The verdict in three sentences
In Nairobi in 2026, touching raw card data drags you into a heavy, costly PCI-DSS scope. Hosted fields and tokenization keep you at SAQ-A, versus the SAQ-D of a self-hosted form, with an audit cost gap of 500,000 to 3,000,000 FCFA/year. 3DS2 is mandatory: it adds 2-5 seconds but cuts fraud by 40-70 %.
SAQ-A vs SAQ-D: what really changes
The central PCI-DSS question is whether your server ever sees the card number (PAN). If it never does, your scope collapses and so does your cost.
| Criterion | SAQ-A (hosted fields) | SAQ-D (self-hosted form) |
|---|---|---|
| Server sees the PAN | Never | Yes |
| Annual audit cost (2026) | Low | 500,000 to 3,000,000 FCFA |
| Compliance burden | Light | Heavy (many controls) |
| Breach risk | Reduced | Fines + card-scheme penalties |
| Re-attestation | Simple annual | Complex annual |
By using hosted fields (Paystack, Flutterwave, Stripe), the card form is served and handled by the provider: your server never sees the PAN, which keeps you at SAQ-A, the lightest questionnaire.
Tokenization and 3DS2: security without storage
Two technical building blocks let you collect card payments without ever storing sensitive data while sharply reducing fraud.
| Building block | Role | Effect (2026 order of magnitude) |
|---|---|---|
| Hosted fields | Isolate the PAN | Keeps you at SAQ-A |
| Tokenization | Replace PAN with a token | Zero card storage |
| 3DS2 | Strong authentication | +2-5 s, fraud -40 to -70 % |
| Annual re-attestation | Maintain compliance | Required every year |
Tokenization replaces the card number with a token useless outside your integration: you store no PAN, eliminating a whole layer of breach risk. 3DS2, even if it adds a few seconds, drastically cuts fraud and unpaid transactions.
Mini case study
Wanjiru runs an electronics e-commerce store in Nairobi and had built her own card form, placing her at SAQ-D. Her annual compliance audit cost around 2,000,000 FCFA/year, plus a heavy monitoring burden.
She migrates to hosted fields with tokenization and 3DS2. She moves back to SAQ-A: audit cost falls to a fraction of the previous figure, about 1,800,000 FCFA saved per year. As a bonus, 3DS2 halves her fraud, reducing chargebacks and disputes. The migration pays for itself in the first year.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
FAQ
What is the difference between SAQ-A and SAQ-D?
SAQ-A covers merchants whose server never sees the PAN (hosted fields). SAQ-D, far heavier, applies as soon as you handle raw card data, with an audit of 500,000 to 3,000,000 FCFA/year.
Does tokenization exempt me from PCI-DSS?
No, but it sharply reduces your scope: by storing no PAN, you stay at SAQ-A, the simplest level to maintain.
Is 3DS2 mandatory?
Yes, 3DS2 is now required. It adds 2-5 seconds to the flow but cuts fraud by 40 to 70 %, protecting your margin and reputation.
Do I re-attest every year?
Yes. PCI-DSS compliance requires annual re-attestation, even at SAQ-A. With hosted fields, this formality stays light.
Can I accept international cards from Nairobi?
Yes, via Paystack, Flutterwave or Stripe, which handle hosted fields, tokenization and 3DS2. You stay compliant without ever storing a card.
Let's talk about your project. We integrate a SAQ-A-compliant card checkout with tokenization and 3DS2, never storing your cards. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
