Compliance Assessment ToolSAQ P2PE: who needs it?
SAQ P2PE is for businesses whose card terminals are part of a PCI-validated point-to-point encryption solution — card data is encrypted inside the terminal, so your own systems never see it.
This is probably you if…
- All your card payments go through terminals from a PCI-listed, validated P2PE solution.
- Nothing else you own stores, processes or sends card numbers.
- You follow your provider's P2PE Instruction Manual (inspecting terminals for tampering, and so on).
Typical setups
- A shop whose processor supplies terminals that are listed as a validated P2PE solution on the PCI SSC website.
It's probably not SAQ P2PE if…
- Your provider says the terminal is "encrypted" but it is not on the PCI SSC list of validated P2PE solutions — encryption alone does not qualify you.
- You also take card details any other way (keyed, online, by email).
Not sure it's SAQ P2PE?
Describe how you take payments in your own words and we'll check it against every SAQ's conditions — free. If it is SAQ P2PE, we walk you through it in plain English and produce your signed SAQ and Attestation of Compliance.
Check my SAQ — free →The official eligibility criteria
To use SAQ P2PE, the PCI Security Standards Council requires all of the following:
- All payment processing is via a validated PCI-listed P2PE solution;
- The only systems in the merchant environment that store, process or transmit account data are the payment terminals from a validated PCI-listed P2PE solution;
- The merchant does not otherwise receive, transmit, or store account data electronically.
- Any account data the merchant might retain is on paper (for example, printed reports or receipts), and these documents are not received electronically; and
- The merchant has implemented all controls in the P2PE Instruction Manual (PIM) provided by the P2PE Solution Provider.
Questions people ask
How do I check if my solution is validated P2PE?
Ask your provider for the solution's PCI SSC listing, or look it up on the PCI SSC list of validated P2PE solutions. If it is not listed, you do not qualify for SAQ P2PE, however strong the encryption.
Other SAQ types
SAQ A · SAQ A-EP · SAQ B · SAQ B-IP · SAQ C · SAQ C-VT · SAQ SPoC · SAQ D
This guide helps you identify the right self-assessment questionnaire. Your acquiring bank or payment processor decides which SAQ you must submit — confirm with them if you are unsure. Compliance Assessment Tool helps you complete a PCI DSS self-assessment; we are not a Qualified Security Assessor (QSA) and do not certify compliance. Eligibility criteria quoted from PCI DSS v4.0.1 SAQ P2PE documentation published by the PCI Security Standards Council.