Guide
PCI compliance for small business, without the panic
PCI compliance for small business usually starts with a letter or a fee on your statement. However, for most small merchants the work is modest, especially if card data never touches your own systems.
- Not a QSA, stated first
- Introductions to independent QSAs
- Written answers, no call
Why PCI compliance for small business is requested
Any business that accepts cards agrees to follow PCI DSS through its merchant agreement. Therefore your bank or processor asks you to confirm compliance, usually once a year. The standard is in the PCI SSC document library.
PCI compliance for small business: which form you need
Most small merchants complete a self-assessment questionnaire. Which one depends on how you take payments.
| How you take cards | Likely form |
|---|---|
| Hosted online checkout only | SAQ A. |
| Standalone card terminals | SAQ B or B-IP. |
| Keyed into a web terminal | SAQ C-VT. |
| Validated encrypting terminals | SAQ P2PE. |
| Several channels or stored cards | Often SAQ D. |
PCI compliance for small business: quick check
Tick what is true. It shows how simple your situation is.
Your result appears here as you tick, so you can see what is still open.
Making PCI compliance for small business lighter
The less card data touches your systems, the less you must prove. So hosted payment pages, encrypting terminals and tokens all reduce effort.
- Never write card numbers down
- Never take card numbers by email
- Use hosted or provider-embedded payment pages
- Ask your provider about validated encrypting terminals
Non-compliance fees
Many processors add a monthly fee if you do not complete your questionnaire. Therefore completing it promptly often removes a charge you may not have noticed. Check your statement for lines labelled non-compliance.
If you see one, ask your processor which form they expect and where to submit it. Often the fee stops once the questionnaire is accepted.
When to get help with PCI compliance for small business
Get help if your setup is mixed, if you store card data, or if a letter mentions a deadline you cannot meet. Readiness work generally costs $8,000 to $40,000 depending on scope, so small, simple setups often need far less. We are not a QSA, and we say so plainly.
PCI compliance for small business questions
Is PCI compliance for small business mandatory?
Yes, through your merchant agreement, although the work is often modest.
Who checks PCI compliance for small business questionnaires?
Your processor or acquirer, who may also ask for scans.
Can our provider make us compliant?
A provider can shrink your scope, but you still confirm your own practices.
What does help cost?
It depends on scope, so simple setups need much less than complex ones.
Related guides
Not sure which form you need?
Describe how you take payments. We reply in writing with the likely form and next steps, with no sales call.
Ask us anything