Expired Self Assessment

[PhoenixPCI]

If a merchant files a self assessment that expired in June of this year but isn't required to be compliant until the Sep 30th deadline, would there be any kind of fallout if they hold off to file their new SA until the deadline?

I have my thoughts but want to see what everyone else thinks.

First time poster. Be gentle.

[mdahn]

Hmm... you should see other posts on "compliance" vs. "validation". You must be compliant with PCI DSS all the time, but you only need to validate that compliance based on criteria set by the card associations and your acquirer.

Even if you were a Level 4 and are newly defined (this year) as a Level 2 or 1, you still needed to be compliant when you were a Level 4 merchant. (See Visa's new program for Level 4 compliance (http://www.paymentsnews.com/2007/07/visa-announces-.html).)

If you are submitting your self-assessment questionnaire (SAQ) then it was requested by your acquirer. You should always validate your compliance based on a schedule set by your acquirer.