Complete your SAQ P2PE with evidence ready for your acquirer

SAQ P2PE is the PCI DSS self-assessment questionnaire for merchants that take card payments only through payment terminals from a validated, PCI-listed point-to-point encryption (P2PE) solution. Because card data is encrypted in the terminal and the merchant never handles clear-text account data electronically, the v4.0.1 version contains only 21 requirements, drawn from PCI DSS Requirements 3, 9 and 12, plus an Attestation of Compliance.

Merchants are eligible when all payment processing goes through a validated PCI-listed P2PE solution, the P2PE terminals are the only systems that store, process or transmit account data, no account data is received or stored electronically, any retained data is on paper only, and every control in the solution's P2PE Instruction Manual (PIM) is in place. It covers card-present and mail or telephone order, but not e-commerce or service providers.

SAQ P2PE v4.0.1 has 21 requirements. Requirement 3 covers minimising stored account data and not keeping card verification codes. Requirement 9 covers securing and destroying paper records and protecting point-of-interaction devices from tampering, including a device list, inspections and staff training. Requirement 12 covers the security policy, roles, awareness training, third-party service provider management and an incident response plan.

Not for the online channel. SAQ P2PE states it does not apply to e-commerce channels. A merchant with both terminal and online payments may need to validate each channel separately, for example using SAQ A or SAQ A-EP for the website, or a broader SAQ. Your acquirer decides which SAQ or SAQs you must submit, so confirm the approach with them before you start.

Solutions on the PCI SSC list of P2PE solutions with expired validations are no longer considered validated under the P2PE Program Guide. If you use one, the SAQ tells you to check with your acquirer or the payment brands whether SAQ P2PE is still acceptable. Otherwise you may need a different SAQ with a larger set of requirements, so it is worth checking your solution's listing regularly.

The PCI Security Standards Council publishes the SAQ, but compliance is enforced contractually by the payment brands and your acquiring bank. Not submitting a valid SAQ and Attestation of Compliance when requested can lead to non-compliance fees, higher processing costs or restrictions on accepting cards, depending on your acquirer's terms. A breach while non-compliant can also bring liability for investigation and card reissue costs.

SAQ P2PE is a subset of PCI DSS v4.0.1, listing only the requirements that apply to a P2PE merchant environment. Its policy, training, supplier management and incident response requirements overlap with ISO 27001 Annex A controls, so an organisation running an ISO 27001 information security management system will already have much of the Requirement 12 evidence. ISO 27001 certification does not replace the SAQ.

SAQ P2PE is mapped in OneClickComply's control library and available on request. It is not yet a self-serve framework in the platform. Once enabled, its 21 requirements sit alongside your other frameworks, so policies, training records, supplier reviews and incident response evidence collected once count towards SAQ P2PE as well. Contact the team to have it switched on for your account.