PCI Compliance for Small Business: Levels and SAQs (2026)

Quick answer: PCI compliance means following the Payment Card Industry Data Security Standard (PCI DSS), currently version 4.0.1, whenever you accept, process or store card payments. Most small businesses are Level 4 merchants and validate once a year with a Self-Assessment Questionnaire (SAQ). Using a hosted checkout or approved reader keeps the SAQ short.

PCI compliance sounds like an enterprise IT project, but for most small businesses it comes down to choosing the right payment setup, keeping card numbers off your own systems, and filling out a questionnaire each year. This guide explains PCI DSS in plain terms, shows the merchant levels and SAQ types, walks through a worked example, and gives you a checklist for staying compliant without hiring a security consultant.

This is general information, not legal or security advice. Your processor or acquiring bank decides your exact validation requirements.

What is PCI compliance?

PCI DSS is a set of security requirements for any organization that stores, processes or transmits cardholder data. It is maintained by the PCI Security Standards Council, founded by the major card brands, and enforced by those brands through acquiring banks and payment processors. When you sign a merchant agreement, you agree to comply.

The standard is organized into 12 principal requirements under six goals:

Goal	Requirements (summary)
Build and maintain a secure network and systems	1. Network security controls; 2. Secure configurations
Protect account data	3. Protect stored account data; 4. Encrypt cardholder data in transit
Maintain a vulnerability management program	5. Protect against malware; 6. Develop and maintain secure systems
Implement strong access control	7. Restrict access by need to know; 8. Identify users and authenticate access; 9. Restrict physical access
Regularly monitor and test networks	10. Log and monitor access; 11. Test security regularly
Maintain an information security policy	12. Support security with policies and programs

The good news for small businesses: the less card data touches your systems, the fewer of these requirements apply to you.

PCI DSS 4.0.1: what changed for small merchants

• Version 4.0.1 is current. It replaced v4.0, which was retired at the end of 2024. Requirements that had been future-dated became mandatory on March 31, 2025.
• Stronger authentication. v4.0 introduced longer minimum password lengths (12 characters where supported) and broader multi-factor authentication for access to the cardholder data environment.
• E-commerce script controls. Requirements 6.4.3 and 11.6.1 address scripts on payment pages to fight web skimming.
• SAQ A update. In early 2025, the Council removed requirements 6.4.3 and 11.6.1 from SAQ A and replaced them with an eligibility criterion: merchants must confirm their site is not susceptible to attacks from scripts that could affect the e-commerce system. Merchants using a provider's embedded payment form or redirect should read the current SAQ A carefully or ask their provider for guidance.

PCI merchant levels

Card brands set merchant levels based on annual transaction volume. The Visa levels below are widely used; Mastercard's are similar, and other brands have their own.

Level	Annual Visa transactions	Typical validation
Level 1	Over 6 million (any channel)	Annual on-site assessment by a Qualified Security Assessor, quarterly scans
Level 2	1 million to 6 million	Annual SAQ (sometimes with assessor), quarterly scans
Level 3	20,000 to 1 million e-commerce	Annual SAQ, quarterly scans if applicable
Level 4	Fewer than 20,000 e-commerce, or up to 1 million total	Annual SAQ, scans if applicable, as required by your acquirer

Nearly every small business is Level 4. Your acquirer can still set specific requirements, and a business that suffers a breach may be moved up a level.

Which SAQ do you need?

The Self-Assessment Questionnaire you complete depends on how you take cards, not on your size.

SAQ	Who it is for	Example small business setup
A	Card-not-present merchants that fully outsource card data handling	Online store using a hosted checkout or payment links; invoice paid via a provider's payment page
A-EP	E-commerce merchants whose website can affect the security of the payment page	Site that hosts its own payment form posting directly to the processor
B	Merchants using only imprint machines or standalone dial-out terminals	Older countertop terminal on a phone line
B-IP	Merchants using only standalone, PCI-approved terminals connected over IP	Internet-connected countertop terminal with no other card systems
C-VT	Manual entry into a processor's web-based virtual terminal on one computer	Office keying phone orders into a virtual terminal
C	Merchants with payment application systems connected to the internet	Point-of-sale software on a PC connected to the internet
P2PE	Merchants using only a validated point-to-point encryption solution	Validated encrypted card readers from a P2PE provider
D	Everyone else (and service providers)	Businesses that store card numbers or run custom payment systems

The PCI SSC publishes all SAQs and their eligibility criteria in its document library. If you use more than one channel, such as a card reader and an online store, you may need to complete more than one SAQ or the one that covers your most complex channel; ask your processor.

Worked example: a small business PCI setup

A home cleaning company takes about 3,500 card payments a year. It sends invoices with a payment link from its processor, takes some payments with a phone tap-to-pay app, and occasionally keys card numbers from customers who call.

Channel	Card data touches business systems?	Relevant validation
Payment links on invoices (hosted page)	No	SAQ A
Tap to pay app from the processor	No, handled in the provider's app	Often covered by the provider's program; confirm
Phone orders keyed into virtual terminal	Yes, briefly on the office computer	SAQ C-VT

By replacing phone orders with a payment link sent while the customer is on the call, the company removes the virtual terminal channel and can likely validate with SAQ A alone, a much shorter questionnaire. That one process change cuts both risk and paperwork. For adding links to your invoices, see how to add a payment link to an invoice.

PCI compliance checklist for small business

1. Map how you take cards. List every channel: in person, online, phone, mail, invoices.
2. Outsource card data handling. Use hosted payment pages, payment links, approved readers and the processor's apps instead of collecting card numbers yourself.
3. Never store card numbers. No spreadsheets, notes, emails, photos or call recordings with full card numbers. Never store CVV codes at all.
4. Secure your accounts. Use unique passwords of at least 12 characters and multi-factor authentication on your processor dashboard and email.
5. Keep devices updated. Update phones, tablets, computers, routers and payment apps; change default passwords on Wi-Fi equipment.
6. Inspect card readers. Check in-person devices for tampering and keep an inventory.
7. Train staff. Teach them never to accept card numbers by email or text and to spot phishing.
8. Complete your SAQ and attestation through your processor's PCI portal each year, and run quarterly scans if required.
9. Write a short incident plan. Know who to call (your processor) if you suspect a breach.

How to complete your SAQ: a practical walkthrough

1. Log in to your processor's PCI portal. Many processors provide one, often run by a compliance partner, and send reminders each year. If you are not sure, ask support where to validate.
2. Answer the scoping questions. The portal asks how you accept cards. Be honest; choosing an SAQ that does not match your setup does not protect you after a breach.
3. Work through each requirement. For each question, answer In Place, Not Applicable or Not in Place. For short SAQs like A, most questions relate to vendor management, passwords and policy.
4. Fix gaps before you attest. If you answer Not in Place, write down what you will change and by when, then do it.
5. Run scans if required. SAQs covering systems connected to the internet may require quarterly scans by an Approved Scanning Vendor; the portal usually arranges them.
6. Sign the Attestation of Compliance. This is your formal statement that the answers are accurate.
7. Set a reminder for next year and update your answers whenever you add a payment channel.

PCI compliance by payment channel

How you take cards	Lowest-effort compliant approach
Invoices	Payment link to a hosted page; no card fields on your own site
Online store	Hosted checkout or embedded payment form from a compliant provider
In person	Provider's reader, terminal or tap to pay app; see Tap to Pay on iPhone
Phone	Send a payment link during the call instead of keying the card
Recurring	Processor's card-on-file storage and customer portal
Mail or paper forms	Avoid; if unavoidable, process immediately and shred the form securely

The same principle runs through every row: let a PCI-compliant provider handle the card number. Our overview of the best payment methods for small business compares options, and Stripe vs Square covers two popular processors.

PCI fees on your merchant statement

Fee type	What it is	How to avoid or reduce
PCI compliance or program fee	Annual or monthly charge for the processor's PCI program	Compare processors; flat-rate providers often have none
PCI non-compliance fee	Monthly charge until you validate	Complete your SAQ and any scans
Breach-related costs	Fines, forensics and card reissuance passed through after a breach	Keep card data off your systems

Our guides to credit card processing fees and merchant account vs payment processor explain where these fees appear and how pricing models differ.

Common PCI mistakes small businesses make

• Emailing or texting card numbers. Even once creates stored card data on several systems.
• Keeping a "card on file" spreadsheet for repeat customers instead of using the processor's secure storage. Our recurring payments guide shows the safe way.
• Ignoring the annual questionnaire and paying non-compliance fees month after month.
• Sharing processor logins among staff instead of creating individual users.
• Adding marketing scripts to payment pages on your own site without understanding the SAQ impact.
• Assuming the processor covers everything. They secure their systems; you secure your practices.

Where invoices fit

Invoices should never contain full card numbers. Put a payment link, bank transfer details or accepted methods on the invoice instead, and let the customer pay on the processor's secure page. Our free invoice generator does not process payments or collect card data at all; it only creates the invoice document. For card fees and options, see how to accept credit card payments.

Summary

PCI compliance for small business is mostly about design: route card data through your processor, keep it off your own devices and files, secure your logins, and complete the right SAQ every year. Do that and PCI becomes a short annual task rather than a risk to your business. When you need clean invoices with a payment link, our invoice generator is free, needs no sign-up and creates a PDF in your browser, keeping card data out of your paperwork and supporting your PCI compliance.