PCI DSS / P2PE
For merchants processing payments exclusively through a validated Point-to-Point Encryption solution listed by PCI SSC.
Who it is for
SAQ P2PE covers eligible card-present and mail or telephone order environments where account data is entered only into the terminals of the specified solution. Encryption on a POS alone is not sufficient: the complete solution must be verified against the PCI SSC listing.
Key eligibility criteria
- All payment processing in the assessed environment uses a validated, PCI-listed P2PE solution.
- The only merchant systems handling account data are the solution’s payment terminals. Other systems have no access to clear-text account data.
- The merchant does not otherwise receive, transmit or store account data electronically. Any retained records are paper only and were not received electronically.
- Every control in the provider’s P2PE Instruction Manual (PIM) has been implemented. This path does not apply to e-commerce.
Payment flow
- 01Card at P2PE terminal
- 02Encrypted transmission
- 03Decryption in the solution environment
Illustrative overview. Your actual data flow must be reviewed before choosing an SAQ.
Before completing your SAQ
Collect the solution name and listing status, terminal models and PIM. Review device receipt, installation, inventory and regular inspection. For a solution with expired validation, confirm the accepted path with the acquirer or payment brands.
These criteria are a summary and do not replace the complete questionnaire. Confirm every criterion in the applicable version and the validation method with your acquirer or accepting entity.
