TL;DR
Your acquirer (or the processor chasing you on their behalf) wants a credible, signed, dated Self-Assessment Questionnaire package — the Attestation of Compliance included — that matches how you actually take cards. They do not want a screenshot of a green dashboard, a Notion page, or a promise that "we're working on it." Fill the right SAQ, sign it, send the PDF. Everything else is optional theatre.
I've lost count of how many founders tell me the same story:
The bank emailed. Or the ISO. Or whoever "owns" the merchant account in the middle. Subject line something like PCI compliance outstanding or please provide your SAQ. Cue mild panic, a Google search, and three tabs of tools that all want a subscription before you've even figured out which questionnaire you need.
Here's the unglamorous truth from the other side of that email.
They are not buying your software story
The person reading your reply is not evaluating your security culture deck.
They are checking a box in their program: does this merchant have a current validation artefact that fits the payment channel they run?
That artefact is almost always:
- The right SAQ for how you take cards (A, A-EP, B-IP, … — see SAQ types explained)
- Filled against PCI DSS v4.0.1 (not a zombie v3 PDF you found on a random blog)
- With the Attestation of Compliance completed and signed
- Dated, and not obviously describing a payment setup you don't have
If you're guessing A vs A-EP, fix that first — SAQ A vs SAQ A-EP. Wrong questionnaire = weak package, even if every checkbox is neat.
What "good" looks like when they open the attachment
1. The official shape.
Banks and processors are used to SSC-form SAQ/AOC PDFs. A homemade Word doc titled "Our PCI Policy" is not the same object. You can be a careful merchant and still get bounced for the wrong format.
2. Eligibility that matches reality.
If you attest SAQ A while your checkout JS still owns the card fields, you're not being clever — you're under-scoping. Acquirers don't award points for optimism.
3. A signature and a date that aren't theatre.
Someone with authority attested. The self-assessment completion date is real. "We'll sign it when Legal wakes up" is not a file.
4. Consistency with what they already know about you.
If they boarded you as e-commerce with a hosted checkout, and you send a SAQ about dial-up terminals, someone will notice.
Optional extras they might ask for (ASV scans, policies, evidence packs) depend on the SAQ and their program. Don't invent a ROC-sized binder for a SAQ A merchant because a LinkedIn post scared you. Ask what they want attached — then send that.
What wastes everyone's time
A login to a compliance tool.
"Create an account and I'll share the dashboard" is not an Attestation of Compliance. Reviewers who never log into your SaaS still need a document they can file.
A screenshot of green ticks.
Status UI is for you. The bank wants the signed questionnaire package.
"Our gateway is PCI compliant."
Necessary relationship. Not your SAQ. (If you're fuzzy on vendor paperwork, that's Requirement 12.8 — related, not a substitute.)
The wrong year's form.
v4.0.1 is the living SAQ set. Shipping a stale template is how you get a polite "please resubmit."
Half the SAQ, fully confident tone.
Empty sections and "N/A" spam without explanation read as unserious. Serious ≠ long. Serious = complete for your eligibility.
The conversion moment nobody markets honestly
Most of the work before you hit "download PDF" should be cheap and reversible: figure out the SAQ, answer the questions, gather the boring vendor list.
The thing the bank files is the signed PDF. That's the artefact. That's what stops the chase — until next year's cycle, because PCI is annual and renewal is real.
So the sane path looks like:
- Confirm which SAQ your acquirer expects (Which SAQ Am I? helps you think; their email still wins)
- Complete it against how you take payments now
- Sign and date
- Send the package they asked for
- Keep a copy you can re-download when the same email arrives next year
If you're on hosted checkout and the open question is scripts / Jan 2025 eligibility language, that's the scripts post — not a reason to ghost the bank for six weeks.
What I built for that exact email
I got tired of watching people drown in 30-page PDFs and still not have something the bank would accept.
On pcidss-dashboard.com you walk the questionnaire in plain English, then download a signed, SSC-shaped PDF when you're ready. Wizard is free to fill. You pay when you download the artefact — SAQ A €99, SAQ A-EP €699 (other paths exist for other SAQs / enterprise).
That is not "buy a dashboard so you feel compliant." It's "produce the thing the acquirer actually files." Using the tool does not make you compliant by magic — you still have to answer honestly and meet the requirements you attest to.
If the email already landed and you're staring at the wrong PDF, write sales@pcidss-dashboard.com. Happier to sort the artefact early than watch another merchant invent a Word doc at midnight.
