Shopify's checkout is PCI certified. Your store, once you have added a single app that touches it, might not be. That gap is where most Canadian merchants get caught out, not because they ignored PCI compliance, but because they assumed the platform's certification covered whatever they built on top of it.
Quick answer: PCI DSS 4.0's future-dated requirements became mandatory in 2025, and 2026 is the year most merchants complete their first real assessment cycle against them. Shopify's own infrastructure and hosted checkout are PCI Level 1 certified, but you are still responsible for the correct Self-Assessment Questionnaire, and for anything installed on top of checkout, a loyalty app, a chat widget, a review tool, or a checkout extensibility customization, can push a simple SAQ A store into the stricter SAQ A-EP tier without anyone flagging it.
01. The Quick Answer
PCI DSS 4.0.1 is the active version of the Payment Card Industry Data Security Standard, and its future-dated requirements, the ones that were previously listed as best practice, became mandatory on March 31, 2025. For a Shopify merchant, that means the Self-Assessment Questionnaire your acquiring bank expects in 2026 needs to reflect controls like a documented script inventory for your checkout page, not the older, lighter checklist from version 3.2.1.
Why it matters: the merchants who treat this as a one-time form to sign are the ones most likely to fail an assessment or, worse, discover the gap during a breach investigation rather than before one.
02. At-a-Glance: SAQ A vs SAQ A-EP for Shopify Merchants
| Factor | SAQ A | SAQ A-EP |
|---|---|---|
| Who qualifies | Fully redirects to a payment page you do not control, no checkout scripts or iframes | Site hosts a script, iframe, or app that touches the payment flow, even without storing card data |
| Vulnerability scan | Not required | Quarterly ASV scan required |
| Script inventory | Not required | Required under Requirement 6.4.3, with a documented business justification per script |
| Tamper detection | Not required | Required under Requirement 11.6.1, weekly checks or a documented risk-based schedule |
| Common Shopify trigger | Default Shopify Payments checkout, no custom scripts installed | Checkout extensibility customization, loyalty apps, chat widgets, review tools, or pixels on checkout |
| Typical annual cost beyond staff time | Close to zero | A few hundred dollars for scanning, plus inventory upkeep |
Why it matters: most merchants do not choose which SAQ tier they are in, their checkout configuration decides it for them, often through an app they installed for an unrelated reason.
03. Why This Matters for Canadian Shopify Merchants in 2026
PCI DSS is a card brand requirement enforced through your acquiring bank and payment processor, not a Canadian regulation, but it applies to every Canadian merchant taking Visa, Mastercard, or Amex regardless of where the card was issued. The future-dated requirements introduced in version 4.0 had a transition window that closed on March 31, 2025, which means 2026 is the first full year most merchants are assessed against the complete standard rather than a partially enforced version of it.
For a manufacturer, wholesaler, retailer, or DTC brand running a growing Shopify storefront, that timing coincides with exactly the kind of app sprawl that creates compliance drift: a loyalty program added last year, a live chat widget added this spring, a new upsell app added last month. Each one is a reasonable business decision on its own. Together, they are usually the reason a store that started clean in SAQ A is no longer eligible for it.
Why it matters: compliance drift happens gradually and invisibly, which is exactly why 2026's assessment cycle is catching merchants who were genuinely compliant the last time they checked.
04. The Two Requirements That Catch Shopify Merchants Off Guard
Requirement 6.4.3 requires a documented inventory of every script that runs on a payment page, a written business justification for each one, and a method, such as Subresource Integrity or active monitoring, to confirm none of them has been altered. Requirement 11.6.1 requires a recurring check, weekly by default unless a documented risk assessment supports a different cadence, of your payment pages and their HTTP headers for unauthorized changes, with alerts sent to someone who will actually act on them.
Both requirements exist because of a specific, well-documented attack pattern: Magecart-style skimming, where an attacker injects a hidden script into a checkout page to silently copy card numbers as customers type them. A web application firewall does not reliably catch this, because the malicious script often loads from a source that looks legitimate until someone is specifically watching for unauthorized changes.
Why it matters: these are not one-time setup tasks. A script inventory that was accurate in January and never updated again does not satisfy either requirement once a new app changes what is running on checkout.
05. What Actually Knocks a Store Out of SAQ A
On Shopify Plus, custom checkout extensibility code is the most direct trigger, since it runs code you or a developer wrote inside the checkout itself. For more stores, the trigger is quieter: a loyalty and rewards app, a live chat widget, an on-site review tool, a cart-recovery or upsell app, or a single analytics or advertising pixel configured to fire on the checkout step. None of these vendors are obligated to tell you this changes your PCI scope, and most do not.
Why it matters: the same audit that catches a checkout script slowing down page load, covered in the Shopify checkout performance guide, usually surfaces the same scripts creating PCI scope. It is worth running both checks together rather than treating them as separate projects.
06. The Three SAQ Types Explained
SAQ A: the default for an untouched Shopify checkout.
Applies when customers are fully redirected to Shopify's hosted, PCI-certified checkout and nothing on your site, no script, no iframe, no embedded widget, touches that payment flow. This is the lightest questionnaire, requires no vulnerability scan, and is where most simple Shopify stores start out.
SAQ A-EP: the tier most growing Shopify stores land in without noticing.
Applies once any script, app, or checkout extensibility customization runs on or near the payment page, even if you never see or store a card number. This adds the Requirement 6.4.3 script inventory, the Requirement 11.6.1 tamper detection checks, and a quarterly ASV scan. Most Shopify Plus merchants using checkout extensibility, and many merchants with a loyalty, chat, or review app active on checkout, belong here.
SAQ D: for merchants who handle card data directly.
Applies when a business stores, processes, or transmits cardholder data itself rather than passing it straight through to a certified processor, for example a custom payment integration outside Shopify Payments or a system that keeps card numbers for offline processing. It is the most demanding questionnaire and is uncommon for a standard Shopify storefront, but it does show up in some custom B2B payment builds.
Why it matters: most Shopify merchants assume they are SAQ A by default and never revisit that assumption once the store grows. Knowing the three tiers exist is the first step toward finding out which one actually applies.
07. Building a Script Inventory and Compliance Checklist
Start by listing every app, theme customization, and checkout extensibility function that has access to the checkout or thank-you page, not just the ones you remember installing for payment reasons. For each one, write down what it does, who approved it, and why it needs to run where it runs. Anything you cannot justify is a candidate for removal, which is often the fastest way to move back into a lighter SAQ tier rather than adding scanning and monitoring to keep it.
For what remains, put a monitoring method in place, whether that is a dedicated PCI monitoring app from the Shopify App Store, an Approved Scanning Vendor's tooling, or a manual weekly review documented well enough to survive an audit. Revisit the inventory every time an app is added, removed, or updated, not on a fixed annual schedule, since the requirement is tied to what is actually running, not to when you last checked.
Why it matters: an inventory built once for an assessment and never touched again is functionally the same as not having one the next time a new app changes what is on checkout.
08. B2B and Wholesale: Net Terms, Invoicing, and PCI Scope
A wholesale account paying by purchase order, net terms invoice, EFT, or bank transfer never enters a card number through the website, which keeps that revenue stream out of PCI scope entirely. This is one of the few compliance areas where a B2B payment model is genuinely simpler than a DTC one, since there is no card data flow to protect in the first place.
Scope reappears the moment a card comes back into the picture: a Shopify payment link emailed against an outstanding invoice, a card taken over the phone and keyed into an admin panel, or a stored card used for automatic reorder billing. A manufacturer or wholesaler running a mixed B2B and DTC storefront, the pattern covered in running B2B and B2C on one Shopify store, needs to map PCI scope separately for each payment path rather than assuming one SAQ answer covers both sides of the business.
Why it matters: the wholesale side of the business is often the easiest part of the assessment. It is worth confirming that instead of assuming it, especially once a sales team starts taking card payments manually to close a deal faster.
09. How AtlanticWorks Helps
AtlanticWorks is a Certified Shopify partner working with manufacturers, wholesalers, retailers, and DTC brands across Atlantic Canada and beyond. We audit checkout scripts and installed apps to determine your actual SAQ scope, build the script inventory and monitoring process Requirements 6.4.3 and 11.6.1 call for, and map PCI scope separately for B2B and DTC payment paths on mixed storefronts. If you are not certain which SAQ tier your store actually qualifies for, the free assessment is a straightforward place to find out.
10. Key Takeaways
- PCI DSS 4.0's new requirements became mandatory in 2025, and 2026 is when most merchants face the first assessment cycle that actually tests them, not a grace-period version.
- Shopify's PCI Level 1 certification covers Shopify's own infrastructure and hosted checkout. It does not cover apps, scripts, or checkout extensibility customizations you add on top.
- The fastest way to lose SAQ A eligibility is installing a loyalty, chat, review, or analytics app that quietly loads a script on the checkout page. Audit for this the same way you would audit checkout speed.
- Requirements 6.4.3 and 11.6.1 exist specifically to catch checkout-skimming script attacks, and they require an ongoing script inventory and tamper detection process, not a one-time setup.
- B2B accounts paying by purchase order, net terms invoice, or bank transfer typically stay out of PCI scope entirely. Scope returns the moment a card touches the process again, including a payment link sent for an outstanding invoice.
11. Frequently Asked Questions
What is PCI DSS 4.0, and is it actually mandatory now?
Yes. PCI DSS 4.0's future-dated requirements became mandatory on March 31, 2025, and the standard is now on version 4.0.1. For most Canadian Shopify merchants, 2026 is the year their acquiring bank or payment processor expects a completed Self-Assessment Questionnaire that actually reflects the new controls, not the older 3.2.1 checklist. Controls that were previously best practice, including a documented inventory of every script running on your checkout page, are now hard pass or fail requirements on that questionnaire.
Does using Shopify make my store PCI compliant automatically?
No, and this is the most common misunderstanding. Shopify is a PCI DSS Level 1 certified service provider, which covers Shopify's own infrastructure, the hosted checkout, and Shopify Payments. That certification does not extend to how you configure your store. You are still responsible for completing the correct Self-Assessment Questionnaire, maintaining a script inventory for anything you or an app has added to the checkout, and, if you fall into SAQ A-EP or SAQ D, arranging a quarterly ASV vulnerability scan.
What is the difference between SAQ A and SAQ A-EP?
SAQ A applies when a customer is fully redirected to a payment page you do not control and your site has no scripts, iframes, or embedded elements that could affect the security of that payment page. It is the lightest questionnaire and does not require a vulnerability scan. SAQ A-EP applies once your site hosts anything that touches the payment flow, a custom checkout script, an embedded payment iframe, or a third-party app injecting JavaScript into checkout, even if you never store a card number yourself. SAQ A-EP adds a formal script inventory requirement and a quarterly ASV scan.
What do PCI DSS requirements 6.4.3 and 11.6.1 actually require?
Requirement 6.4.3 requires you to inventory every script that runs on a payment page, document a business justification for each one, and use a method such as Subresource Integrity or active monitoring to confirm none of them have been tampered with. Requirement 11.6.1 requires you to regularly evaluate your payment pages and their HTTP headers for unauthorized changes, weekly at minimum unless a documented risk assessment justifies a different frequency, and alert the right people the moment something changes. Together, they exist to catch the kind of checkout-skimming attack (Magecart-style script injection) that a web application firewall alone will not catch.
What pushes a Shopify store from SAQ A into SAQ A-EP?
Any script running on the checkout page that did not ship as part of Shopify's own certified checkout. On Shopify Plus, custom checkout extensibility code you or a developer wrote is the most direct trigger. Beyond that, a loyalty and rewards app, a live chat widget, an on-site review tool, an upsell or cart-recovery app, or even a single analytics or pixel tag configured to load on the checkout step can all shift a store out of clean SAQ A eligibility. The common thread is that the app vendor rarely tells a merchant this is happening. It is worth auditing checkout scripts the same way you would audit checkout speed after installing a new app, since the two often break for the same reason.
Does a B2B store with net terms and offline invoicing have different PCI scope?
Often, yes, and usually in a merchant's favour. A wholesale account that pays by purchase order, net terms invoice, EFT, or a manually processed bank transfer never enters card data through the website at all, which keeps that portion of the business out of PCI scope entirely. Scope reappears the moment a card is involved again: a Shopify payment link emailed for an outstanding invoice, a card taken over the phone and keyed into an admin panel, or a stored card used for automatic reorder billing. Manufacturers and wholesalers running a mixed B2B and DTC storefront usually need to map scope separately for each payment path rather than assuming the wholesale side is automatically covered by whatever the DTC storefront qualifies for.
What actually happens if a Shopify merchant does not complete their SAQ?
Nothing happens immediately in most cases, which is exactly why it gets ignored. The real exposure shows up in two situations: your acquiring bank or payment processor can levy non-compliance fees or, in persistent cases, restrict card processing, and if a breach ever occurs, an incomplete or inaccurate SAQ becomes evidence that reasonable security controls were not in place. That second scenario is the expensive one, since it shifts liability and can affect the fines and remediation costs a merchant is on the hook for after a breach, well beyond whatever the processor would have charged for non-compliance alone.
How much does PCI compliance cost a small Canadian Shopify merchant?
For a merchant that stays in SAQ A, the direct cost is close to zero beyond the time to complete the questionnaire annually, since no scan is required and Shopify's certified checkout covers the infrastructure. For a merchant in SAQ A-EP, budget for a quarterly ASV scan, typically a few hundred dollars a year through a Shopify App Store scanning app or an independent Approved Scanning Vendor, plus the time to build and maintain a script inventory. The larger cost is usually not paid in dollars, it is the audit work of finding out which of your installed apps put you in A-EP in the first place, since most merchants do not know until they sit down to answer the questionnaire honestly.
PCI DSS requirements and SAQ eligibility depend on your store's specific configuration. Confirm your current SAQ type and scan requirements with your acquiring bank or payment processor before relying on this guide as your final compliance record.
Related resources
The customization work that often creates SAQ A-EP scope
Payment security beyond what Shopify Protect covers
The privacy law side of the compliance picture
AODA, ACA, and WCAG 2.2 for Canadian ecommerce
Not sure which SAQ tier your store actually qualifies for?
AtlanticWorks audits Shopify checkouts for Canadian manufacturers, wholesalers, retailers, and DTC brands, script by script, so PCI scope is a known answer instead of a guess. The free assessment is a straight conversation about where your store actually stands.
Start the Assessment