Every business that processes card payments - including Mollie’s customers - is expected to validate PCI DSS compliance on an annual basis. For the vast majority of customers, this validation takes the form of a Self-Assessment Questionnaire (SAQ): a checklist of security controls you confirm are in place, tailored to how you accept payments. Depending on your integration, you may also have to conduct quarterly Vulnerability Scans.
What does the Self-Assessment Questionnaire entail?
A PCI SAQ (Payment Card Industry Self-Assessment Questionnaire) is a validation tool and checklist published by the PCI Security Standards Council. It allows customers and service providers to evaluate, declare, and report their compliance with the PCI DSS.
What determines which Self-Assessment Questionnaire you need?
There are various SAQ types, and which one you are required to complete depends on how card data flows through your systems. A customer using Mollie Checkout, where consumers are redirected to a Mollie-hosted payment page, likely has a fundamentally different (much smaller) footprint than one building a fully custom checkout that captures raw card numbers on their own servers.
Note: While Mollie provides general guidance on PCI DSS compliance, we cannot offer definitive, legally binding, or customised advice regarding your specific Self-Assessment Questionnaire (SAQ); you are ultimately responsible for their own compliance validation.
How do I know which SAQ applies to me?
Working out exactly which SAQ applies to you - and then correctly answering every question on it - can be the hardest part of PCI compliance, especially if this is your first time.
The SAQs are self-serve, but most of the time people work with certified third-party partners to complete them.
There are multiple vendors through which you can validate your PCI compliance, but we have partnered with a certified Qualified Security Assessor (QSA) called SecurityMetrics, to provide you with end-to-end guidance on this entire process. If you choose to sign up for their services, as a Mollie customer you will receive access to discounted package options, expert-led advice, 24/7 support, and a tailored offering.
What it includes
- A short, guided scoping questionnaire about how you use Mollie, which automatically determines your correct SAQ type.
- A percentage of the SAQ questions already pre-filled, so you're not starting from a blank form.
- Step-by-step guidance through any remaining questions, in plain language.
- A completed, submission-ready SAQ and supporting documentation at the end of the process.
- SecurityMetrics also conducts the vulnerability scanning, so you do not need an additional Certified Vulnerability Assessor.
How do I get access?
To read more or sign up, visit Mollie’s Security Metrics referral link here: https://www.securitymetrics.com/merchant/mollie
Pricing
In order to get access to the discounted rates, be sure to sign up with your business email address linked to your Mollie account. Please see package options below:
Disclaimer
Merchants using this product or signing up for these services may choose to enter into a relationship with SecurityMetrics, a certified Qualified Security Assessor (QSA) who manages the PCI DSS assessment process end-to-end. This choice is entirely at the merchant's discretion; you are free to engage SecurityMetrics or any other QSA or PCI DSS compliance provider of your choosing. Mollie is not a PCI DSS advisor and does not provide advice, assessments, or representations regarding your PCI DSS compliance status or obligations. Please note that SecurityMetrics owns and monitors the data within its platform, including the data you share, but Mollie will have access to relevant data.