SAQ A was developed for merchants that outsource credit card functions to banks or validated external providers and may retain only paper reports or receipts containing card data. It applies to e-commerce or telephone transactions without a physical card present, where merchants do not store, process or transmit card data electronically on their premises or systems.
Merchants must confirm that they meet the following criteria to complete SAQ A:
- Your company accepts only card-not-present transactions, electronically or by telephone.
- All card data processing is fully outsourced to banks or a PCI DSS-validated service provider.
- Your company does not store, process or transmit electronic card data on its premises or systems, relying entirely on a third-party provider to perform these functions.
- The company has confirmed that all third-party providers handling storage, processing or transmission of card data are PCI DSS certified.
- Any card data retained by your company exists only in paper form, such as printed reports or receipts, and these documents were not received electronically.
- All elements of all payment pages delivered to the consumer's browser originate only and directly from a third-party PCI DSS-validated service provider.
Payment Flow
SAQ DOCUMENT
Download the SAQ with which merchants under SAQ Type A must comply.
Would you like to know your certification type and cost?
Cost calculation tool
Use the certification selection tool to calculate your certification type and annual cost.
What is your next step?
Discuss your environment with a specialist.