SAQ A-EP for PCI DSS: E-commerce Eligibility

For e-commerce merchants that partially outsource payment processing to a third-party provider. SAQ A-EP was developed for merchants transacting through their own website, which does not receive the customer's card data but affects transaction security and/or the integrity of the website accepting the consumer's card data, for example an iframe.

SAQ A-EP concerns merchants that partially outsource electronic transactions to PCI DSS-certified third parties and do not store, process or transmit card data on their premises or systems. Merchants must confirm that they meet the following criteria:

Your company accepts only e-commerce transactions.

All card data processing, except for the payment page, is entirely outsourced to a third-party PCI DSS-certified payment provider.

Your website does not receive card data.
If the provider's website is hosted by a service provider, that provider is validated against all applicable PCI DSS requirements.
Every payment page element delivered to the consumer's browser comes either from the merchant's website or from a third-party PCI DSS-certified service provider.
Your company does not store, process or transmit electronic card data on its premises or systems, relying entirely on a third party to perform these functions.
Any card data your company retains is in paper form only, such as printed reports or receipts, and was not received electronically.
This SAQ applies only to e-commerce transactions.
Note: For SAQ A-EP, PCI DSS requirements referring to the cardholder data environment apply to the merchant's website. This is because the website directly affects how card payment data is transmitted, even if it does not itself receive card data.