Who decides which SAQ a merchant must complete?

The merchant's acquirer or payment provider, according to card scheme rules, transaction volume and channel. That party also decides whether an assessor must countersign the questionnaire. For a PayFac or PSP, this means the SAQ type is part of what the operator determines and records at onboarding, rather than a choice left to the merchant.

The acquirer's call

Self-assessment questionnaires come in several types, from SAQ A for merchants that outsource all card handling to SAQ D for those that store card data. Which one applies depends on the merchant's channel, its integration and its transaction volume. The decision belongs to the merchant's acquirer or payment provider, applying card scheme rules, and that party also decides whether a Qualified Security Assessor must countersign.

For PayFacs and PSPs

• The operator determines the SAQ type for each merchant at onboarding, based on the integration chosen.
• It records the type, the validation date and the next review.
• It collects the completed questionnaire and attestation as part of its risk program.
• Its sponsor acquirer may audit that process.

Why this matters

A merchant left to choose its own SAQ will pick the lightest one. The operator carries the consequences if the choice is wrong, because its acquirer holds it responsible for its sub-merchants' compliance. Making the SAQ type a function of the integration, hosted page, iframe, hosted fields or direct integration, and recording it on the merchant file turns compliance into a data point rather than a yearly scramble.