PCI DSS / SPoC
For merchants accepting attended card-present payments through a secure reader and a phone or tablet as part of a validated SPoC solution.
Who it is for
SAQ SPoC covers Software-based PIN Entry on COTS solutions listed by PCI SSC. A secure SCRP reader is used with a compatible application on a general-purpose device. It does not automatically apply to every mobile POS application or phone-based payment.
Key eligibility criteria
- Transactions are attended and card-present. Account data enters only through the SCRP of the listed SPoC solution.
- Only systems belonging to the validated solution handle account data, and the payment channel is not connected to other merchant systems or networks.
- There is no other electronic receipt, transmission or storage of account data. Every control in the provider’s SPoC user guide has been implemented.
- This path does not apply to unattended payments, mail or telephone orders, or e-commerce. Non-PTS-listed magnetic stripe readers are not covered by this SAQ.
Payment flow
- 01Card at secure SCRP reader
- 02SPoC application on phone or tablet
- 03Processing in the solution environment
Illustrative overview. Your actual data flow must be reviewed before choosing an SAQ.
Before completing your SAQ
Confirm the complete solution name and active listing, reader and supported devices. Collect the user guide and review connections. PCI SSC has set a SPoC/CPoC standards sunset period from 1 May to 31 October 2026: new submissions are not accepted afterwards, while existing listings retain their normal lifecycle. Confirm the suitability of your solution with its provider and the accepting entity.
These criteria are a summary and do not replace the complete questionnaire. Confirm every criterion in the applicable version and the validation method with your acquirer or accepting entity.
