The verdict in three sentences
In Africa as elsewhere, PCI DSS 2026 compliance boils down to one principle: never store the PAN (card number) on your servers. By delegating card entry to the PSP via hosted fields or a hosted payment page, you shrink your scope from the heavy SAQ-D (~300 questions) to the light SAQ-A (~22 questions). As a result, 3-D Secure 2 is handled by the PSP, the audit simplifies, and your compliance cost trends toward zero.
SAQ-A vs SAQ-D: the choice that changes everything
The self-assessment questionnaire (SAQ) that applies to you hinges on a single architecture decision: who touches the card data?
| Criterion | SAQ-A (hosted) | SAQ-D (storage) |
|---|---|---|
| Number of questions | ~22 | ~300 |
| Who enters the card | The PSP | Your server |
| PAN storage | Never | On you (encrypted) |
| 3-D Secure 2 | Handled by PSP | On you |
| Annual audit | Self-assessment | Heavy self-assessment / QSA |
| Compliance cost | ~0 | High |
The operational conclusion is clear: barring a rare regulatory need, every African merchant benefits from staying in SAQ-A via hosted fields.
Splitting responsibilities merchant / PSP
Compliance is not a total transfer: even with hosted fields, some obligations stay with the merchant.
| Responsibility | Merchant | PSP |
|---|---|---|
| Secure PAN entry | — | Yes |
| Encryption in transit (TLS) | Shared | Yes |
| 3-D Secure 2 / authentication | — | Yes |
| Access / password management | Yes | — |
| Admin access logging | Yes | — |
| PCI certification of infrastructure | — | Yes |
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Even freed from card storage, the merchant must secure their own accesses and log their back-office: that is where most real incidents nest.
Mini case study
Moussa launches a ticketing platform in Abidjan and, for convenience, wanted to store his loyal customers' cards. That choice would have pushed him into SAQ-D (~300 questions), with a heavy audit and an estimated cost of several million FCFA per year. By opting for his PSP's hosted fields, he stays in SAQ-A (~22 questions), stores no PAN, and his annual compliance cost drops to nearly 0 FCFA — the PSP carrying the certification of the payment infrastructure.
FAQ
Must I be PCI DSS compliant if I use a PSP? Yes, any merchant accepting cards is concerned, but with hosted fields your obligation is limited to the SAQ-A of about 22 questions, easily handled in-house.
Is 3-D Secure 2 mandatory in 2026? Yes, strong authentication via 3-D Secure 2 is the norm on card payments, and it is carried by the PSP when you use its hosted page.
Can I store cards to ease repeat purchases? No, not on your servers. Use the PSP's tokenization: you keep a harmless token, never the PAN, which keeps you in SAQ-A.
How much does a PCI audit cost under SAQ-A? In practice, the SAQ-A self-assessment generates no external audit cost: it is an annual questionnaire you fill in, unlike SAQ-D which may require a QSA.
Let's talk about your project. We design your card payment in SAQ-A, with no PAN storage, compliant and with no extra cost. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
