Compliance Assessment ToolSAQ SPoC: who needs it?
SAQ SPoC is for businesses that take in-person card payments on a phone or tablet paired with a small secure card reader, using a payment solution validated by PCI SSC under the SPoC standard.
This is probably you if…
- You take in-person payments using a phone or tablet plus a secure card reader (SCRP).
- The solution is validated and listed by PCI SSC as a SPoC solution.
- That phone or tablet is used for payments and nothing else touches card numbers.
Typical setups
- A food truck, market stall or pop-up shop using a validated phone-and-reader setup.
- A plumber or electrician taking payment on site with a validated mobile reader.
It's probably not SAQ SPoC if…
- The solution is not on the PCI SSC list of validated SPoC solutions — check with your provider.
- You also key card numbers by hand, take payments online, or store card data.
Not sure it's SAQ SPoC?
Describe how you take payments in your own words and we'll check it against every SAQ's conditions — free. If it is SAQ SPoC, we walk you through it in plain English and produce your signed SAQ and Attestation of Compliance.
Check my SAQ — free →The official eligibility criteria
To use SAQ SPoC, the PCI Security Standards Council requires all of the following:
- All payment processing is only via a card-present payment channel.
- All cardholder data entry is via an SCRP that is part of a validated SPoC solution approved and listed by PCI SSC;
- The only systems in the merchant's SPoC environment that store, process, or transmit account data are those used as part of the validated SPoC solution approved and listed by PCI SSC;
- The merchant does not otherwise receive, transmit, or store account data electronically;
- This payment channel is not connected to any other systems/networks within the merchant environment;
- Any account data the merchant might retain is on paper (for example, printed reports or receipts), and these documents are not received electronically; and
- The merchant has implemented all controls in the SPoC user guide provided by the SPoC Solution Provider.
Questions people ask
Does any phone card reader qualify?
No. Only solutions validated and listed by PCI SSC as SPoC solutions qualify. Ask your provider for the listing.
Other SAQ types
SAQ A · SAQ A-EP · SAQ B · SAQ B-IP · SAQ C · SAQ C-VT · SAQ P2PE · SAQ D
This guide helps you identify the right self-assessment questionnaire. Your acquiring bank or payment processor decides which SAQ you must submit — confirm with them if you are unsure. Compliance Assessment Tool helps you complete a PCI DSS self-assessment; we are not a Qualified Security Assessor (QSA) and do not certify compliance. Eligibility criteria quoted from PCI DSS v4.0.1 SAQ SPoC documentation published by the PCI Security Standards Council.