Who needs to complete the self assessment questionnaire?
Your acquiring bank can confirm, but typically all level 2, 3, and 4 merchants and service providers can complete a PCI Self-Assessment Questionnaire on an annual basis. I can just answer “yes” to all the criteria on the Self-Assessment Questionnaire. The Self-Assessment Questionnaire is a mechanism for getting the information about the level of your compliance to your merchant bank. The standard applies at all times. Just saying yes to the questions puts you at great risk. If a compromise occurs and you are not compliant, the matter would be taken very seriously and the potential of huge fines and further inability to process credit cards. You would be risking your whole business by answering “yes” to the questions, when there is no factual basis for the answers.
All merchants at level 2, 3 and 4 and all service providers at level 3 must complete a PCI self assessment questionnaire (SAQ) on an annual basis. Level 4 merchants should contact their acquiring banks for requirements. Note: In Canada, for Visa, merchants must have their SAQ validated by a PCI qualified security assessor (QSA) prior to submitting the SAQ to acquiring banks.
