SAQ B
PCIComplianceHubLast updated
The Self-Assessment Questionnaire for merchants that take payments only through imprint machines or standalone dial-out terminals with no internet connection, and that store no account data electronically. Paper records may still be held, so physical security and retention requirements continue to apply.
Applies to. Card-present or mail and telephone order merchants using only imprint machines or standalone dial-out terminals, with no electronic storage of account data. Not e-commerce channels, not service providers.
Limits. The terminal must not connect to any other merchant system or to the internet; a dial-out terminal that shares a network with the till has left SAQ B. Paper records with account data may be retained, so the physical security and retention requirements still apply.