Contents
Do merchants need to be PCI compliant?
Like merchants, any business that processes, handles or stores credit card data on behalf of a merchant is required to be PCI DSS Compliant. Visa maintains a list of Global PCI DSS Validated Service Providers on their website. Merchants are required to make sure their provider has been validated as PCI DSS Compliant.
Can service provider use SAQ A?
SAQ A-EP is for e-commerce-only merchants that use a third-party service provider to handle their card information and who have a website that doesn’t handle card data, but could impact the security of the payment transaction. Not for e-commerce environments.
Who should be PCI compliant?
The PCI Security Standards Council Any business that transmits, stores, handles, or accepts credit card data—regardless of size or processing volume—must comply with the PCI DSS. If you only process three credit card transactions a month, you must comply with PCI standards.
Which SAQ form is required?
SAQ D is the final SAQ and applies to any merchants who don’t meet the criteria for other SAQs, as well as all service providers. SAQ D encompasses the full set of over 200 requirements and covers the entirety of the PCI DSS. If you’re a service provider, this is the only SAQ you are eligible to complete.
How frequently does a merchant have to complete a self assessment questionnaire SAQ )?
Level 4 businesses are required to complete an annual risk assessment using the appropriate PCI Self-Assessment Questionnaire (SAQ). Quarterly PCI scans, administered by an approved scanning vendor, may also be required.
What is a SAQ D Merchant?
SAQ D applies to merchants who don’t meet the criteria for any other SAQ type. This SAQ handles merchants who store card data electronically and do not use a P2PE certified POS system. Some examples include: Merchants that don’t store cardholder data electronically but that do not meet the criteria of another SAQ type.
Can A SAQ a be used on a merchant website?
In the subsequent Guidance documentation, however, the Council says that a merchant can still use SAQ A if: Merchant website provides an inline frame (iframe) to a PCI DSS compliant third-party processor facilitating the payment process.
What are the requirements to comply with SAQ a?
However, the requirements the merchant must comply with are minimal. Completing and maintaining SAQ A is a fairly trivial exercise for merchants and the requirements address two key areas. Firstly, any paper copies of cardholder data (such as merchant copy receipts or reconciliation reports) must be physically protected or destroyed.
What does SAQ B stand for in merchant?
SAQ B SAQ B applies to merchants with no electronic cardholder data storage, who process payments either by standalone terminals or imprint-only machines. Modern payment terminals are often referred to as PEDs (pin-entry devices) or previously as PDQs (Process Data Quickly terminals).
What’s the difference between SAQ a and a-EP?
SAQ A: Merchant website is entirely hosted and managed by a PCI-compliant, third-party payment processor, OR Merchant website provides an iframe or URL that redirects a consumer to a PCI-compliant, third-party payment processor, where no elements of the page originate from the merchant website.