Answer
PCI compliance for small business
Quick answer
PCI compliance means following the Payment Card Industry Data Security Standard (PCI DSS) whenever you accept cards. Most small businesses prove it by completing an annual self-assessment questionnaire. Using a hosted checkout or payment links, so card numbers never touch your systems, keeps that questionnaire short, usually SAQ A.
Updated October 2026. Evergreen page — refreshed in place as facts change.
- Current standard
- PCI DSS v4.0.1
- Published 2024 by the PCI SSC
- New rules in force
- March 31, 2025
- v4.0's future-dated requirements
- Small-business level
- Level 4
- Under 20,000 Visa ecommerce payments a year
- Shortest questionnaire
- SAQ A
- Hosted checkout, links or a provider frame
- Longest
- SAQ D
- If you store or handle card data yourself
- Validation
- Every year
- Questionnaire, attestation and any required scans
- Council founded
- 2006
- By Amex, Discover, JCB, Mastercard and Visa
- PCI fees with us
- None
- No PCI, monthly or setup fees
PCI compliance for small business sounds like an audit and, for most, works out to an annual questionnaire. How long that questionnaire is depends almost entirely on one design choice: whether card numbers ever touch your website, devices or staff. This guide explains the standard, the merchant levels and questionnaires, what changed in version 4, what counts as in scope, and how to keep your share of the work as small as possible.
Payment methods on this page
What is PCI DSS, and who has to follow it?
PCI DSS is a security standard written by the PCI Security Standards Council, which American Express, Discover, JCB, Mastercard and Visa founded in 2006. It applies to every business that accepts, processes, stores or transmits card data, whatever its size. The current version is PCI DSS v4.0.1, published in 2024.
It is not a federal law. It is enforced through the card networks' rules and your agreement with your payment provider, which is why the provider is the one asking you to confirm compliance, and the one passing on fines or fees when a business does not.
What changed in PCI DSS v4.0 and v4.0.1?
PCI DSS v4.0 was published in March 2022 and replaced v3.2.1, which was retired at the end of March 2024. v4.0.1, a limited revision that clarified wording rather than adding rules, followed in June 2024 and replaced v4.0 from the start of 2025. A group of new requirements in v4.0 were 'future-dated', best practice until March 31, 2025 and mandatory since; among them are stronger password and multi-factor authentication rules and controls on the scripts that run on payment pages.
For small businesses using hosted checkout, the change that mattered most came in January 2025, when the Council revised SAQ A. It took the two payment-page script requirements (6.4.3 and 11.6.1) out of the questionnaire and replaced them with an eligibility criterion: the business confirms its site is not susceptible to attacks from scripts that could affect its ecommerce systems. In practice, if your page embeds a provider's payment frame, know which scripts run on that page, or get your provider's confirmation that its solution protects it.
| Date | What happened |
|---|---|
| March 2022 | PCI DSS v4.0 published |
| March 31, 2024 | v3.2.1 retired; v4.0 became the only version |
| June 2024 | v4.0.1 published, clarifying v4.0 |
| December 31, 2024 | v4.0 retired in favour of v4.0.1 |
| January 2025 | SAQ A revised: script requirements replaced by an eligibility criterion |
| March 31, 2025 | v4.0's future-dated requirements became mandatory |
Which merchant level are you?
Your level decides how you prove compliance, and it is set by how many card transactions you process a year. Nearly every small business is Level 4, which means a self-assessment rather than an outside audit. Your provider or acquiring bank confirms your level.
| Level | Annual Visa transactions | How compliance is usually validated |
|---|---|---|
| Level 1 | Over 6 million | Annual on-site assessment by a qualified security assessor |
| Level 2 | 1 million to 6 million | Self-assessment questionnaire; some acquirers require more |
| Level 3 | 20,000 to 1 million ecommerce | Self-assessment questionnaire |
| Level 4 | Fewer than 20,000 ecommerce, or up to 1 million in total | Self-assessment questionnaire |
Which self-assessment questionnaire applies to you?
There are several self-assessment questionnaires (SAQs), and the right one depends on how card data moves through your business. The less of it your own systems touch, the shorter the questionnaire. SAQ A is the shortest; SAQ D, for businesses that handle card data themselves, is the longest by far.
| Questionnaire | Who it is for |
|---|---|
| SAQ A | Card-not-present businesses (online, mail or phone orders) that fully outsource card entry to a provider's hosted page or frame |
| SAQ A-EP | Ecommerce sites that control how card data reaches the provider, such as a direct-post form |
| SAQ B / B-IP | Businesses using standalone card terminals, dial-up or IP-connected |
| SAQ C-VT | Businesses keying payments into a provider's web-based virtual terminal |
| SAQ C | Businesses whose payment software is connected to the internet |
| SAQ P2PE | Businesses using a validated point-to-point encryption terminal solution |
| SAQ D | Everyone else, including any business that stores card numbers |
What counts as 'in scope' for PCI?
Your PCI scope is every person, system and process that stores, processes or transmits card data, plus anything that could affect the security of those that do. A laptop where staff type card numbers from phone orders is in scope, and so is the network it sits on. A website whose checkout is served entirely by a provider keeps most of its systems out of scope, with the page that hands the customer over to the checkout still in.
That is why two small businesses of the same size can face a short questionnaire or most of the full standard. Taking one phone order by writing a card number on a notepad pulls the notepad, the desk drawer and the person into scope; sending a payment link instead keeps all three out.
Where the card number goes with hosted checkout
- 1
Customer clicks Pay
On your website, a payment link, an invoice or a QR code.
Your page - 2
Checkout opens
A window or frame served by the provider, not your server.
Provider's page - 3
Card is tokenized
The number is encrypted and replaced with a token for processing.
Encrypted - 4
Payment authorized
Approved or declined by the card's issuer.
Seconds - 5
Result returned
A paid status, a receipt and a webhook, never the card number.
Out of scope
Why does hosted checkout keep the work small?
PCI scope follows the card number. If customers type card details into a page or frame served by your provider, the number never reaches your website, servers or staff, and most of the standard simply does not apply to you. That is the situation SAQ A was written for.
On Anytime Capital Payments, card details are entered on a checkout served by Anytime Capital, inside the Pay button window or the inline frame, so they never pass through your site or servers. Payment links, invoices and the hosted checkout work the same way, and so does in-person payment, where the customer pays on their own phone.
What do PCI fees and non-compliance fees cover?
Some providers, especially traditional merchant accounts, charge an annual PCI compliance fee, a monthly fee for a compliance portal, or a non-compliance fee each month until you submit your questionnaire. Paying a fee does not make you compliant; it pays for a tool or a penalty.
Ask what each fee includes, and whether moving to hosted checkout would remove it. Anytime Capital Payments charges no PCI fees, and no monthly or setup fees either.
What does the yearly PCI routine involve?
Validation happens once a year, and for a Level 4 business it is a self-assessment: you answer the questionnaire that matches how card data moves through the business, then sign an Attestation of Compliance, the form that declares your status, and give it to your provider or acquirer when asked. Many providers run this through an online portal that picks the questionnaire for you from a few questions.
Some questionnaires also call for quarterly external vulnerability scans by an Approved Scanning Vendor (ASV). Under v4.0.1, SAQ A lists one such requirement (11.3.2) for the parts of an ecommerce site that are in scope, such as the page that links to or embeds the payment form, so ask your provider exactly what it expects you to scan. The longer questionnaires add internal scans, logging and written policies.
The yearly PCI routine
- 1
Confirm level
Your provider or acquirer tells you your merchant level.
Usually Level 4 - 2
Pick the SAQ
Match how card data moves; hosted checkout usually means SAQ A.
SAQ A–D - 3
Answer it
Work through each requirement and fix anything not in place.
Hours - 4
Scan if listed
Quarterly external scans by an Approved Scanning Vendor, where required.
Quarterly - 5
Attest
Sign the Attestation of Compliance and submit it to your provider.
Every year
A small-business PCI checklist
Most of PCI for a small business comes down to a few habits that keep card numbers out of places they should not be. Work through these, then complete the questionnaire your provider asks for each year.
- Take online payments through a hosted checkout, payment links or an embedded frame from your provider
- Never write down, store, email or message full card numbers or security codes
- Do not take card details over chat or email; send a payment link instead
- Use unique logins and two-factor authentication for every payments dashboard
- Keep devices that take payments updated, and keep guest Wi-Fi separate from them
- Complete your questionnaire, and any vulnerability scans it calls for, on time each year
What happens after a card data breach?
If card data is stolen from a business, the costs arrive in a predictable order. The acquirer can require a forensic investigation by a PCI Forensic Investigator, paid for by the business; the card networks can assess fines and the cost of reissuing compromised cards, which the acquirer passes on; and state data-breach laws can require the business to notify affected customers. A business that was not compliant at the time has the weakest position in every one of those conversations.
The cheapest protection is still scope. Card numbers that never reach your website, devices or inbox cannot be stolen from them, which is the whole case for hosted checkout and payment links. This is general information, not legal advice.
Frequently Asked Questions
Is PCI compliance required by law?
Not by US federal law. It is required by the card networks' rules and your provider agreement, and a few states reference it in their own data-security laws. The practical consequences of ignoring it are fees, fines passed on after a breach, and possibly losing the ability to take cards.
Do I still need PCI compliance if I use a provider like Stripe or Square?
Yes, but your share is much smaller. Using a provider's hosted checkout or payment links usually qualifies a business for SAQ A, the shortest questionnaire, because card numbers never touch its own systems. You still confirm compliance each year.
How much does PCI compliance cost a small business?
With hosted checkout it is mostly an hour or two each year to complete the questionnaire. Costs rise if your provider charges PCI or non-compliance fees, if your setup needs vulnerability scans, or if you handle card data yourself and need a longer questionnaire or outside help.
What happens if a business is not PCI compliant?
Your provider may charge a monthly non-compliance fee until you submit your questionnaire. After a data breach, a non-compliant business can face network fines passed on by its acquirer, the cost of investigating the breach, and the loss of its ability to accept cards.
What is SAQ A?
SAQ A is the shortest PCI self-assessment questionnaire, for businesses that outsource all card entry to a PCI-compliant provider, such as through a hosted payment page, payment links or an embedded frame served by the provider, so no card data is processed or stored on their own systems.
Do card terminals need PCI compliance too?
Yes. A terminal reads card data at your counter, so it is in scope. A provider's validated point-to-point encryption (P2PE) terminal usually qualifies a business for SAQ P2PE, a far shorter questionnaire than one for a terminal connected to its own point-of-sale software. Taking in-person payments on the customer's own phone, as Anytime Capital's QR checkout does, keeps card data off your devices entirely.
What is an Attestation of Compliance?
The Attestation of Compliance (AOC) is the signed form at the end of a PCI assessment in which a business declares its compliance status. Your provider or acquirer may ask for yours each year. Providers have their own AOCs covering their systems, and asking a provider to confirm it is PCI DSS compliant is a reasonable step before you sign up.
Keep reading
Important Disclosures
- Third-party fees and product details cited on this page are each company's published US pricing, or industry-typical ranges, as of the date shown and may have changed. Check current pricing with the provider before you decide.
- Information on this page is general and educational — it is not financial, legal, or tax advice.
- Anytime Capital is a fintech company, not a bank. Payment processing, banking and payout services are provided by Anytime Capital's licensed partners. Rates shown are for US card payments; international cards, currency conversion and disputes may carry additional fees shown in your dashboard before you accept a payment.