The verdict in three sentences
Most small shops either over-engineer PCI-DSS or ignore it entirely, both costly mistakes. The 2026 best practice: use a hosted field (iframe) or provider redirect to stay in SAQ-A. As a result you never touch the raw card number and your compliance cost falls near zero.
SAQ-A vs SAQ-D: the only decision that matters
PCI scope depends on whether card data flows through your servers or not.
| Criterion | SAQ-A | SAQ-D |
|---|---|---|
| Where card data is entered | Provider iframe / redirect | On your server |
| Number of self-assessment questions | ~22 | 300+ |
| Quarterly ASV scans | Not required | Mandatory |
| Annual compliance cost | ~0-100,000 FCFA | 500,000+ FCFA |
| Technical effort | Low | High |
| Breach exposure | Reduced | Maximal |
The golden rule: never let the PAN (card number) pass through your code. A hosted field from Stripe, Flutterwave or Paystack keeps you in SAQ-A.
What you actually need to put in place
Even in SAQ-A, a few obligations remain non-negotiable.
| 2026 requirement | SAQ-A | SAQ-D |
|---|---|---|
| TLS 1.2+ mandatory | Yes | Yes |
| Annual self-assessment | Yes (~22 questions) | Yes (300+) |
| Quarterly ASV scans | No | Yes |
| Annual penetration test | No | Recommended/required |
| Encrypted PAN storage | Forbidden (no storage) | Strong encryption required |
| Access logging | Basic | Full and audited |
In practice, 90 % of African shops should aim for SAQ-A and never leave that scope.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Mini case study
Wanjiru launches a cosmetics store in Nairobi. Her first provider offers a "homemade" card form: it pushes her to SAQ-D, with ASV scans and audit estimated at 650,000 FCFA/year. She rebuilds checkout with her PSP's hosted iframe: she returns to SAQ-A, fills in 22 questions, and her annual compliance cost drops to ~40,000 FCFA. Saving: over 600,000 FCFA/year with no loss of security.
FAQ
Does PCI-DSS apply to my small shop? Yes, as soon as you accept cards. But with a hosted field you stay in SAQ-A, the lightest scope.
What's the cost difference SAQ-A vs SAQ-D? Near zero in SAQ-A versus 500,000+ FCFA/year in SAQ-D (ASV scans, audit, penetration test).
Can I store card numbers to re-bill? No, never store the PAN. Use the provider's tokenization, which keeps storage on their side.
Are quarterly ASV scans mandatory? Only in SAQ-D. In SAQ-A they're not required, which simplifies everything.
What's the risk in a breach? Fines, remediation costs and losing the ability to accept cards. SAQ-A sharply reduces the exposure surface.
Let's talk about your project. We build PCI SAQ-A checkouts that keep you out of the heavy scope. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
