Set up card payments, EPOS and your first PCI self-assessment
Choosing a card machine or EPOS provider is also choosing who checks your card-data security.
Choosing a card machine or EPOS provider is also choosing who checks your card-data security. Every business that takes card payments has to comply with PCI-DSS (the Payment Card Industry Data Security Standard). For a small venue this almost always means completing a short Self-Assessment Questionnaire (SAQ) with your card processor or acquirer — the company behind your card machine or EPOS — rather than anything you apply for with government.
Skipping the SAQ when your acquirer asks for it can lead to non-compliance fees on your monthly statement, and in a genuine data breach an unfinished SAQ makes you liable for far more of the cost and any card-scheme fines.
Your card machine or EPOS provider will issue and check your actual SAQ — this is background, not where you apply.
Who this is for
Any venue that takes card, contactless or app payments — which in practice is almost every venue.
Applies regardless of turnover; the level of assessment required scales with transaction volume.
What you’ll hold
- Completed PCI SAQ (kept with your acquirer, plus your own copy)
Watch out for
- Ignoring the SAQ email from your acquirer because it looks like marketing — non-compliance fees follow within a few months.
- Storing customer card numbers in a notebook or spreadsheet for phone bookings, which breaks PCI-DSS immediately.
- Assuming a new EPOS system is automatically compliant out of the box without completing the questionnaire yourself.
Sources
- PCI Security Standards Council checked 2026-09-02
- GOV.UK — Data protection checked 2026-09-02
See also
- Build your commercial insurance package
- PCI-DSS self-assessment— this becomes an ongoing job once you’re open →
This is item 10 of 66 in the free UK Launch Checklist. See the whole list →