PCI DSS / B
For merchants using only imprint machines or standalone dial-out terminals, with no electronic account data storage.
Who it is for
SAQ B covers specific card-present and mail or telephone order environments. A standalone terminal communicating through a telephone line differs from an IP-connected POS. Having a POS terminal alone does not establish SAQ B eligibility.
Key eligibility criteria
- Only imprint machines or standalone dial-out terminals communicating with the processor through a telephone line are used.
- The terminals do not connect to other business systems or to the Internet for this processing.
- Account data is not stored electronically. Any paper records are retained and handled under the applicable requirements.
- This path does not apply to e-commerce. Additional channels or connections require separate review.
Payment flow
- 01Card or paper order
- 02Imprint machine or dial-out terminal
- 03Provider processing
Illustrative overview. Your actual data flow must be reviewed before choosing an SAQ.
Before completing your SAQ
Collect device models and connection details. Check where receipts are retained and whether electronic records or another payment channel change the assessment scope.
These criteria are a summary and do not replace the complete questionnaire. Confirm every criterion in the applicable version and the validation method with your acquirer or accepting entity.
