• e-commerce merchant, which fully outsourced payment processing to third-party PCI DSS compliant service
  • NO paper with cardholder data is ever retained

Question: should such merchant still be SAQ-A compliant?

Or probably more general question: is it possible to fully outsource payment processing to third-party service and not worry about PCI DSS compliance at all?

1 Answer 1


Assuming you are a merchant with your own website and charge cards as yourself (as opposed to doing business though another site - like eBay or Amazon - and just being paid by that company), then there's no way to get around needing to be (at least) SAQ A compliant. After all, part of the point of SAQ A is to document that you don't handle cardholder data.

Whether SAQ A or SAQ A-EP applies depends on just how much of the process is outsourced. There's a guide for that

SAQ A has been developed to address requirements applicable to merchants whose cardholder data functions are completely outsourced to validated third parties, where the merchant retains only paper reports or receipts with cardholder data.

SAQ A-EP has been developed to address requirements applicable to e-commerce merchants with a website(s) that does not itself receive cardholder data but which does affect the security of the payment transaction and/or the integrity of the page that accepts the consumer’s cardholder data.

Since you say "fully-outsourced", I'm assuming you fall under A, but it's possible to fully outsource the payment handling, while still retaining enough influence in the process to fall under A-EP instead. For example, payment controls on your site which send the card data to the third party could be either, depending on how they're implemented, while simply redirecting to the third party site should always be A.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .