PCI DSS / C-VT
For merchants manually entering one transaction at a time into an external provider’s virtual terminal, with no electronic account data storage.
Who it is for
SAQ C-VT covers eligible use of a web-based virtual terminal through a browser on an isolated computer. The terminal is hosted by a PCI DSS-validated provider. It differs from a standalone physical POS and automated online store payment.
Key eligibility criteria
- Processing takes place only through the external provider’s virtual terminal, with manual entry of one transaction at a time.
- The computer is isolated and is not connected to other locations or systems in the environment.
- There are no attached card-reading devices or applications that electronically capture or store account data.
- Account data is not retained electronically and this path does not apply to e-commerce. All criteria must be confirmed against the actual use of the computer.
Payment flow
- 01Manual transaction entry
- 02Virtual terminal in browser
- 03External provider processing
Illustrative overview. Your actual data flow must be reviewed before choosing an SAQ.
Before completing your SAQ
Record the virtual terminal provider, computer usage and how transaction details are received. Check that card details are not retained in files, email, screen recordings or other applications.
These criteria are a summary and do not replace the complete questionnaire. Confirm every criterion in the applicable version and the validation method with your acquirer or accepting entity.
