The verdict in three sentences
For a Dubai SME, compliance boils down to one structural decision: never touch card data by relying on a hosted checkout (SAQ-A), or handle it and absorb an SAQ-D at 8,000-20,000 EUR of annual audit. 3-D Secure 2 cuts fraud by about 60 % but costs 1 to 3 conversion points, a trade-off to calibrate to your basket. A chargeback costs 15 to 25 EUR in fixed fees on top of the refunded amount, which makes fraud prevention directly profitable.
SAQ-A or SAQ-D: the real compliance cost
Your PCI-DSS questionnaire level depends on your architecture. Here are 2026 orders of magnitude.
| Scenario | Card scope | Compliance cost/year |
|---|---|---|
| Hosted checkout (SAQ-A) | no card data | nearly free |
| iframe fields (SAQ-A-EP) | redirected | 1,500-3,500 EUR |
| Tokenization via PSP | token only | 2,000-4,000 EUR |
| Card data in-house (SAQ-D) | full | 8,000-20,000 EUR |
| On-site QSA audit | level 1 | 20,000 EUR+ |
The default recommendation for an SME is clear: stay in SAQ-A via a hosted PSP. Handling card data only makes sense above very high volume with a dedicated security team.
Application compliance and fraud
Beyond the questionnaire, application compliance has a project cost. Here are 2026 line items.
| Item | Cost EUR | Timeline |
|---|---|---|
| Migration to hosted checkout | 3,500-6,000 | 4-6 weeks |
| Tokenization + data removal | 2,500-5,000 | 3-5 weeks |
| 3-D Secure 2 integration | 1,500-3,000 | 2-3 weeks |
| Anti-fraud rules / scoring | 2,000-4,500 | 2-4 weeks |
| Full compliance overhaul | 3,500-9,000 | 4-8 weeks |
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
3-D Secure 2 is the best anti-fraud lever: it cuts fraud by around 60 % and shifts liability to the issuer, but each friction costs 1 to 3 conversion points. So it is activated selectively, via rules based on amount and risk.
Mini case study
Sarah, who runs an online cosmetics store in Dubai, processed card data in her old system, exposing her to an SAQ-D at 12,000 EUR of annual audit. By migrating to a hosted checkout with tokenization for 5,500 EUR, she moves back to SAQ-A, saves 12,000 EUR per year of audit, and enables targeted 3-D Secure 2 above 100 EUR. Result: fraud cut by about 60 %, around twenty chargebacks avoided per year at 20 EUR each, an investment amortized in under 6 months.
FAQ
Is SAQ-A really free? The questionnaire is self-attested with no external audit, so nearly free. The real cost is the migration project to a hosted checkout, 3,500 to 6,000 EUR once.
Does 3-D Secure lower sales? Yes, by 1 to 3 conversion points depending on friction. But it cuts fraud by about 60 % and shifts liability, making it profitable as soon as your fraud rate exceeds a few tenths of a point.
How much does a chargeback cost? 15 to 25 EUR in fixed fees on top of the refunded amount, not counting the lost product. Thirty chargebacks a year quickly reaches 1,500 EUR in fees.
How long to become compliant? Budget 4 to 8 weeks for a full application compliance overhaul, tokenization and 3-D Secure 2 included.
Let's scope your project. Describe your current payment architecture and volume, and we'll audit your SAQ level and quote the compliance work. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
