{"head":{"title":"PCI DSS SAQ Picker: Which SAQ Do I Need? | OceanLab","description":"Answer a few questions on how you take cards to see which PCI DSS v4.0.1 self-assessment questionnaire likely fits: A, A-EP, P2PE, B-IP, C-VT, SPoC or D.","canonical":"https://oceanlab.in/tools/pci-dss-saq-picker"},"tool":{"slug":"pci-dss-saq-picker","path":"/tools/pci-dss-saq-picker","name":"PCI DSS SAQ picker","h1":"PCI DSS SAQ picker","lede":"Say how you take card payments and see which PCI DSS self-assessment questionnaire likely fits, and why.","category":"compliance","categoryTitle":"Compliance checklists","method":["Service providers get SAQ D for Service Providers, the only SAQ for them. Merchants who store card data electronically get SAQ D for Merchants.","Online: a redirect, or the provider's iframe with script protection confirmed, points to SAQ A. A payment page your own site produces, such as Direct Post, points to SAQ A-EP.","In person: a validated P2PE solution points to SAQ P2PE; standalone approved terminals on IP to SAQ B-IP; a phone or tablet with a secure reader to SAQ SPoC; a virtual terminal on a standalone computer to SAQ C-VT. Anything else falls back to SAQ D.","Each rule comes from a PCI SSC FAQ or announcement linked below. SAQ B and SAQ C are not chosen by the tool because their eligibility text could not be re-checked."],"sources":[{"label":"PCI SSC FAQ: SAQ A vs SAQ A-EP payment page elements","url":"https://www.pcisecuritystandards.org/faqs/if-a-merchant-s-e-commerce-implementation-meets-the-criteria-that-all-elements-of-payment-pages-originate-from-a-pci-dss-compliant-service-provider-is-the-merchant-eligible-to-complete-saq-a-or-saq-a-ep/","checkedAt":"2026-10-25"},{"label":"PCI SSC FAQ 1588: SAQ A eligibility criteria for scripts","url":"https://www.pcisecuritystandards.org/faqs/how-does-an-e-commerce-merchant-meet-the-saq-a-eligibility-criteria-for-scripts/","checkedAt":"2026-10-25"},{"label":"PCI SSC FAQ: who can use SAQ P2PE","url":"https://www.pcisecuritystandards.org/faqs/who-can-use-saq-p2pe/","checkedAt":"2026-10-25"},{"label":"PCI SSC FAQ: SAQ D is the only SAQ for service providers","url":"https://www.pcisecuritystandards.org/faqs/can-service-providers-use-eligibility-criteria-from-a-merchant-self-assessment-questionnaire-saq-to-determine-applicable-pci-dss-requirements-for-the-service-providers-assessment/","checkedAt":"2026-10-25"},{"label":"PCI SSC: what's new with SAQs for PCI DSS v4","url":"https://blog.pcisecuritystandards.org/pci-dss-v4-whats-new-with-self-assessment-questionnaires","checkedAt":"2026-10-25"},{"label":"PCI SSC bulletin: SAQs for PCI DSS v4.0.1","url":"https://www.pcisecuritystandards.org/wp-content/uploads/2024/10/SAQs_for_PCI_DSS_v4.0.1_Bulletin.pdf","checkedAt":"2026-10-25"}],"faq":[{"question":"Who decides which SAQ I use?","answer":"Your acquirer (the bank that processes your card payments) or the card brands. They also decide whether you file an SAQ or need a full assessment."},{"question":"Does an iframe still qualify for SAQ A?","answer":"Under SAQ A for v4.0.1, yes, once you confirm the page is not open to script attacks: with controls such as Requirements 6.4.3 and 11.6.1, or with your PCI DSS compliant provider's confirmation."},{"question":"Which PCI DSS version applies now?","answer":"Version 4.0.1. Version 3.2.1 was retired on 31 March 2024, and the future-dated v4 requirements became mandatory on 31 March 2025."},{"question":"Is this legal advice?","answer":"No. It is a first-pass check to plan engineering work. Confirm it with your acquirer or a QSA."}],"notice":{"title":"Guidance, not legal advice.","text":"Your acquirer or the card brands decide which SAQ you may use."},"updatedAt":"2026-10-25"},"related":[{"href":"/tools/payment-processing-fee-calculator","label":"Payment processing fees","detail":"Enter your monthly card payments and compare what each processor's published US rate would cost, and what to charge to receive a set amount."},{"href":"/tools/soc-2-checklist","label":"SOC 2 checklist","detail":"Turn the SOC 2 criteria into engineering tasks, pick the categories in scope, and track what is still open."},{"href":"/tools/fintech-app-cost","label":"Fintech app cost","detail":"Pick the money features and platforms and get a cost and timeline range, with what cutting each feature would save."}],"studies":[{"meta":{"slug":"cenote","industry":"payments","projectType":"Payment gateway dashboard","country":"mx","tags":["fintech","saas"],"compliances":["PCI DSS","EMV 3-D Secure 2","Banxico card network rules","CFDI 4.0 (SAT)","LFPDPPP (2025)"],"cover":{"src":"/case-studies/cenote/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Cenote - Merchant Dashboard for a Mexican Payment Gateway","description":"Designed and built a clickable merchant dashboard for a Mexican online payment gateway that takes cards with meses sin intereses, SPEI transfers and OXXO cash vouchers in MXN: every payment from authorisation to settlement, declines in plain language, refunds with approval limits, chargebacks sorted by deadline and payouts that break down to the last fee.","category":"Payments / Payment Gateway Dashboard","client":"Mezquite Pagos"}}},{"meta":{"slug":"parley","industry":"payments","projectType":"Chargeback manager","country":"us","tags":["fintech","enterprise"],"compliances":["PCI DSS","CCPA","Visa Claims Resolution","Visa CE3.0","Visa VAMP","Mastercard ECP"],"cover":{"src":"/case-studies/parley/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Parley - Chargeback Manager with One Dispute Desk Across Every PSP","description":"Designed and built a clickable chargeback manager for a US merchant group with four online brands on Stripe, Adyen and Braintree: one inbox for every dispute with deadline countdowns, evidence gathered per reason code, a fight or accept recommendation with its reasons, pre-dispute alerts and dispute ratios tracked against network thresholds.","category":"Payments / Chargeback Management","client":"Fernhollow Commerce Group"}}},{"meta":{"slug":"rastro","industry":"payments","projectType":"Corporate cards & spend","country":"es","tags":["fintech","saas","tax"],"compliances":["PSD2 and SCA (RDL 19/2018)","PCI DSS","Invoicing rules (RD 1619/2012)","SII","Veri*factu (RD 1007/2023)","Ley Crea y Crece (Ley 18/2022)","IRPF allowance limits","Código de Comercio","AML (Ley 10/2010)","GDPR","LOPDGDD"],"cover":{"src":"/case-studies/rastro/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Rastro - Corporate Cards and Spend Management with IVA-Ready Receipts","description":"Designed and built a clickable spend-management platform for a Valencia fintech that gives Spanish SMEs company cards: budgets and card controls checked at authorisation, every transaction matched to its receipt, IVA marked recoverable or not from the invoice type, and a keyboard-driven review queue that turns card spend into bookable entries.","category":"Payments / Corporate Cards & Spend","client":"Almadraba Pagos"}}},{"meta":{"slug":"calada","industry":"ecom","projectType":"B2B wholesale portal","country":"mo","tags":["enterprise"],"compliances":["Macau PDPA (Law 8/2005)","Macau Food Safety Law (Law 5/2013)","PCI DSS"],"cover":{"src":"/case-studies/calada/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Calçada - B2B Wholesale Portal with Route Cut-offs, Contract Prices and Allergen-Safe Substitutions","description":"Designed and built a clickable staff console for a Macau importer of specialty food and wine that supplies resort outlets, hotels, restaurants, bars and delis: an order queue that puts exceptions first, order detail with the source of every price, shortages resolved with the customer before the truck leaves, and credit holds released with an audited reason.","category":"E-commerce & D2C / B2B Wholesale Portal","client":"Lorcha & Vine Trading Co."}}}],"more":[{"href":"/case-studies/industry/payments","label":"Payments case studies","detail":"Every OceanLab product build in Payments."},{"href":"/case-studies/industry/ecom","label":"E-commerce & D2C case studies","detail":"Every OceanLab product build in E-commerce & D2C."},{"href":"/case-studies","label":"All case studies","detail":"Every OceanLab product build."},{"href":"/ai-automation","label":"AI automation","detail":"AI built into real business workflows, with people in charge."}],"today":"2026-10-25"}