PCI compliance support for small businesses
Most small merchants prove PCI compliance with one questionnaire a year, and the way you take cards decides how long it is. Clearo offers PCI compliance support, and every client has a dedicated rep to ask about their setup.
Short answer
PCI compliance means following the Payment Card Industry Data Security Standard (PCI DSS) whenever you take cards, and proving it each year, usually with a self-assessment questionnaire your acquirer asks for. How you take cards decides which questionnaire. Clearo offers PCI compliance support and a dedicated rep, but every merchant still validates its own setup.
What does PCI compliance require of a small business?
Two things: keep card data safe all year, and prove it once a year in the form your acquirer asks for. The rules are the Payment Card Industry Data Security Standard (PCI DSS), written by the PCI Security Standards Council (PCI SSC), and they apply to every merchant, whatever its size or transaction volume (PCI SSC).
As of October 2026, PCI DSS v4.0.1 is the only active version, after v4.0 was retired on December 31, 2024 (PCI SSC). It has 12 principal requirements under six goals (PCI SSC), but each self-assessment questionnaire (SAQ) was written for one type of payment environment (PCI SSC), so you answer the version that fits your setup. Our guide to what PCI compliance is lists all 12.
PCI SSC says it doesn't enforce the standard (PCI SSC). The card brands run the compliance programs, and your acquirer asks for your proof, because Visa holds acquirers responsible for their merchants' compliance (Visa). Rules here are as of October 2026; confirm them with the linked sources before you act.
PCI compliance levels and which SAQ to file
Your level sets how much proof you owe; your SAQ depends on how card data reaches you. On Visa's table, Level 1 (over 6 million Visa transactions a year) needs a Report on Compliance from a Qualified Security Assessor, while Level 2 (1 to 6 million) and Level 3 (under 1 million) complete an SAQ every year (Visa). Visa has had three levels since April 25, 2024, when it folded Level 4 into Level 3 (Visa). Mastercard, American Express and Discover set their own tables; see our guide to PCI compliance levels.
| How you take cards | SAQ to look at |
|---|---|
| Online only, with every part of the payment page served by a PCI DSS compliant provider | SAQ A |
| Online, with a card form your own website builds and posts straight to the gateway | SAQ A-EP |
| At a counter, on standalone PCI-listed terminals with an IP connection, isolated from your other systems | SAQ B-IP |
| By phone, keyed one sale at a time into a virtual terminal on a dedicated computer | SAQ C-VT |
| In person, only on terminals from a validated, PCI-listed P2PE solution | SAQ P2PE |
| Anything the shorter forms don't cover, such as card numbers stored on your systems | SAQ D |
Sources: PCI SSC's SAQ A update and its SAQ A-EP, SAQ B-IP, SAQ C-VT, SAQ P2PE and SAQ D forms.
If you take cards more than one way, ask your acquirer how to report each channel, since PCI SSC sends questions about validating and reporting compliance to your acquirer or the payment brands (PCI SSC). Our SAQ A guide covers the most common online case.
How your checkout and terminals shrink PCI scope
PCI scope means the parts of your business that touch card data, and the smaller it is, the shorter your questionnaire.
Online checkout
Let the provider serve the whole payment page through a hosted checkout, an embedded form or a payment link.
Counter terminals
Standalone terminals on their own network, or a validated P2PE solution, so card data stays off your computers.
Saved cards
Keep your provider's tokens for repeat charges, never the card numbers themselves.
Security codes
Never keep a CVV after the sale is authorized, on paper or anywhere else.
The details decide whether a choice counts. PCI SSC's FAQ 1292 says SAQ A fits only when every element of the payment page comes from the provider (PCI SSC). Since March 31, 2025, merchants that embed a provider's form must also confirm their site isn't susceptible to script attacks (PCI SSC), a check that doesn't apply to redirects or emailed payment links (PCI SSC).
In store, PCI SSC says merchants on a PCI-listed P2PE solution face fewer PCI DSS requirements (PCI SSC), but encryption alone is generally insufficient to take card data out of scope (PCI SSC), so a terminal that merely encrypts isn't the same. PCI SSC's tokenization guidelines recommend keeping the systems that touch card numbers to a minimum (PCI SSC), and PCI DSS bars keeping security codes once a sale is authorized, even in encrypted form (PCI SSC). Our guides to point-to-point encryption and payment tokenization go further.
Visa rewards this. Its Technology Innovation Program can remove the annual validation requirement for eligible merchants that run at least 75% of their yearly transactions through EMV chip terminals, validated P2PE or EMVCo-standard tokenization (Visa); in the US, those terminals must take both contact chip and contactless (Visa). Ask your acquirer whether you qualify before skipping a filing.
Do you need ASV scans and terminal checks?
Yes, if your SAQ includes Requirement 11.3.2: a passing external scan by a PCI SSC Approved Scanning Vendor (ASV) at least once every three months, rescans until it passes, and scans after significant changes (PCI SSC). For PCI DSS v4.x, PCI SSC added these scans to SAQ A, for the merchant's own site that redirects to the provider or embeds its form (PCI SSC).
Your provider's scans cover its systems, not your storefront, and only a vendor on PCI SSC's published list counts (PCI SSC). If a scan fails, fix the findings and rescan; PCI SSC's FAQ on quarterly scans looks for a working process for fixing what they find (PCI SSC). Our ASV scan guide covers failures and false positives.
In store, add a device check: PCI SSC says requirement 9.5 covers a current list of card-reading devices, periodic inspections for tampering and substitution, and staff training (PCI SSC). Our credit card skimmer guide shows what tampering looks like.
What skipping PCI validation can cost
Usually a monthly fee first, then far more after a breach. If your processor charges a PCI non-compliance fee, it stays on your statement until you validate; our PCI compliance fee guide explains which charges are fair.
A breach starts the clock. Visa's What To Do If Compromised rules call for reporting a suspected compromise to Visa and your acquirer within three calendar days and, if Visa requires a PCI Forensic Investigator, signing one within five business days (Visa). Visa may charge a non-compliance assessment to your acquirer (Visa), and for Level 3 merchants its compromise rules list $5,000 for up to 100,000 transactions a year and $10,000 for 100,000 to 500,000, effective February 9, 2025 (Visa). Your merchant agreement says how such costs can reach you.
In Canada, PIPEDA adds its own duties: report a breach that creates a real risk of significant harm to the Office of the Privacy Commissioner, notify the people affected and keep a record of every breach (OPC). Our guide to PCI compliance in Canada covers the rest.
How Clearo helps with PCI compliance
Clearo offers PCI compliance support, and every client has a dedicated rep, so a question about your questionnaire or a PCI line on your statement goes to a person. Ask us what the support includes for your business.
Several of the choices that shape your questionnaire are things we sell: hosted checkout through our online payments, POS terminals that read chip, tap and swipe, and a virtual terminal so phone orders never land on a notepad. Confirm with your acquirer which SAQ your setup points to. Pricing is interchange-plus, with no long-term contract and no cancellation fee, and a free statement review will flag every PCI-related fee you pay now.
PCI compliance FAQ
List every way card data reaches you and remove what you don't need, such as stored card numbers. Ask your acquirer which SAQ it expects, fix the gaps it reveals, answer it honestly and sign the Attestation of Compliance. Add quarterly ASV scans if it includes Requirement 11.3.2, and repeat every year.
The card brands, through your acquirer. PCI SSC writes the standard but says it doesn't enforce it, and it names American Express, Discover, JCB International, Mastercard and Visa as running their own compliance programs. Visa holds acquirers responsible for their merchants' compliance, which is why your processor asks for your SAQ.
There is no set price. Expect a PCI program fee if your processor charges one, quarterly ASV scans if your SAQ needs them, and your own time. Falling behind costs more: non-compliance fees where they apply and, after a breach, Visa assessments such as $5,000 for a Level 3 merchant with up to 100,000 transactions a year.
No. Your processor's compliance covers its own systems, and you still validate your own setup each year. A compliant provider can shrink your part, though, and SAQ A asks you to confirm each provider is PCI DSS compliant for the services you use, so ask for its Attestation of Compliance.
Sources
The PCI SSC, Visa and Office of the Privacy Commissioner documents behind the facts on this page, checked in October 2026. PCI DSS v4.0.1 is the active version; confirm which questionnaire applies to you with your acquirer.
- Merchant Resources - PCI Security Standards Council (pcisecuritystandards.org)
- Just Published: PCI DSS v4.0.1 (blog.pcisecuritystandards.org)
- Maintaining Payment Security - PCI Security Standards Council (pcisecuritystandards.org)
- What is the intent of the SAQ eligibility criteria? (PCI SSC FAQ) (pcisecuritystandards.org)
- About Us - PCI Security Standards Council (pcisecuritystandards.org)
- Account Information Security (AIS) Program and PCI (Visa) (corporate.visa.com)
- What To Do If Compromised - Visa Supplemental Requirements (usa.visa.com)
- Important Updates Announced for Merchants Validating to Self-Assessment Questionnaire A (PCI SSC) (blog.pcisecuritystandards.org)
- PCI DSS v4.0.1 SAQ A-EP (docs-prv.pcisecuritystandards.org)
- PCI DSS v4.0.1 SAQ B-IP (docs-prv.pcisecuritystandards.org)
- PCI DSS v4.0.1 SAQ C-VT (docs-prv.pcisecuritystandards.org)
- PCI DSS v4.0.1 SAQ P2PE (docs-prv.pcisecuritystandards.org)
- PCI DSS v4.0.1 Self-Assessment Questionnaire D for Merchants (docs-prv.pcisecuritystandards.org)
- FAQ 1292 - PCI Security Standards Council (pcisecuritystandards.org)
- FAQ Clarifies New SAQ A Eligibility Criteria for E-Commerce Merchants (PCI SSC) (blog.pcisecuritystandards.org)
- Point-to-Point Encryption (P2PE) - PCI Security Standards Council (pcisecuritystandards.org)
- Information Supplement: PCI DSS Tokenization Guidelines (listings.pcisecuritystandards.org)
- Are merchants allowed to request card-verification codes/values from cardholders? (PCI SSC FAQ) (pcisecuritystandards.org)
- Merchant qualifications for the Visa Technology Innovation Program (corporate.visa.com)
- PCI DSS v4.0.1 Self-Assessment Questionnaire A, revision 1 (PCI SSC) (docs-prv.pcisecuritystandards.org)
- Resource Guide: Vulnerability Scans and Approved Scanning Vendors (blog.pcisecuritystandards.org)
- Approved Scanning Vendor (ASV) list - PCI Security Standards Council (pcisecuritystandards.org)
- FAQ 1152 - PCI Security Standards Council (pcisecuritystandards.org)
- FAQ: Are point-of-interaction devices required to be physically secured to meet PCI DSS Requirement 9.5? - PCI SSC (pcisecuritystandards.org)
- What you need to know about mandatory reporting of breaches of security safeguards - Office of the Privacy Commissioner of Canada (priv.gc.ca)
Disclaimer: general information, not professional advice
This page is general educational information, not legal, tax, accounting or financial advice. Rules and rates vary by place and change, so confirm them with the official source and a qualified professional before you act. Full terms are in our Terms of Service.
Ready to lower your processing costs?
See exactly what you're paying and how much you could save, with no commitment required.
Related Services
Everything you need to accept payments and reduce costs.
Payment Processing
Transparent interchange-plus pricing
Merchant Services
Full merchant services stack for small business
Credit Card Processing Fees
Understand fees and lower your effective rate
POS Terminals
Countertop, wireless, and portable terminals
Online Payments
Secure website checkout and payment gateway
Mobile Payments
Accept payments from phone or tablet
Virtual Terminal
Phone and remote payment processing
ACH Payment Processing
Bank-to-bank payments for invoices and B2B
Chargeback Management
Tools and a rep to keep disputes in check
Surcharging Program
Pass processing costs to credit card users
Pricing
See our interchange-plus rates and how we compare
Other industries we serve
Clearo works with businesses across the US and Canada. Find your industry below.
Guides to PCI compliance and card security
Security and compliance
What is a CVV? A merchant's guide to card security codes
Security and compliance
Credit card skimmers: how to spot and stop them
Security and compliance
What is PCI compliance? A guide for small merchants
Security and compliance
What is EMV? How chip cards stop counterfeit fraud
Security and compliance
Payment tokenization: how it works for merchants
Security and compliance
PCI compliance levels: Visa, Mastercard, Amex and Discover
Security and compliance
Is tap to pay safer? How it compares to chip and swipe
Canada
PCI compliance in Canada: what merchants need to know
Security and compliance
ASV scan: who needs one and how to pass it
Security and compliance
PCI SAQ A: who qualifies and how to file it
Security and compliance
Point-to-point encryption: what P2PE is and who needs it
Security and compliance
EMV liability shift: who pays for counterfeit fraud
Let's talk about your payments
Tell us a bit about your business and how you currently take payments. A Clearo rep will reach out within one business day with a personalized recommendation. No generic pitch, no pressure.
If we can save you money and improve your setup, we'll show you exactly how. If we can't, we'll tell you that too.
Ready to save on processing?
Fill out a quick form and a Clearo rep will reach out within one business day with a personalized recommendation.
Get Your Free ConsultationNo obligation. No pressure. Takes 2 minutes.