The verdict in three sentences
If no card data touches your servers, you fall under the lightweight SAQ-A questionnaire and avoid a full PCI-DSS audit costing 3-8 million FCFA. The 2026 golden rule: use a hosted checkout or a tokenized iframe from an aggregator already certified PCI-DSS Level 1. The direct API puts everything on you — choose it only with a dedicated security team.
The 4 integration models and their compliance burden
The PCI-DSS level required depends entirely on how the card data flows. The further you keep data from your infrastructure, the shorter the questionnaire.
| Integration model | Applicable SAQ | Card fields hosted by | Compliance burden |
|---|---|---|---|
| Hosted checkout (redirect) | SAQ-A | Aggregator | Very low |
| Iframe / tokenized fields | SAQ-A | Aggregator | Low |
| Direct API + tokenization | SAQ-D (light) | You (transit) | High |
| Direct API card storage | Full SAQ-D | You | Very high |
In practice 90% of African SMEs should aim for SAQ-A. SAQ-A has about 30 questions, versus more than 300 for SAQ-D.
What compliance really costs
2026 orders of magnitude for the West African market, excluding aggregator subscriptions.
| Item | SAQ-A (hosted) | SAQ-D / full audit |
|---|---|---|
| Annual questionnaire | Free self-assessment | 3,000,000 - 8,000,000 FCFA (QSA) |
| Quarterly ASV scan | Often included | 300,000 - 900,000 FCFA/yr |
| Penetration test | Not required | 1,500,000 - 4,000,000 FCFA/yr |
| Server hardening | None | 2,000,000+ FCFA |
| Tokenization | Provided by aggregator | To implement |
Tokenization — replacing the card number with a token useless out of context — is the pivot: it is mandatory for any recurring payment and removes you from the storage scope.
Mini case study
Awa, who runs a cosmetics shop in Dakar, takes in 4,000,000 FCFA/month, 25% by card (diaspora). By switching from a planned direct API to a hosted checkout, she moves from SAQ-D to SAQ-A: she saves the QSA audit (estimated 4,000,000 FCFA) and the annual pentest (2,000,000 FCFA), i.e. 6,000,000 FCFA in year one, for nearly identical customer friction.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
FAQ
Does PCI-DSS apply if I only use Wave and Orange Money?
Mobile money is not governed by PCI-DSS (that is a card standard). The moment you accept Visa/Mastercard, even one transaction, you enter scope.
Is a hosted checkout really enough to be compliant?
Yes, under SAQ-A, if the card entry page is served by the aggregator and you never store a number. You remain responsible for your site's security (HTTPS, updates).
How long does an SAQ-A self-assessment take?
Budget 1 to 3 days of internal work, no external auditor cost, renewed yearly.
What does a non-compliant SME risk?
In a breach: network fines of several million FCFA, loss of the right to accept cards, and liability for fraud. Reputational risk often exceeds the fine.
Is tokenization a paid add-on?
With most aggregators it is included in transaction fees (often 1.5-3.5%), with no dedicated surcharge.
Let's talk about your project. We integrate an SAQ-A compliant card checkout with native tokenization for your store. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
