Every hotel that accepts credit cards has to validate PCI compliance, and for most properties that means completing a PCI SAQ (Self-Assessment Questionnaire) each year. The catch is that there are several SAQ types, and picking the wrong one can mean answering questions that do not apply to you, or worse, missing ones that do. This guide explains each PCI SAQ in plain language and how hotels usually fit into them.

What Is a PCI SAQ?

A PCI SAQ is a questionnaire that merchants complete to confirm they meet the PCI Data Security Standard. Each SAQ type is built for a specific way of accepting cards. The more of the payment process happens on your own systems, the longer and more demanding the SAQ.

Most independent and franchised hotels validate with an SAQ rather than a full on-site assessment. Your payment processor tells you your merchant level and which SAQ to complete. The descriptions below help you understand that decision and spot when your setup has changed.

The PCI SAQ Types, Explained for Hotels

SAQ A

For card-not-present merchants that fully outsource card handling to PCI DSS compliant providers, so card data never touches their own systems. A hotel rarely qualifies overall because the front desk takes cards in person, but a fully hosted online booking engine may fit this model for that channel.

SAQ A-EP

For e-commerce merchants whose own website affects the security of the payment page, even though a third party processes the payment. This applies if your hotel website plays a part in the card entry process rather than handing it off completely.

SAQ B

For merchants using only imprint machines or standalone terminals that dial out over a phone line, with no electronic card data storage. This is increasingly rare as carriers retire copper phone lines.

SAQ B-IP

For merchants using standalone, PTS-approved card terminals that connect to the processor over an IP connection, kept separate from other systems. This is common for smaller hotels whose terminals are not integrated with the PMS. Quarterly ASV scans apply.

SAQ C-VT

For merchants who key in transactions one at a time through a web-based virtual terminal from a third-party provider, on a computer used for that purpose and isolated from other systems, with no electronic card data storage. Some properties use this for phone reservations.

SAQ C

For merchants with payment application systems connected to the internet, such as a PMS or POS with integrated payments, and no electronic storage of card data. Many hotels with integrated front desk payments land here. Quarterly ASV scans apply.

SAQ P2PE

For merchants using only hardware terminals that are part of a validated, PCI-listed point-to-point encryption (P2PE) solution, with no electronic card data storage. This is the shortest card-present SAQ and does not include ASV scans, which is why P2PE terminals are worth asking your processor about.

SAQ D

For every merchant that does not fit another SAQ, including any property that stores card data electronically. It covers the full PCI DSS and includes ASV scans plus additional testing. If your setup has grown over the years without a plan, there is a good chance you are here.

Which PCI SAQ Fits a Typical Hotel?

Small property, standalone IP terminals at the desk: usually SAQ B-IP.
PMS or POS with integrated payments: usually SAQ C, or SAQ D if card data is stored.
Terminals on a validated P2PE solution only: SAQ P2PE.
Full-service hotel with several outlets and channels: often SAQ D.

Hotels take cards in many ways: at the front desk, by phone, through the booking engine, through OTAs and at the restaurant or spa. If you accept cards through more than one channel, ask your processor whether one SAQ covers everything or whether you need more than one.

How to Move to a Simpler SAQ

The fastest way to make PCI easier is to reduce how much of your property handles card data. The biggest levers are:

Tokenization so your PMS never stores real card numbers. See our guide to hotel PMS payment security.
Validated P2PE terminals, which can qualify you for the shortest card-present SAQ.
Secure payment links instead of taking cards by email, chat or paper forms.
Network segmentation so payment systems are separated from guest WiFi and office PCs. Our guide to PCI compliance for hotels covers the network side.

Get Your SAQ Right the First Time

If you are unsure which PCI SAQ fits your property, or your setup has changed since you last completed one, start with our PCI readiness check. We map how cards move through your hotel, help you confirm your SAQ type and tell you whether quarterly ASV scans apply. To learn what those scans involve, read What Is an ASV Scan?

Book a PCI readiness check or call 226-476-3358.