The Self-Assessment Questionnaire for card-not-present merchants, e-commerce or mail and telephone order, that have outsourced all account data functions to PCI DSS compliant third parties and neither store, process nor transmit account data on their own systems. Two e-commerce integrations qualify: a full redirect to the provider, and a provider payment page or form embedded in the merchant page, typically in an iframe. Hosting that iframe does not by itself move a merchant to SAQ A-EP; what does is the merchant page collecting or handling the card data itself, as with a direct post or a form built by merchant-loaded script. For e-commerce channels, every element of the payment form delivered to the browser must originate only and directly from the compliant provider. A merchant whose page embeds the provider's form must also confirm that its site is not susceptible to attacks from scripts that could affect its e-commerce systems, a criterion added to SAQ A for v4.x; the Council's FAQ 1588 says it does not apply to a redirect.
Applies to. Card-not-present merchants only. Not face-to-face channels and not service providers.
Example. A merchant whose checkout page is entirely hosted and managed by its provider, with no access to the page, answers 14 requirements. One that redirects to or embeds the provider's form answers 27, including quarterly ASV scans of its own website.
Limits. The script-attack criterion applies only to merchants whose page embeds the provider's payment page or form, such as an iframe. FAQ 1588 says it does not apply to redirects (an HTTP, meta-tag or JavaScript redirect) or to fully outsourced payment such as an emailed payment link. The merchant confirms it either by protecting its page with techniques such as those in 6.4.3 and 11.6.1, deployed by itself or a third party, or by obtaining the provider's confirmation that its solution, implemented as instructed, protects the merchant's payment page from script attacks. The redirect and embedded integrations both gained quarterly ASV scans and scans after significant change (11.3.2 and 11.3.2.1) in v4.x, because a compromised merchant page can send customers elsewhere (FAQ 1604). MOTO channels have their own criteria, not shown in the e-commerce table.