Who decides: the standard, the schemes or your acquirer?
The PCI Security Standards Council writes the standard and the forms. It does not decide who must validate or how. It says that is set by the card brands, acquirers and payment facilitators, and tells merchants to ask them [1][2]. One of its FAQs says the organisations that accept your compliance decide how it is to be evidenced, for example by a ROC or by an SAQ [10].
For a merchant, that means the acquirer. Visa’s programme page says a merchant’s level rests on its total Visa transaction volume over 12 months, and that acquirers must make sure their merchants validate at the right level and collect the documents [3]. For a service provider it means the schemes and the members it serves: issuers and acquirers must make sure each service provider they use shows compliance at least every 12 months [3].
The same holds in the UK. Visa’s public rules list its security programme guide as applying in every Visa region [13]. The Payment Systems Regulator’s review of card-acquiring says scheme rules require acquirers to make sure their merchants comply with PCI DSS [15]. We found no separate UK rule on who validates or how.
What is the difference between a ROC and an SAQ?
| Question | Report on Compliance | Self-assessment questionnaire |
|---|---|---|
| What it is | A reporting tool that records the detailed results of an assessment [4] | A reporting tool that records the results of a self-assessment [4] |
| Who does the work | A Qualified Security Assessor company, which must use the Council’s ROC template. Where an internal assessor does it, what must be reported is settled with the scheme or acquirer that receives the ROC [4][11] | You. The form has places to record a QSA or an internal assessor who took part [6]. Some schemes ask for one to be involved at certain levels |
| What it covers | Every requirement in the standard. Each is reported as in place, not applicable, not tested or not in place, and an assessment with any requirement not tested counts as partial [11] | Only the requirements for the kind of environment that questionnaire describes [6] |
| What you hand over | The ROC, to the scheme or acquirer that asked for it [11]. The AOC is the form meant to be shared with other organisations that ask, under the schemes’ rules [12] | The SAQ and its AOC, with scan reports if asked [6] |
The Council recognises its own forms for validation and nothing else: the ROC, the AOC, the SAQs and the attestation that goes with external scans. A compliance certificate from anyone else is not evidence of compliance, and the firm you send it to need not accept it [7].
Which SAQ types are there?
The Council’s document library lists ten questionnaires for version 4.0.1 [5]. Each describes one kind of environment. Nine are for merchants. A service provider that may self-assess uses SAQ D for Service Providers [9]. The descriptions below are ours, shortened from the Council’s instructions [9].
| SAQ | Who it is for, in brief |
|---|---|
| A | Card-not-present merchants that have handed all handling of account data to compliant third parties. Not for service providers or face-to-face payments [6] |
| A-EP | E-commerce merchants that outsource part of their payment processing, and whose own website does not receive account data but can affect the security of the payment [9] |
| B | Merchants using only imprint machines or standalone dial-out terminals, with no electronic storage of account data [9] |
| B-IP | Merchants using only standalone, PCI-listed payment terminals with an IP connection to the payment processor [9] |
| C-VT | Merchants keying in one payment at a time through a compliant provider’s virtual terminal, from an isolated device [9] |
| C | Merchants with a payment application system connected to the internet and no electronic storage of account data [9] |
| P2PE | Merchants using only payment terminals in a validated, PCI-listed point-to-point encryption solution [9] |
| SPoC | Merchants taking payments on a phone or tablet with a secure card reader from a PCI-listed solution [9] |
| D for Merchants | Merchants that may self-assess but fit none of the questionnaires above [9] |
| D for Service Providers | Service providers that a card scheme defines as eligible to self-assess [9] |
How do the card schemes’ levels work?
Levels belong to the schemes, not to the standard. Visa sets a merchant’s level by its Visa transactions over 12 months [3]. The volumes below are Visa’s, from a document it issued in June 2026 [14]. Visa merged its merchant levels 3 and 4 into a single level 3 on 25 April 2024, and says the merger changed nothing in what PCI DSS compliance requires [14].
The volumes are sourced. What each level has to produce is not: Visa’s rules say the criteria for each merchant level are set out in its programme guide, which is not on its public pages [13]. Where a line in this section carries no source number, it comes from the author’s work on assessments. Confirm your level and your validation with your acquirer.
| Level | Visa transactions a year | Usual validation |
|---|---|---|
| 1 | More than 6 million [14] | ROC |
| 2 | 1,000,001 to 6 million [14] | SAQ. Mastercard asks for an internal assessor or a QSA to be involved |
| 3 | Up to 1 million [14] | SAQ |
Mastercard keeps four levels, with level 3 at 20,000 to 1 million e-commerce transactions a year and level 4 below that, validated by SAQ as the acquirer directs.
Service providers have two levels. Visa’s document draws the line at 300,000 transactions a year for the agents of issuers and acquirers: level 1 above it, level 2 below [14]. Level 1 needs a ROC from a QSA company. Level 2 may use SAQ D for Service Providers.
An acquirer or scheme decides how your compliance is to be evidenced [10]. It can ask for more than your level suggests, for example after a breach.
The Council lists each scheme’s programme page in its FAQ 1142 [16]. Visa’s is source 3.
Can I do PCI compliance myself?
Yes, if you are eligible for an SAQ. That takes two things: the schemes’ programmes let you self-assess, and you meet the criteria of the questionnaire you choose [9]. The questionnaire sets out the steps [6]:
- Confirm that you meet its eligibility criteria.
- Confirm your scope.
- Assess your environment against each requirement.
- Complete the questionnaire and its attestation.
- Send both to the organisation that asked, with scan reports if it wants them.
The Council also trains Internal Security Assessors. They are employees, sponsored by their employer, who carry out internal assessments for their own company [8]. Whether a ROC must come from a QSA company or may be done by an internal assessor is for the scheme or acquirer to say [10][11].
Doing it yourself does not make it informal. The attestation is a declaration of your results, signed by an executive officer of your firm [6].
What an assessor will ask to see
- The written request from your acquirer, sponsor or scheme, giving your level and the validation it wants
- For an SAQ, how you confirmed each eligibility criterion [6]
- How you confirmed your scope [6]
- How you confirmed that each third-party provider you rely on is PCI DSS compliant for the services you use [6]
- Last year’s AOC, and progress on any action plan it recorded for requirements not in place
- External vulnerability scan reports from a scanning vendor on the Council’s list (an ASV), at least one every three months, where requirement 11.3.2 is part of your validation [6]
How the platform helps
Whether you validate by Report on Compliance or by self-assessment questionnaire, the platform files what it finds in your cloud accounts and the evidence you add under each requirement that applies, and shows the gaps. Whether a requirement is in place is for your QSA to decide, or for you on a self-assessment.
Sources
- “Important Updates Announced for Merchants Validating to Self-Assessment Questionnaire A”, PCI Security Standards Council, 30 January 2025, https://blog.pcisecuritystandards.org/important-updates-announced-for-merchants-validating-to-self-assessment-questionnaire-a, read 13 October 2026
- Merchant resources, PCI Security Standards Council, https://www.pcisecuritystandards.org/merchants/, read 13 October 2026
- Account Information Security (AIS) Program and PCI, Visa, https://corporate.visa.com/en/resources/security-compliance.html, read 13 October 2026
- Glossary, PCI Security Standards Council, https://www.pcisecuritystandards.org/glossary/, read 13 October 2026
- Document library, PCI Security Standards Council, https://www.pcisecuritystandards.org/document_library/, index read 13 October 2026
- Self-Assessment Questionnaire A and Attestation of Compliance, for use with PCI DSS version 4.0.1, revision 1, PCI Security Standards Council, January 2025, https://docs-prv.pcisecuritystandards.org/SAQ%20(Assessment)/SAQ/PCI-DSS-v4_0_1-SAQ-A-r1.pdf, read 13 October 2026
- “Beware of PCI DSS Compliance Certificates”, PCI Security Standards Council, 2 September 2025, https://blog.pcisecuritystandards.org/beware-of-pci-dss-compliance-certificates, read 13 October 2026
- Internal Security Assessor (ISA) Qualification, PCI Security Standards Council, https://www.pcisecuritystandards.org/program_training_and_qualification/internal_security_assessor_certification/, read 13 October 2026
- PCI DSS Self-Assessment Questionnaire Instructions and Guidelines, version 4.0.1, revision 1, PCI Security Standards Council, April 2025, https://docs-prv.pcisecuritystandards.org/SAQ%20(Assessment)/Instructions%20%26%20Guidance/SAQ-Instructions-Guidelines-PCI-DSS-v4-0-1-r1.pdf, read 13 October 2026
- FAQ 1473, “What is the role of compliance-accepting entities and assessors in determining the applicability of PCI DSS requirements for merchant and service provider PCI DSS assessments?”, PCI Security Standards Council, March 2023, https://www.pcisecuritystandards.org/faqs/1473/, read 13 October 2026
- PCI DSS v4.x Report on Compliance Template: Frequently Asked Questions, revision 2, PCI Security Standards Council, August 2024, https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Frequently%20Asked%20Questions%20(FAQ)/PCI-DSS-v4-x-ROC-Template-FAQs-r2.pdf, read 13 October 2026
- FAQ 1568, “Is the PCI DSS Attestation of Compliance intended to be shared?”, PCI Security Standards Council, April 2023, https://www.pcisecuritystandards.org/faqs/1568/, read 13 October 2026
- Visa Core Rules and Visa Product and Service Rules, Visa, 18 April 2026, https://corporate.visa.com/content/dam/VCOM/download/about-visa/visa-rules-public.pdf, read 13 October 2026
- What To Do If Compromised: Visa Supplemental Requirements, version 10.0, Visa, effective 25 June 2026, https://usa.visa.com/dam/VCOM/download/merchants/cisp-what-to-do-if-compromised.pdf, read 13 October 2026
- Market review into card-acquiring services: final report (MR18/1.8), Payment Systems Regulator, November 2021, https://www.psr.org.uk/media/p1tlg0iw/psr-card-acquiring-market-review-final-report-november-2021.pdf, read 13 October 2026
- FAQ 1142, “How do I contact the payment card brands?”, PCI Security Standards Council, June 2024, https://www.pcisecuritystandards.org/faqs/1142/, read 13 October 2026