The short answer
SAQ-A applies when card data is fully outsourced — hosted payment page or iframe. SAQ-A-EP applies when your site controls the payment page but does not touch card data directly. SAQ-D applies when card data touches your systems. SAQ-B and B-IP cover standalone terminals.
Why merchants end up on the wrong one
Providers sometimes default everyone to the longest questionnaire because it is safest for them. Ask which one your actual data flow requires — the difference is hours of work and, more importantly, real liability.
Changing your integration changes your SAQ
Moving from a hosted page to a self-hosted form silently increases your obligations. Check the compliance consequence before making that change for design reasons.
Key takeaways
- The questionnaire follows the data flow, not the business size
- Hosted fields keep you on the short form
- Integration changes can change your SAQ obligations
Want this checked against your own statement?
We are an independent agent — we shop every processor we work with and bring you the best deal for your profile. Free analysis, every fee named, back within 4 hours. Or call now and we will quote you on the phone.