PCI DSS self-assessment
FFUSA merchants complete a PCI DSS Self-Assessment Questionnaire (SAQ) each year to attest how they handle cardholder data. The questionnaire takes about 15–30 minutes, can be saved and resumed, and is reviewed by our compliance team.
Which questionnaire applies to you?
Choose the SAQ that matches how your business accepts payments. Not sure? Complete the eligibility step first — you can change the form before answering questions.
-
SAQ A
Card-not-present merchants
E-commerce, mail-order or telephone-order merchants that outsource all cardholder-data functions to validated third parties and store no cardholder data electronically.
-
SAQ B
In-person merchants — imprint or dial-up terminals
Merchants using only imprint machines or standalone dial-out terminals, storing no cardholder data electronically.
-
SAQ C
In-person merchants — internet-connected payment applications
Merchants with payment applications connected to the internet and no electronic cardholder-data storage.
-
SAQ D
All other merchants
Merchants that do not qualify for SAQ A, B or C. The full questionnaire, including ASV scan attestation.
How it works
- Get your link. Your FFUSA representative can send one, or you can request one yourself below — the secure link arrives by email.
- Answer by category. Work through each requirement area. You can stop any time; your progress is saved automatically.
- Review and sign. Confirm your answers and the attestation — then we review and follow up if anything needs remediation.
Security note: links are single-use and expire 90 days after issue. FFUSA will never ask for your password or full card number.