PCI DSS SAQ A-EP: Partially Outsourced E-Commerce Eligibility

Eligibility Criteria

• Accepts only e-commerce transactions
• All processing of account data, except the payment page, entirely outsourced to a PCI DSS compliant TPSP/payment processor
• Merchant e-commerce website does not receive account data but controls how customers or their account data are redirected to a compliant TPSP/processor
• If the website is hosted by a TPSP, that TPSP is compliant with applicable PCI DSS (including Appendix A if it is a multi-tenant hosting provider)
• Each element of payment page(s) delivered to the browser originates from either the merchant's website or a PCI DSS compliant TPSP
• No electronic store/process/transmit of account data on merchant systems; TPSP handles those functions
• TPSP(s) confirmed PCI DSS compliant for services used
• Paper-only retention if any; documents not received electronically

Typical A-EP Patterns

• Direct Post - merchant creates the payment form; the browser posts account data to the processor
• Merchant website loads or delivers scripts (for example JavaScript) that support payment page creation or data transmission

SAQ A vs SAQ A-EP

SAQ A: all payment page/form elements originate only and directly from the TPSP. SAQ A-EP: elements may originate from the merchant or the TPSP. Applicable only to e-commerce; not for service providers.

How CyberSilo Helps

• Script inventory and change-detection evidence for payment pages
• CSA mapping for the larger A-EP control set
• USA readiness support for Direct Post vs iframe architecture decisions

Frequently Asked Questions

We use an iframe - is that SAQ A or A-EP?

Often SAQ A if all payment page/form elements originate only and directly from the TPSP and other SAQ A criteria are met. If the merchant delivers payment-form elements or scripts, evaluate SAQ A-EP.

Does SAQ A-EP apply to MOTO?

No. SAQ A-EP is applicable only to e-commerce channels.

Why is SAQ A-EP so much longer than SAQ A?

Merchant-controlled payment pages expand the applicable control set, including CDE-referencing requirements applied to the merchant website.

Related PCI Resources

SAQ selector · SAQ types · SAQ A · SAQ D · Requirement 6 (6.4.3) · Requirement 11 (11.6.1)