PCI Compliance for PayPal Merchants: Full SAQ Guide 2026
PCI compliance for PayPal merchants explained: which SAQ you need, when ASV scans apply, and how the 2026 PCI DSS v4.0.1 rules changed eligibility.
An ASV scan is a mandatory external vulnerability assessment of your internet-facing systems, conducted by a vendor approved by the PCI Security Standards Council, to verify that your externally reachable infrastructure does not expose payment card data to known security threats. If your business accepts, processes, stores, or transmits cardholder data and has any systems connected to the internet, quarterly ASV scanning is a non-negotiable component of your PCI DSS compliance programme.
For many business owners and IT managers, the term “ASV scan” surfaces for the first time when a payment processor flags it as a compliance requirement, often accompanied by a tight deadline and little explanation. The result is a scramble to understand what the scan actually involves, who is qualified to perform it, and what happens if the results come back with findings.
The good news is that once you understand the structure of ASV scanning, its purpose, its scope, and its relationship to the broader PCI DSS framework, it becomes one of the more manageable compliance obligations you will face. This guide covers everything you need to know about ASV scans: what they are, what the PCI ASV scan process looks like in practice, how to read and act on your ASV scan report, and how to choose the right scanning partner for your organisation.
Whether you are a small business owner encountering this requirement for the first time or an IT manager preparing to formalise your quarterly scanning programme, the sections below will give you the clarity and confidence to move forward decisively.
Approved Scanning Vendor (ASV): A company or organisation that has been qualified and approved by the PCI Security Standards Council to perform external vulnerability scanning services in accordance with the ASV Program Guide, and whose scan solutions have passed validation testing to confirm accuracy and reliability.
Cardholder Data Environment (CDE): The people, processes, and technology that store, process, or transmit cardholder data or sensitive authentication data, as well as any systems directly connected or that could impact the security of those systems; this is the primary scope boundary for PCI DSS compliance activities, including ASV scanning.
External Vulnerability Scan: An automated security assessment conducted from outside an organisation's network perimeter, targeting publicly accessible IP addresses and domains to identify known vulnerabilities that could be exploited by an attacker without internal access. This is different from a penetration test, which involves a human tester actively attempting to exploit weaknesses rather than just scanning for them, see how this differs from a penetration test for the full comparison.
PCI DSS (Payment Card Industry Data Security Standard): The globally recognised security standard developed and maintained by the PCI SSC that defines technical and operational requirements for organisations that handle cardholder data, including mandatory ASV scanning under Requirement 11.3.2.
An ASV scan is an external vulnerability scan of your internet-facing systems, performed by a PCI Security Standards Council-approved vendor, to identify security weaknesses that could expose your cardholder data environment to attack. It is a specific, mandated compliance activity under PCI DSS Requirement 11.3.2, distinct from all other forms of security testing.
To understand the ASV scan meaning fully, it helps to break the term into its components. “ASV” stands for Approved Scanning Vendor; a category of company that has undergone rigorous qualification testing by the PCI SSC to confirm that its scanning tools and methodologies meet the council’s technical standards. Not every vulnerability scanner qualifies.
The vendor’s tools must pass validation testing, and the vendor itself must maintain its approved status by complying with the ASV Program Guide. This matters because when your payment processor, acquirer, or QSA requests evidence of your quarterly scan, they are specifically requesting a report produced by a qualified member of the PCI SSC’s ASV list.
A scan from an unapproved tool, regardless of how sophisticated it may be, will not satisfy the requirement. The scan itself operates from an external vantage point. This is a defining characteristic of ASV scanning and one of the most common sources of confusion for organisations new to the process. The scanner does not sit inside your network; it probes your systems from the outside, exactly as an attacker on the internet would. It sends requests to your public IP addresses and internet-facing hostnames, tests for known vulnerabilities in the services and software those systems expose, and records what it finds.
This external perspective is intentional; the goal is to surface the weaknesses that a real-world threat actor could actually reach and exploit, without the benefit of being inside your firewall.
ASV scan vs internal vulnerability scan: An ASV scan targets what an attacker on the public internet can see; your external attack surface. A separate internal vulnerability scan (Requirement 11.3.1) covers systems inside your network perimeter. Both are required under PCI DSS v4.0.1, but they are distinct processes.
Whether you're preparing for your first PCI DSS assessment or switching providers, Secusy ASV makes quarterly scanning simple with fast turnaround times, clear reporting, and expert support when you need it.
Merchants and service providers that handle payment card data typically need quarterly ASV scans under PCI DSS requirements. This includes all Level 1, Level 2, and Level 3 merchants, most Level 4 merchants if required by their acquiring bank, organisations completing SAQ B-IP, SAQ C, SAQ C-VT, or SAQ D, and all PCI DSS service providers in scope. Businesses using fully hosted payment pages that qualify for SAQ A are generally exempt.
Whether you need an ASV scan depends on both your PCI merchant level and how your organisation handles payment card data.
Quarterly ASV scans are mandatory for:
| Merchant Level | Quarterly ASV scan required? | Notes |
|---|---|---|
| Level 1 | Yes | Over 6M Visa/Mastercard transactions per year |
| Level 2 | Yes | 1M–6M transactions/year |
| Level 3 | Yes | 20K–1M e-commerce transactions |
| Level 4 | Recommended / often required by acquirer | Smaller merchants — check with your bank |
| Service Providers | Yes | All levels of service providers in scope |
ASV scans are also required for organisations completing the following Self-Assessment Questionnaires (SAQs):
SAQ B-IP, SAQ C, SAQ C-VT, SAQ D (merchants), SAQ D (service providers), and all Level 1, 2, and 3 merchants undergoing a full Report on Compliance (ROC).
SAQ A merchants using a fully hosted, PCI-certified payment page (such as Stripe Checkout or Shopify Payments) where cardholder data never touches your systems or network.
SaaS and fintech providers
Service providers handling payment processing on behalf of merchants, including payment gateways, hosted commerce platforms, and fintech infrastructure providers are required to complete quarterly ASV scans as part of their own PCI DSS compliance programme. A passing ASV scan is often a prerequisite for issuing an Attestation of Compliance (AOC) to enterprise clients.
An ASV scan must be completed every 90 days and whenever significant changes are made to systems that affect the cardholder data environment. This helps maintain continuous PCI DSS compliance and identify new vulnerabilities before they can be exploited.
PCI DSS requires a passing ASV scan result at least once every 90 days. In practice, this means four scans per calendar year, though the 90-day clock runs from the date of your last passing scan, not from fixed quarterly dates. Missing the 90-day window, even by a few days, constitutes a compliance gap.
Beyond the quarterly cadence, PCI DSS v4.0.1 requires you to run a new ASV scan after any significant change to your environment that could affect the cardholder data environment. Triggers include:
The intent is to ensure that infrastructure changes do not introduce new vulnerabilities between scheduled quarterly scans. Your ASV can advise on what constitutes a “significant change” in your specific environment.
An ASV scan identifies vulnerabilities in external-facing systems, including open ports, unpatched CVEs, weak SSL/TLS settings, insecure configurations, and DNS or email server issues. Under PCI DSS, findings with a CVSS score of 4.0 or higher must be fixed to achieve a passing result.
An ASV scan probes all external-facing IP addresses, hostnames, and domains that you declare within your cardholder data environment scope. The scan engine evaluates each target across several dimensions:
What it checks | Why it matters for PCI |
|---|---|
Open ports and running services | Unnecessary open ports expand your attack surface. PCI DSS requires only approved services to be accessible externally. |
Known CVEs (Common Vulnerabilities and Exposures) | The scan checks your software versions against the National Vulnerability Database. Unpatched CVEs scored 4.0+ on CVSS will cause a scan failure. |
SSL/TLS configuration | Weak cipher suites, expired certificates, and deprecated protocol versions (TLS 1.0, SSL 3.0) are flagged. PCI DSS v4.0.1 mandates TLS 1.2 as the minimum. |
HTTP security headers | Missing headers such as HSTS, X-Content-Type-Options, and Content Security Policy are evaluated as indicators of web application security posture. |
Misconfigured services | Default credentials, anonymous FTP access, exposed admin panels, and unrestricted directory listings are checked. |
DNS and mail server configuration | Open resolvers, zone transfer vulnerabilities, and insecure mail relay configurations are in scope. |
The severity of findings is scored using the Common Vulnerability Scoring System (CVSS). Under PCI DSS requirements, any finding with a CVSS base score of 4.0 or higher must be remediated before a scan can pass. Findings below 4.0 are noted in the report but do not cause an automatic failure.
The process involves scoping your external assets, submitting them to an Approved Scanning Vendor, detecting vulnerabilities, fixing and rescanning failed findings, and obtaining a passing ASV report for PCI DSS compliance.
You identify all external-facing IP addresses and domains that are in scope for PCI DSS. This includes web servers, APIs, cloud instances, load balancers, and anything else that sits on the boundary between your system and the public internet.
You hand your IP list to your approved scanning vendor. They schedule and run the scan, typically automated, against those targets. You don't need to be heavily involved at this stage.
The ASV tool runs through your external surface, checking for known CVEs, open risky ports, exposed services, outdated TLS/SSL configurations, and more. Results are logged with severity ratings.
Any finding rated medium, high, or critical must be addressed before you can pass. Your team fixes the issues (patching, reconfiguring, closing ports) and requests a rescan.
Once all high-severity findings are resolved, your ASV issues a passing scan report. That report is submitted to your acquirer, QSA, or compliance portal. Done until next quarter. Please do more scans as a security hygiene measure.
The most common reasons for failing an ASV scan include missing in-scope IP addresses, weak or outdated TLS settings, exposed services with unpatched vulnerabilities, inadequate evidence when disputing false positives, and delaying scans until the end of the compliance period.
Failing an ASV scan is extremely common on the first attempt. Here’s what typically goes wrong and the practical fix for each:
Teams forget staging environments, third-party integrations running on their IP space, or cloud instances spun up without proper tracking. The fix: audit your entire external attack surface before submitting. Use a tool like Shodan or your cloud provider’s asset inventory to sanity-check what’s publicly visible.
TLS 1.0 and 1.1 are still flagged by many ASV tools, even on servers where the actual card data never flows. PCI DSS 4.0 is particularly strict here. Disable legacy protocols across all in-scope hosts; not just your primary payment endpoint.
Many teams patch their main web servers religiously but forget about SSH on port 2222, admin panels on high ports, or internal monitoring tools accidentally exposed to the internet. Scan your own infrastructure first with an open-source tool like Nmap before the ASV does
Sometimes ASV tools flag things incorrectly. You have the right to dispute findings, but most teams either ignore the dispute process or submit weak evidence. A solid dispute needs proof the finding doesn’t apply (screenshots, config dumps, vendor documentation) and a clear written explanation. Secusy ASV’s support team can walk you through this directly.
The scan, remediation, rescan, and report submission cycle can take two to three weeks if issues are found. Starting your quarterly PCI scan in week 12 of the quarter is how you miss deadlines. Build in a buffer ideally starting by week 8.
An ASV scan report includes the pass/fail result, scan date, the IP addresses and hostnames scanned, details of identified vulnerabilities and their severity, remediation or dispute status, and the ASV's signed attestation for PCI DSS compliance.
A passing ASV scan report includes the following components, worth understanding if you’re submitting it to an acquirer or QSA:
Most organisations don't pass their first scan because of scoping gaps, outdated configurations, or unresolved findings. Secusy ASV helps you identify issues quickly, guide remediation, and get back to compliance without unnecessary delays.
PCI ASV scan pricing ranges from $400 to over $5,000 per quarter, depending on your environment's size and the vendor you choose. Be sure to check whether rescans are included, as some providers charge extra for failed scan retests.
Pricing varies significantly across vendors. A few data points to set expectations:
For most SaaS businesses and mid-market merchants, there is no reason to pay enterprise rates for a standard quarterly scan. The PCI SSC sets the technical requirements; every approved vendor scans to the same standard. The differentiators are turnaround speed, support quality, and pricing transparency.
PCI DSS 4.0 introduced stricter external scanning requirements, including stronger TLS expectations, enhanced scoping for cloud and third-party environments, clearer documentation for disputed findings, and greater emphasis on authenticated vulnerability assessments where applicable.
PCI DSS 4.0 became the mandatory standard in April 2024, replacing version 3.2.1. For external ASV scanning, the key changes include:
If you’ve been running scans under PCI DSS 3.2.1, it’s worth re-examining your scope and configuration assumptions. Several findings that previously passed are now flagged under 4.0.
Choose an ASV based on turnaround time, rescan policies, support quality, and report clarity. While all ASVs follow the same PCI DSS requirements, the best vendors provide transparent pricing, responsive support, and reports that acquirers and QSAs can easily review.
All ASVs are technically approved by the PCI SSC, but that doesn’t mean they’re equal. Here’s what to evaluate:
Some vendors take 5–7 business days to deliver scan results. Others, including Secusy ASV, turn around results significantly faster. In a compliance crunch, that difference is material.
Ask directly: are rescans included, or do they cost extra? This is a common profit centre for vendors. If you fail your first scan (which is common), you shouldn't be penalised for it.
When you have a false positive or a confusing finding at 4pm on a Friday before a compliance deadline, you want a real person to speak to. Not a ticket queue with a 48-hour SLA.
Request a sample report before committing. It should be clean, structured, and formatted in a way that your acquirer or QSA will accept without pushing back.
No. PCI DSS is a global standard, so quarterly ASV scanning requirements are the same regardless of where your business operates. However, some regional acquirers may have different submission processes, timelines, or validation workflows.
PCI DSS is a global standard, set by the Payment Card Industry Security Standards Council. Whether you’re processing payments in New York, London, or Singapore, the quarterly external scan requirement is the same. That said, some regional acquirers in the UK and EU have specific submission portals or timelines.
Visa Europe and Mastercard have slightly different compliance validation workflows from their US counterparts, though the underlying scan standard is identical. Secusy ASV works with merchants and service providers across the US, UK, and globally.
ASV scanning sits at a specific, well-defined intersection of compliance obligation and genuine security value. It is a mandatory quarterly requirement for most organisations handling payment card data, underpinned by a rigorous PCI SSC approval framework that ensures only qualified vendors can produce compliant results.
But beyond its regulatory function, a well-managed ASV scanning programme gives your organisation a reliable, recurring window into the real-world security posture of your public-facing infrastructure, one that is updated every quarter and calibrated against the latest threat intelligence.
The key to getting real value from your ASV scan, rather than simply tolerating it as a compliance burden, lies in choosing the right partner, understanding what the results mean, and connecting the findings to your broader security and operations practices.
When scoping is accurate, remediation is supported, and rescanning is fast and affordable, ASV compliance becomes a manageable, predictable process rather than a recurring source of stress. The organisations that approach it this way are both more compliant and more secure, and that combination is precisely what the programme was designed to produce.
An ASV scan is a mandatory external vulnerability scan conducted by a PCI Security Standards Council-approved vendor, required under PCI DSS Requirement 11.3.2 for any organisation whose internet-facing systems connect to a cardholder data environment. Performed at least quarterly, the scan targets publicly accessible IP addresses and domains to identify known vulnerabilities rated CVSS 4.0 or above, producing a formal ASV scan report that serves as evidence of PCI DSS compliance. Selecting a qualified, approved scanning partner and integrating ASV results into ongoing security operations transforms a compliance requirement into a genuine security asset.
Avoid hidden fees, long turnaround times, and confusing reports. With Secusy ASV, you get PCI-compliant quarterly scanning, unlimited guidance throughout the process, and the support needed to achieve a passing result with confidence.
Binoy Koonammavu, is the Founder and CEO of Secusy ASV, where he helps SMBs and fintech companies meet PCI DSS scanning requirements without the complexity of enterprise-grade tools. His writing focuses on making ASV compliance straightforward for growing businesses.