Merchant services
PCI Compliance Support
Every business that accepts cards has to validate PCI DSS compliance each year. We help you identify the right self-assessment questionnaire, work through it, and keep your validation current so it does not lapse unnoticed.
PCI DSS requirements are set by the PCI Security Standards Council and the card networks; compliance remains the merchant's responsibility.
Talk to a payments specialist
Tell us about your business and we'll follow up with next steps. No obligation.
What you get
SAQ selection
Identify which self-assessment questionnaire matches how your business actually takes cards.
Guided completion
Work through the questionnaire with someone who has answered it for businesses like yours.
Scope reduction
Tokenization, EMV and hosted checkout reduce where card data touches your systems.
Scan coordination
Coordinate any required external vulnerability scanning through your program's approved vendor.
Renewal reminders
Validation is annual — we track the date so a non-compliance status never surprises you.
Staff practices
Plain-English guidance on receipts, stored paperwork, device checks and who may handle card data.
Included in the setup
- Review of your payment channels: counter, mobile, online, phone and recurring
- SAQ type determination and walkthrough
- Guidance on network segmentation and device placement
- Coordination of required scans through your program's vendor
- Documentation of policies your team needs on file
- Annual revalidation tracking with reminders
How the process works
- 1
Assess how you take cards
We document every channel and device so the compliance scope reflects reality, not guesswork.
- 2
Complete validation
We guide you through the correct questionnaire and coordinate scanning where it applies.
- 3
Stay current
We track the renewal date and revisit the scope whenever you add a channel, location or device.
How SAQ type is actually determined
PCI DSS validation is not one-size-fits-all — the Self-Assessment Questionnaire you complete depends on exactly how your business touches card data. A retailer using only a standalone, PIN-entry P2PE-validated terminal typically qualifies for a shorter questionnaire (SAQ P2PE) than a business that also takes phone orders into a virtual terminal or stores card numbers in a CRM (which usually pushes toward SAQ D, the longest form). E-commerce merchants using a fully hosted, redirect-based checkout usually qualify for a shorter SAQ than one embedding a card field directly on their own site.
We start by documenting every channel where a card touches your business: counter terminal, mobile reader, phone/mail orders, e-commerce checkout, recurring billing, and any paper or spreadsheet that still records a card number. That inventory — not guesswork — determines the questionnaire, and it's also what changes the scope if you add a channel later, such as launching an online store on top of an existing counter business.
What actually reduces PCI scope
Tokenization, EMV chip acceptance, and hosted or redirect checkout pages don't eliminate the annual validation requirement, but they do reduce how much of your environment is 'in scope' — meaning how many of your systems, networks and staff the questionnaire has to cover. A business that never stores, transmits or processes card numbers on its own servers (because a hosted gateway or P2PE terminal handles it) usually has a much shorter, simpler SAQ than one running its own payment page or storing card numbers for recurring billing internally.
The most common pitfall we see is a business assuming EMV or a modern POS automatically makes them 'compliant' — it reduces exposure and can shorten the applicable SAQ, but the annual attestation still has to be completed and signed by the merchant.
What a non-compliance status actually costs you operationally
Most processing programs assess a recurring fee while a merchant's PCI validation is expired or incomplete — not a penalty for a breach, just for a lapsed attestation. Because the requirement renews annually and often gets buried in email, the realistic failure mode isn't a business ignoring PCI on purpose, it's a renewal notice getting missed during a busy season. That's the specific gap the renewal tracking in this service is built to close.
Which SAQ type tends to apply
This is a general guide — your specific SAQ is confirmed after reviewing every channel where your business touches card data.
| How you take cards | Typically applicable SAQ | Why |
|---|---|---|
| Standalone, PIN-entry P2PE terminal only | SAQ P2PE | Card data is encrypted at the point of entry and never touches your systems |
| Fully hosted/redirect e-commerce checkout | SAQ A | Your website never handles card data directly |
| Card field embedded on your own site (not redirected) | SAQ A-EP or SAQ D | Your web environment is more directly in scope |
| Phone/mail orders keyed into a virtual terminal | SAQ D (or C-VT in some programs) | Card numbers are manually entered and may be logged |
| Card numbers stored for recurring billing without full tokenization | SAQ D | Broadest scope; stored cardholder data increases requirements |
Frequently asked questions
Do small businesses really need PCI compliance?
Yes. Every merchant that accepts card payments has to validate compliance with PCI DSS annually, regardless of size. The difference is which self-assessment questionnaire applies and whether scanning is required.
What is a non-compliance fee?
Many processing programs assess a monthly fee while a merchant's PCI validation is incomplete or expired. Completing validation is what resolves it, which is why we track renewal dates for our merchants.
Does using EMV or tokenization make me compliant?
Those controls reduce your exposure and can simplify which questionnaire applies, but they do not replace validation. You still complete an SAQ and, where applicable, scanning.
Can BSV complete the questionnaire for me?
We guide you through it and explain each section, but the attestation is signed by your business because compliance stays the merchant's responsibility.
How is my SAQ type decided?
It's based on every channel where your business touches card data — counter terminal, phone orders, e-commerce checkout, recurring billing and any stored records. A hosted checkout or standalone P2PE terminal usually qualifies for a shorter questionnaire than a business that keys in orders or stores card numbers directly.
Do I need external vulnerability scanning?
Scanning requirements depend on your SAQ type and whether your environment includes internet-facing systems that store, process or transmit card data. Where it applies, we coordinate the scan through your program's approved vendor.
What changes my PCI scope if I add an online store to an existing counter business?
Adding a new payment channel changes what has to be documented and can change which SAQ applies, since e-commerce and card-present acceptance are scoped differently. We revisit your compliance profile whenever a channel, location or device is added.