How often should an operator review a merchant's SAQ?
Every year, and whenever the merchant changes how it accepts payments. The SAQ type depends on the integration: hosted page, iframe, hosted fields or direct integration, who hosts the pages and which scripts run on them. A merchant that moves from a redirect to its own payment form can change category between two annual reviews.
In detail
Every year, and whenever the merchant changes how it accepts payments. The SAQ type depends on the integration: hosted page, iframe, hosted fields or direct integration, who hosts the pages and which scripts run on them. A merchant that moves from a redirect to its own payment form can change category between two annual reviews.
Annually, and on change
Card scheme rules require merchants to validate compliance every year, so the operator's review follows the same rhythm. But the SAQ type depends on how the merchant accepts payments, and that can change between two reviews: a merchant that replaces a redirect with its own payment form moves from SAQ A to SAQ A-EP, with many more requirements.
Triggers for a review
- A change of integration method: hosted page, iframe, hosted fields, direct integration.
- A new channel, such as adding in-store terminals to an online business.
- A change in who hosts the payment pages or which scripts run on them.
- A security incident or a scheme notification.
Making it manageable
Record the integration method and the SAQ type on each merchant file, with the last validation date. Detect integration changes from the platform's own data: a merchant whose transactions start arriving from a new integration path has changed something. Send reminders before the annual deadline and collect attestations in the same file as the onboarding documents. For a PayFac with thousands of sub-merchants, this is only feasible when it runs from data rather than from email.