Do SAQ A merchants need vulnerability scans?

Yes. The PCI SSC confirms that SAQ A for PCI DSS v4.x includes quarterly external vulnerability scanning by an Approved Scanning Vendor, including for merchants whose pages redirect to a provider or embed its iframe. The merchant remains responsible for the requirements listed in SAQ A.

What SAQ A still requires

The 2025 update removed two payment-page requirements from SAQ A and added an eligibility criterion on script attacks, but some duties did not change. SAQ A still requires quarterly external vulnerability scans by an Approved Scanning Vendor, even for redirect and iframe merchants, and a merchant that cannot confirm its site is protected from script attacks moves to SAQ A-EP. SAQ A remains the cheapest path, at 27 requirements instead of 151 or 250, but the merchant still owes quarterly ASV scans and a yearly AOC.

Handling scans at onboarding

Acquirers hold PayFacs and PSPs responsible for the compliance of their sub-merchants. The onboarding file should record which integration each merchant uses, derive the SAQ type from it, and collect the signed AOC with its expiry date. On a platform that serves hosted pages, the remaining merchant duties, ASV scans, the script confirmation and the AOC collection, are small enough to automate at onboarding.

More detail in our #PayDecoding episode on PCI DSS SAQ.