Answer
PCI compliance for small business
Quick answer
PCI compliance means following the Payment Card Industry Data Security Standard (PCI DSS) whenever you accept cards. Most small businesses prove it by completing an annual self-assessment questionnaire. Using a hosted checkout or payment links, so card numbers never touch your systems, keeps that questionnaire short, usually SAQ A.
Updated October 2026. Evergreen page — refreshed in place as facts change.
What is PCI DSS, and who has to follow it?
PCI DSS is a security standard written by the PCI Security Standards Council, which American Express, Discover, JCB, Mastercard and Visa founded in 2006. It applies to every business that accepts, processes, stores or transmits card data, whatever its size. The current version is PCI DSS v4.0.1, published in 2024.
It is not a federal law. It is enforced through the card networks' rules and your agreement with your payment provider, which is why the provider is the one asking you to confirm compliance, and the one passing on fines or fees when a business does not.
Which merchant level are you?
Your level decides how you prove compliance, and it is set by how many card transactions you process a year. Nearly every small business is Level 4, which means a self-assessment rather than an outside audit. Your provider or acquiring bank confirms your level.
| Level | Annual Visa transactions | How compliance is usually validated |
|---|---|---|
| Level 1 | Over 6 million | Annual on-site assessment by a qualified security assessor |
| Level 2 | 1 million to 6 million | Self-assessment questionnaire; some acquirers require more |
| Level 3 | 20,000 to 1 million ecommerce | Self-assessment questionnaire |
| Level 4 | Fewer than 20,000 ecommerce, or up to 1 million in total | Self-assessment questionnaire |
Which self-assessment questionnaire applies to you?
There are several self-assessment questionnaires (SAQs), and the right one depends on how card data moves through your business. The less of it your own systems touch, the shorter the questionnaire. SAQ A is the shortest; SAQ D, for businesses that handle card data themselves, is the longest by far.
| Questionnaire | Who it is for |
|---|---|
| SAQ A | Card-not-present businesses (online, mail or phone orders) that fully outsource card entry to a provider's hosted page or frame |
| SAQ A-EP | Ecommerce sites that control how card data reaches the provider, such as a direct-post form |
| SAQ B / B-IP | Businesses using standalone card terminals, dial-up or IP-connected |
| SAQ C-VT | Businesses keying payments into a provider's web-based virtual terminal |
| SAQ C | Businesses whose payment software is connected to the internet |
| SAQ P2PE | Businesses using a validated point-to-point encryption terminal solution |
| SAQ D | Everyone else, including any business that stores card numbers |
Why does hosted checkout keep the work small?
PCI scope follows the card number. If customers type card details into a page or frame served by your provider, the number never reaches your website, servers or staff, and most of the standard simply does not apply to you. That is the situation SAQ A was written for.
On Anytime Capital Payments, card details are entered on a checkout served by Anytime Capital, inside the Pay button window or the inline frame, so they never pass through your site or servers. Payment links, invoices and the hosted checkout work the same way, and so does in-person payment, where the customer pays on their own phone.
What do PCI fees and non-compliance fees cover?
Some providers, especially traditional merchant accounts, charge an annual PCI compliance fee, a monthly fee for a compliance portal, or a non-compliance fee each month until you submit your questionnaire. Paying a fee does not make you compliant; it pays for a tool or a penalty.
Ask what each fee includes, and whether moving to hosted checkout would remove it. Anytime Capital Payments charges no PCI fees, and no monthly or setup fees either.
A small-business PCI checklist
Most of PCI for a small business comes down to a few habits that keep card numbers out of places they should not be. Work through these, then complete the questionnaire your provider asks for each year.
- Take online payments through a hosted checkout, payment links or an embedded frame from your provider
- Never write down, store, email or message full card numbers or security codes
- Do not take card details over chat or email; send a payment link instead
- Use unique logins and two-factor authentication for every payments dashboard
- Keep devices that take payments updated, and keep guest Wi-Fi separate from them
- Complete your questionnaire, and any vulnerability scans it calls for, on time each year
Frequently Asked Questions
Is PCI compliance required by law?
Not by US federal law. It is required by the card networks' rules and your provider agreement, and a few states reference it in their own data-security laws. The practical consequences of ignoring it are fees, fines passed on after a breach, and possibly losing the ability to take cards.
Do I still need PCI compliance if I use a provider like Stripe or Square?
Yes, but your share is much smaller. Using a provider's hosted checkout or payment links usually qualifies a business for SAQ A, the shortest questionnaire, because card numbers never touch its own systems. You still confirm compliance each year.
How much does PCI compliance cost a small business?
With hosted checkout it is mostly an hour or two each year to complete the questionnaire. Costs rise if your provider charges PCI or non-compliance fees, if your setup needs vulnerability scans, or if you handle card data yourself and need a longer questionnaire or outside help.
What happens if a business is not PCI compliant?
Your provider may charge a monthly non-compliance fee until you submit your questionnaire. After a data breach, a non-compliant business can face network fines passed on by its acquirer, the cost of investigating the breach, and the loss of its ability to accept cards.
What is SAQ A?
SAQ A is the shortest PCI self-assessment questionnaire, for businesses that outsource all card entry to a PCI-compliant provider, such as through a hosted payment page, payment links or an embedded frame served by the provider, so no card data is processed or stored on their own systems.
Keep reading
Important Disclosures
- Third-party fees and product details cited on this page are each company's published US pricing, or industry-typical ranges, as of the date shown and may have changed. Check current pricing with the provider before you decide.
- Information on this page is general and educational — it is not financial, legal, or tax advice.
- Anytime Capital is a fintech company, not a bank. Payment processing, banking and payout services are provided by Anytime Capital's licensed partners. Rates shown are for US card payments; international cards, currency conversion and disputes may carry additional fees shown in your dashboard before you accept a payment.