Braintree PCI Compliance: Which SAQ Applies and When You Need an ASV Scan
Braintree PCI compliance explained: see which SAQ fits Hosted Fields, Drop-in or custom builds, and when quarterly ASV scans apply. Book an ASV scan today.
The PCI DSS 4.0.1 deadline has already passed, but a surprising number of merchants are still confused about what that actually means for their ASV scanning programme. Part of the confusion is legitimate: there wasn’t one deadline; there were two, and PCI DSS 4.0.1 itself didn’t add a single new control; it clarified how the existing ones should be read and evidenced. This guide cuts through both problems. It lays out exactly which dates matter, what changed (and, just as importantly, what didn’t) between v4.0 and v4.0.1, and what’s specifically different about how 2026 assessments are treating ASV scanning compared to the last two years.
PCI DSS v4.0.1: A limited revision to PCI DSS v4.0 published by the PCI Security Standards Council to correct formatting issues and clarify ambiguous wording. It replaced v4.0 as the sole active standard and introduced no new or removed requirements.
Approved Scanning Vendor (ASV): A vendor certified by the PCI SSC to run the external vulnerability scans required under Requirement 11.3.2. Only scans from a currently listed ASV are accepted by acquirers.
Cardholder Data Environment (CDE): The systems, people, and processes that store, process, or transmit cardholder data, plus anything connected to them that could affect their security. Your ASV scan scope is only as accurate as your CDE scope.
Requirement 11.3.2 / 11.3.2.1: The clauses governing external scanning: quarterly ASV scans of all in-scope internet-facing systems (11.3.2), plus an additional scan after any significant network change (11.3.2.1).
Targeted Risk Analysis (TRA): A structured, risk-based justification some organisations use to support a customised approach to certain controls, rather than following the defined approach exactly as written.
SAQ A scope: The applicability question of whether a merchant on a fully hosted or redirect-based checkout still needs ASV scanning. Under v4.0.1's clarified language, redirect and iframe-based checkouts generally do.
Yes, both relevant dates have passed. PCI DSS v4.0 was retired on December 31, 2024, making v4.0.1 the only active standard from that point forward. Separately, the new v4.0 requirements that had been optional "best practices" since March 2022 became fully mandatory on March 31, 2025. There is no remaining PCI DSS 4.0.1 deadline still ahead of you, every current requirement, including ASV scanning provisions, has been enforceable since that date.
Merchants often use “the PCI DSS 4.0.1 deadline” loosely to mean either date, which is understandable but worth untangling: if you’re being asked whether you’re “past the 4.0.1 deadline,” the honest answer is that you have been for over a year. What’s live in 2026 isn’t a new cutoff; it’s a stricter assessment cycle against requirements that have already been mandatory for some time.
Get a free review of your checkout flow and CDE scope before your next scan cycle.
The mechanics of ASV scanning are unchanged. Quarterly external scans, a CVSS threshold below 4.0 to pass, and a clean rescan requirement after a failed scan were all true under v4.0 and remain true under PCI DSS 4.0.1 ASV scanning rules. What changed is applicability language, specifically, clearer wording on which merchants and system types fall in scope.
The PCI SSC’s own Summary of Changes classifies every 4.0.1 edit as either “clarification/guidance” or “structure/format,” and explicitly notes there are no new evolving requirements in this revision. The heaviest rewording landed in Requirements 6 and 8 (secure software and authentication), but the applicability notes touching Requirement 11.3.2 were also sharpened, mainly around what counts as an internet-facing system connected to the CDE, and which SAQ types those systems apply to.
Merchants using a hosted or redirect-based checkout, including iframe-embedded third-party payment pages are generally in scope for ASV scanning under the clarified SAQ A ASV scan requirements, even if they previously assumed a fully outsourced checkout meant no scanning obligation.
This is the change that catches the most merchants off guard, because it’s a shift in what businesses believed the rules meant rather than a shift in the rules themselves. A narrow exemption still exists where cardholder data genuinely never touches the merchant’s own systems in any form, but eligibility depends on the exact payment integration and should be confirmed with your acquirer, not assumed from a platform’s marketing claims about being “PCI compliant out of the box.”
Requirement 12.5.2 requires that your CDE scope be confirmed, documented, and reviewed by senior management at least once every 12 months. Under 2026 assessments, an ASV scan that's technically clean but doesn't reflect your current, correctly documented scope is treated as a compliance gap, not a passing result.
This is where many merchants who assume they’re covered actually aren’t. Cloud infrastructure added mid-year, a new payment page integration, or a forgotten subdomain can all sit outside a scan scope that hasn’t been reviewed since the original setup. A passing scan against an outdated scope doesn’t satisfy the requirement, the scope itself has to be current and signed off.
2026 is the first full assessment cycle in which QSAs and acquirers are applying PCI DSS 4.0.1 2026 enforcement standards without carrying over leniency for ambiguity that existed under the original v4.0 wording. Every subrequirement under 11.3; internal scanning, risk-based handling of lower-severity findings, authenticated scanning, significant-change rescans, and external ASV scans, now carries its own evidence expectation that's checked individually.
In practice, this means a missing quarterly scan report, an SAQ A merchant who never engaged an ASV, or a scan scope that quietly excludes a redirect-based checkout page are no longer arguable points during an assessment. There’s no single new calendar date to plan around this year, the operative deadline is your own recurring 90-day scan cycle, plus immediate rescans after significant changes. The risk in 2026 isn’t missing a global cutoff; it’s assuming a scan scope or SAQ answer from a prior year still holds up.
Quarterly scans, clear pass/fail reporting, and free rescans until you pass.
PCI DSS isn't enforced by a government regulator; it's enforced contractually, through your acquiring bank and, ultimately, the card brands. Consequences for a missed scan or unresolved failure typically include remediation demands from your acquirer, increased transaction fees, restricted processing privileges, and weakened standing with your cyber liability insurer if a breach occurs during a period of documented non-compliance.
A failed scan isn’t the end of the process, though, remediation and a clean rescan close the loop, and this hasn’t changed under 4.0.1. What has tightened is that quarterly scans returning the same unresolved vulnerabilities, cycle after cycle, are treated in 2026 as a program failure rather than a documentation gap.
Four checks cover most of the gap: confirm your ASV is currently listed with the PCI SSC and reports against v4.0.1, re-verify your SAQ type against the clarified redirect/iframe language, refresh your CDE scope documentation with senior management sign-off, and close out any open scan failures with a documented rescan rather than a remediation plan alone.
The PCI DSS 4.0.1 deadline, both the version cutover and the mandatory-requirements date; is behind us, not ahead. What’s live in 2026 isn’t a new rule but a stricter read of the existing one: assessors are checking ASV scanning, SAQ A applicability, and CDE scope documentation individually, with none of the ambiguity that earlier v4.0 assessments allowed. If your scan scope, SAQ answers, or ASV reporting format predate 2025, that’s the gap worth closing before your next quarterly cycle; not a new deadline worth waiting for.
See how Secusy stacks up on pricing, turnaround time, and 4.0.1-ready reporting.
No. 4.0.1 added no new requirements. If your program met v4.0's actual controls, it's still compliant, but your documented scan scope is worth reviewing against the clarified applicability notes.
Binoy Koonammavu, is the Founder and CEO of Secusy ASV, where he helps SMBs and fintech companies meet PCI DSS scanning requirements without the complexity of enterprise-grade tools. His writing focuses on making ASV compliance straightforward for growing businesses.