all card data handling to an outside provider that has been validated as PCI DSS compliant. In that case, the merchant keeps nothing but paper receipts or reports. In effect, this could be a fully outsourced, online checkout, or a Mail Order/Telephone Order (MOTO) business.
SAQ B is completed by merchants that accept cards only through an imprint machine or a dial-up card terminal. The October 2024 SAQ B requires that the terminals be completely isolated from the merchant environment. The data may be kept only on paper. Card data must not be kept in the merchant’s systems, environment, or on the staff’s devices. SecurityMetrics clarifies that SAQ B relates to Requirements 3, 4, 7, 9, and 12 of the PCI DSS and is not related to e-commerce.
The SAQ A form was changed in 2025. On January 30, 2025, Requirements 6.4.3, 11.6.1, and 12.3.1 were dropped from the form by the PCI SSC. These requirements relate to script of the payment page, and tamper detection. The SAQ A form revised its eligibility criteria and now asks the merchant to verify that its website cannot be exploited by scripting attacks, which could impact its online payment systems. The revised form was released on March 31, 2025.
Figure 2: PCI DSS v4.x milestones, 2022 to 2026
SAQ A still has Requirement 11.3.2. That means SAQ A merchants must have regular external vulnerability scans. There are no Requirement 11 questions in SAQ B, so SAQ B does not require a scan.
Requirement 9.5 of PCI DSS v4.0.1 pertains to point-of-interaction (POI) devices. POI devices are the card readers and terminals that are used by customers. Requirement 9.5.1.1 requires merchants to create and maintain a device register that lists each device by make, model, location and serial number. Requirement 9.5.1.2 requires examination of device surfaces to determine if there has been tampering or unauthorized substitution.
For requirement 9.5.1.2.1, merchants are required to evaluate the risks to their business and determine the frequency of inspection based on the merchant’s targeted risk assessment. Requirement 9.5.1.3 adds staff training to be able to identify tampering. Staff are also required to verify the identity of persons claiming to be repair or maintenance personnel before allowing access to the device.
In Visa’s Technology Innovation Program (TIP) for U.S. merchants, the important requirement to validate PCI DSS compliance is waived if at least 75 percent of a merchant’s yearly transactions occur through any combination of dual-interface EMV terminals, a validated point-to-point encryption solution, or tokenization that meets the EMVCo specification. Visa’s page on TIP states that validation of PCI DSS compliance is waived. It does not state that compliance is waived.
The checklist for a network is based on how terminals and computers are connected. Standalone dial-out terminals, by definition, are disconnected from the Internet. IP-connected terminals under SAQ B-IP are required to be isolated from other systems. In-scope systems are required to be hardened.
Requirement 2.2.2 covers vendor default accounts. They must be removed or disabled, or default passwords must be changed if they remain in use. Requirement 8.3.6 sets a minimum password length of 12 characters, or 8 where a system cannot support 12. Requirement 8.4.2 requires multi-factor authentication for all non-console access to the cardholder data environment. Requirement 4.2.1 requires the use of strong cryptography for the protection of cardholder data over open, public networks.
Requirement 12.6.3 stipulates that upon hire and annually thereafter, staff must receive and acknowledge the security policy and undergo security awareness training using different methods.
Requirements 12.6.3.1 and 12.6.3.2 cover the contents of security awareness training. It must include phishing and social engineering, as well as the acceptable use of organizational technologies. Requirement 12.6.2 calls for a review of the awareness training program. Requirement 7 limits access to cardholder data to staff who need to know. Requirement 12.10.1 calls for an incident response plan that is ready to activate in the event of a suspected breach.
Once every quarter, external vulnerability scans must be conducted, and an ASV approved by the PCI SSC must perform them. These scans must meet the requirements set forth by the ASV Program Guide to be considered passing. Scans considered failing must be repeated until the issues are fixed. Requirement 11.3.2.1 adds a scan after significant changes to the environment. The quarterly window set forth in LBMC’s 2025 PCI DSS 4.0 recurring task checklist states that scans must be completed every 90-92 days.
The SAQ and AOC must be completed annually. Per Visa’s guidelines, Level 2 and 3 merchants must also complete the SAQ and AOC annually. Level 4 merchants are to abide by their acquirer’s rules. The AOC is the signed declaration of compliance status that goes to the acquirer. It is to be completed and submitted with the SAQ, and where the SAQ includes Requirement 11.3.2, the ASV scans.
Table 2: Recurring PCI DSS tasks for a small merchant
| Task | PCI DSS v4.0.1 reference | Frequency |
| External vulnerability scan by an ASV | 11.3.2 and 11.3.2.1 | At least once every 3 months, and after significant changes |
| POI device surface inspection | 9.5.1.2 and 9.5.1.2.1 | Set by the merchant’s targeted risk analysis |
| Security awareness training and policy acknowledgment | 12.6.3 | Upon hire and at least once every 12 months |
| Awareness program review | 12.6.2 | At least once every 12 months |
| Security policy review | 12.1.2 | At least once every 12 months |
| Service provider compliance check | 12.8.4 | At least once every 12 months |
| SAQ and AOC to the acquirer | Visa merchant level rules | Every year |
The Payment Security Report provides data on how compliant organizations are between annual assessments. It measures full compliance at interim validation. The percentage of fully compliant organizations declined from 55.4% in 2016 to 27.9% in 2019, and then increased to 43.4% in 2020, as shown in the 2022 edition. The 2022 edition also showed that 56.7% of organizations failed interim validation because at least one of the required security controls was missing.
The 2022 data is based on Verizon’s own PCI assessors and four external assessor partners. The sample is not focused on small businesses.
Figure 3: Full PCI DSS compliance at interim validation, 2016 to 2020
The records a small merchant should keep follow from the checklist above. They include the SAQs and AOCs completed for each year, the ASV scan report for each quarter, the POI device inventory and inspection records, dated training records with signed acknowledgment, and the 3rd party service providers as required by Requirement 12.8.1. SAQ A merchants also need evidence their service providers are compliant with the PCI DSS. SAQ A eligibility criteria ask the merchant to affirm that its service providers are compliant for the services utilized.
Requirement 10.5.1 sets a retention period for audit logs. Logs must be kept for at least 12 months and the latest three months must be available for analysis. It applies to systems in the cardholder data environment that create logs.
It also addresses paper. Requirement 3.3.1 prohibits the storage of sensitive authentication data, including full track data, card verification codes and PINs, after authorization. Requirement 9.4.6 stipulates that hard-copy records with cardholder data must be destroyed when they are no longer necessary, by cross-cut shredding, incineration, or pulping. The retention period for completed SAQs is not defined in PCI DSS v4.0.1. A merchant agreement may define a retention period.
Visa’s site discusses non-compliance in the context of its Core Rules and how a merchant’s acquirer may face a Visa assessment for non-compliance under Visa Core Rules ID 0001054 if the merchant did not remediate the issue and/or does not become PCI DSS compliant. Visa states that acquirers are not permitted to pass through these assessments to the merchant, and Visa may waive these assessments if a merchant forensic investigation does not find evidence of non-compliance during the data breach. The public pages of Visa’s site do not disclose the amount of these assessments.
Many acquirers charge merchants for compliance programs. Published merchant agreements in October 2026 show monthly PCI compliance program charges of around $10, typically covering a web security tool, breach insurance, and a records portal, with separate non-compliance fees that are often not disclosed up front.
Non-compliance fees across the industry typically range from $25 to $50 per month and are charged until the business validates compliance. Host Merchant Services charges no PCI program fee and no non-compliance fee.
The first step in creating a PCI compliance checklist for a small business is determining which SAQ matches the payment acceptance method. For a merchant using a fully hosted online checkout, the payment page is protected from script attacks, and SAQ A is selected. For a merchant using dial-out terminals with no connection to the internet, SAQ B (which contains no scan requirement) would be selected.
From there, the process is largely repetitive and calendar-based. ASV scans for SAQs that include Requirement 11.3.2 must occur at least once every 3 months. Training and policy acknowledgement are due during hire and once every 12 months. The SAQ and AOC are submitted to the acquirer once a year. Merchants should check their SAQ choice and fee terms with their acquiring bank or a QSA. PCI DSS v4.0.1 is the current and effective version.
According to Visa, merchants of any size who accept Visa cards must comply in full with PCI DSS requirements, and small merchants typically validate compliance through an annual SAQ.
SAQ A is for merchants who fully outsource card handling work, and SAQ B is for merchants using imprint machines or standalone dial-out terminals.
It depends on the acquirer. Monthly PCI program fees of around $10 per merchant ID and non-compliance fees of $25 to $50 a month are common. Host Merchant Services charges neither.
