Compliance Assessment ToolSAQ B: who needs it?
SAQ B is for businesses whose card machine connects over a phone line (or that still use a manual imprint machine), with nothing connected to the internet or to your computers.
This is probably you if…
- Your card terminal dials out over a phone line to your processor.
- It is not connected to the internet, Wi-Fi, or any computer.
- You never store card numbers electronically; any paper copies stay on paper.
Typical setups
- An older countertop terminal plugged into an analogue phone line.
- A manual knuckle-buster (imprint) machine.
It's probably not SAQ B if…
- Your terminal connects over the internet, Wi-Fi, Ethernet or cellular — that is usually SAQ B-IP (or SAQ P2PE if it is a validated P2PE solution).
- Your terminal is connected to a register, computer or POS system — that is usually SAQ C.
Not sure it's SAQ B?
Describe how you take payments in your own words and we'll check it against every SAQ's conditions — free. If it is SAQ B, we walk you through it in plain English and produce your signed SAQ and Attestation of Compliance.
Check my SAQ — free →The official eligibility criteria
To use SAQ B, the PCI Security Standards Council requires all of the following:
- The merchant uses only an imprint machine and/or uses only standalone, dial-out terminals (connected via a phone line to the merchant processor) to take customers' payment card information;
- The standalone, dial-out terminals are not connected to any other systems within the merchant environment;
- The standalone, dial-out terminals are not connected to the Internet;
- The merchant does not store account data in electronic format, and
- Any account data the merchant might retain is on paper (for example, printed reports or receipts), and these documents are not received electronically.
Questions people ask
My terminal is new and uses Wi-Fi. Is that SAQ B?
No. Internet-connected terminals are usually SAQ B-IP, or SAQ P2PE if the terminal is part of a validated point-to-point encryption solution. SAQ B is only for phone-line terminals and imprint machines.
What about paper receipts with card numbers?
Paper is allowed, as long as it is never scanned, emailed or otherwise turned into an electronic record. You will be asked how you store and destroy it.
Other SAQ types
SAQ A · SAQ A-EP · SAQ B-IP · SAQ C · SAQ C-VT · SAQ P2PE · SAQ SPoC · SAQ D
This guide helps you identify the right self-assessment questionnaire. Your acquiring bank or payment processor decides which SAQ you must submit — confirm with them if you are unsure. Compliance Assessment Tool helps you complete a PCI DSS self-assessment; we are not a Qualified Security Assessor (QSA) and do not certify compliance. Eligibility criteria quoted from PCI DSS v4.0.1 SAQ B documentation published by the PCI Security Standards Council.