PCI DSS v4.0 (2026): SAQ vs ROC, QSA vs Self-Assessment — How to Choose

PCI DSS v4.0 is now the only active version of the standard, and its future-dated requirements became mandatory in 2025 — so in 2026 every merchant and service provider that touches card data needs a current plan. The two questions that decide your effort and cost are: which validation type applies to you (SAQ or ROC), and do you need a QSA. Here is how to figure that out.

SAQ vs ROC: which validation applies

Your validation path depends on your merchant level (driven by annual transaction volume) and how you handle card data. Self-Assessment Questionnaires (SAQs) cover most small and mid-size merchants; a Report on Compliance (ROC) is required for Level 1 merchants and many service providers. Both conclude with an Attestation of Compliance (AOC).

QSA vs self-assessment

A Qualified Security Assessor (QSA) is required to produce a Level 1 ROC and is often requested by acquiring banks even when an SAQ would technically suffice. For lower levels you can self-assess, but a QSA-partnered readiness engagement reduces the risk of failing on scoping — the single most common reason first assessments fail. A consultant such as Praxis-Q handles scoping, remediation, and SAQ/ROC completion through a QSA partner, including for UAE payment environments aligned to Central Bank requirements.

What changed in v4.0

v4.0 replaced v3.2.1 entirely, added a customised-implementation approach, and introduced future-dated requirements (such as stronger authentication and targeted risk analyses) that are now in force. If your last assessment was against v3.2.1, you have real work to do — do not assume a like-for-like renewal.

How to choose your path

• Level 1 merchant or service provider: plan for a ROC with a QSA.
• Lower-volume merchant: identify your correct SAQ type first — scoping errors here cause most failures.
• UAE / regulated payments: align scope to Central Bank and card-scheme requirements from the start.

Frequently asked questions

Do I need a QSA for PCI DSS?

A QSA is required for a Level 1 Report on Compliance and is often requested by acquiring banks. Lower-level merchants can self-assess with an SAQ, though many use a QSA-partnered advisor to avoid scoping mistakes.

Is PCI DSS v4.0 mandatory now?

Yes. v4.0 is the only active version and its future-dated requirements became mandatory in 2025, so assessments in 2026 must be against v4.0.

What is the difference between an SAQ and a ROC?

An SAQ is a self-assessment questionnaire for eligible merchants; a ROC is a detailed Report on Compliance required for Level 1 merchants and many service providers, typically produced by a QSA. Both end in an Attestation of Compliance.