PCI DSS SAQ B and B-IP eligibility explained

Does PCI DSS SAQ B or SAQ B-IP fit your standalone terminals?

SAQ B covers merchants that take cards only on imprint machines or standalone dial-out terminals connected by phone line to the processor, while SAQ B-IP covers standalone PTS point-of-interaction devices with an IP connection to the processor. Both are self-assessment questionnaires, and a merchant must meet every eligibility criterion for either one. A single failed criterion, such as a terminal that also connects to a back-office computer or a store network, moves the merchant to a different questionnaire. The merchant owns that answer. Its acquirer and the payment brands decide which validation applies and which enforcement programs run, so confirm the choice with the acquirer before completing anything.

Start by listing every device that takes card data and tracing how each one connects. Check whether it is a dial-out terminal, an imprint machine, or an IP-connected PTS device, and whether it relies on a phone, computer or other device to reach the processor. Also check whether any device stores account data electronically, including on paper-based workflows that the v4 questionnaires address. Keep the device list and network sketch, because the merchant signs the Attestation of Compliance and must be able to show the basis for each answer. Where a device connects over cellular or wireless, the PCI SSC's guidance says it can still fit SAQ B-IP if all criteria are met, so ask the acquirer to confirm that point in writing.

DeployOpen can help prepare the environment and the evidence, such as device inventories, network isolation checks and records of how terminals are administered. It does not complete the questionnaire on the merchant's behalf, issue an attestation or decide eligibility. Only the merchant's acquirer or the payment brands accept the result, so agree the required scope and documents with them before work begins. If the answers point toward a different questionnaire, the same evidence will usually carry over to the next step.

Which questionnaire matches how each terminal connects?

This table compares four self-assessment questionnaires by how card data is captured and how the device reaches the processor. Read each row against your own terminal setup, then confirm the final choice with your acquirer, since the payment brands and acquirer decide which questionnaire applies.

Questionnaire	Connection method	Typical device	What makes it fit	Most common reason to move
SAQ B	Phone line dial-out to the processor, no Internet or network connection	Imprint machine or standalone dial-out terminal	No electronic storage of account data, device not connected to other systems or the Internet	Adding an IP connection or any electronic storage of card data
SAQ B-IP	IP connection to the processor using standalone PCI-listed PTS POI devices	Standalone IP-connected PTS terminal, excluding secure card readers	Device does not connect to other merchant systems or depend on a computer or phone to reach the processor	Terminal reaches the processor through a computer, phone or other shared device
SAQ C	Payment application and Internet connection on one device or a single-store LAN	Internet-connected POS system with a payment application	Isolated from other systems, with the payment application on the same device or single-store network	Multi-store or storing environment, or systems that cannot be isolated
SAQ C-VT	Keyed entry into a provider's web-based virtual terminal	Isolated computer with browser access to the virtual terminal	No card readers, no card data storage software, no other electronic payment channels	Adding card readers, another electronic channel or stored card data

Which terminal setups fall outside SAQ B-IP

SAQ B-IP is narrow by design. Each setup below breaks one of its core conditions: standalone devices, no connection to other merchant systems, and no dependence on another device to reach the processor. Check each setup against your architecture before you assume the questionnaire fits.

Secure card readers (SCRs and SCRPs)

SAQ B-IP excludes secure card readers, which are PTS-approved devices that attach to a computer or POS system to read card data and pass it on. A terminal that is really an SCR or SCRP, even when it looks like a standalone unit, puts you outside this SAQ. Check the device's PTS listing and its device type against the SAQ's definition, and ask your acquirer to confirm the classification in writing.

Devices connected to other merchant systems

A PTS POI device must not connect to other merchant systems. Its IP link should serve only the payment connection to the processor, not a shared store network that also carries a till, a inventory server or a point-of-sale back office. If the terminal shares a segment, VLAN or network path with other systems, the setup fails eligibility. Review the network diagram and confirm that the terminal has no route to other merchant hosts.

Devices that rely on a computer or phone

A device that reaches the processor only through a computer, tablet or phone is not a standalone POI device. The SAQ requires a direct connection, so a terminal that depends on a PC running a payment app, or on a mobile phone acting as a gateway, is outside B-IP. Trace the full path from the terminal to the processor and confirm that no intermediary device is required for the connection to work.

Electronic storage of account data

SAQ B-IP assumes the merchant does not store account data electronically. Any log file, export, cached transaction file, or back-office spreadsheet that holds card numbers moves the merchant to a broader SAQ. Paper records are handled under the SAQ's own requirements. Search terminal logs, store servers, email and shared drives for stored account data, and confirm that the terminal's transaction records are not retained beyond what the processor provides.

Back-office server administering a POI device

Administrative access is allowed only from a same-type system. PCI SSC FAQ 1442 permits a terminal to be administered from another device of the same type on the same network without losing eligibility. A back-office server used to manage the terminal is a different system type, however, and breaks B-IP eligibility. Identify who administers each device, from what machine, and whether that machine is a PTS POI device of the same type.

Can wireless and cellular PTS terminals still use SAQ B-IP?

Yes, a PTS-approved terminal that connects over cellular or wireless can still fit SAQ B-IP, as long as the merchant meets every SAQ B-IP eligibility criterion. The PCI SSC's answer to FAQ 1313 makes the point that the connection type alone does not disqualify the device. The questions that decide eligibility are whether the device is a standalone PTS POI device, whether it is not a secure card reader, and whether it reaches the processor without depending on a computer, phone or other system. Wireless connectivity does not change which questionnaire applies, so a merchant should not assume that a cellular terminal automatically moves to SAQ C or SAQ D.

The connection still has to be standalone. A terminal that joins the store Wi-Fi shared with a point-of-sale computer, a back-office printer or a guest network is no longer isolated from other merchant systems, and that breaks eligibility. The same applies if the device uses a paired phone or tablet as a bridge to reach the processor. Check how the device is provisioned, whether its SIM or access point is dedicated to it, and whether any other device in the store can reach it on the local network. If the store uses a router or Wi-Fi access point, confirm that it serves only the terminal and that administration of the device does not run from a different system type, which FAQ 1442 treats as a breach of B-IP eligibility.

Confirm the wireless configuration with your acquirer and the payment brands before you complete the questionnaire, because they decide which validation applies to you. Ask them to confirm in writing that a cellular or wireless deployment of your specific device model is acceptable under B-IP. Then keep a device record in your compliance file that lists the make, model, serial number, firmware version, connection type and PTS listing reference for each terminal, along with the store location and the date of your last PTS check. The PTS listing matters because some payment brands treat devices with expired approval differently, so the record should show that each terminal is still approved.

What SAQ B and SAQ B-IP each require in practice

Imprint machines and standalone dial-out terminals are the configuration SAQ B was written for. The device takes card data either from a manual imprint or from a card read at the terminal, then sends the transaction over a phone line to the processor. Nothing else connects to the device, so the merchant's network, back-office computers and the Internet are outside the picture.

Connection check: Confirm the terminal dials out over a phone line and has no Ethernet, Wi-Fi or cellular path to other systems.
Storage check: Confirm no account data is kept electronically, including on the terminal, in a spreadsheet or in a receipt scanner. Paper records need a retention policy.
Device list and inspection: Keep a list of each terminal with its location and serial number, inspect it on a set schedule, and record the results under Requirement 9.5.1.
Staff training: Train cashiers to spot substitution, unexpected cables or a swapped terminal, and to report anything unusual.
Evidence to keep: The device list, inspection logs, training records, the paper retention policy and the phone line invoice showing the dedicated line.

Before relying on a dial-out device, check its PTS listing and ask the acquirer about any device whose approval has expired, since some payment brands treat that as a rule issue.

What the v4 questionnaires added for B and B-IP merchants

The v4 versions of SAQ B and SAQ B-IP added requirements that reach paper. For SAQ B, the new items cover data retention and stored account data policies for paper records. For SAQ B-IP, the additions are data retention and media protection for paper records. In practice, printed terminal receipts, imprint slips, merchant copies and daily batch summaries that carry card data now need a written answer to three questions: how long each type is kept, where it is kept and how it is destroyed when the retention period ends. A merchant whose only written guidance is an unwritten habit of filing slips in a drawer should update its policy before it completes the questionnaire, because the questionnaire asks the merchant to confirm that such a policy exists and is followed.

The v4 guidance also made the scope of SAQ B-IP narrower in one important respect. The B-IP questionnaire applies only to standalone POI devices that are not connected to other device types in the same network zone. A merchant that runs an IP-connected PIN pad next to a till, a router-connected print server or a back-office computer on the same segment should not assume it still qualifies. The practical check is to list every device on the segment the terminal uses, confirm that each one is a POI device of the same kind, and confirm with the acquirer that the terminal's configuration matches the eligibility criteria before choosing SAQ B-IP.

Before completing either questionnaire, a merchant should ask its acquirer which version of the questionnaire it expects and whether it has any local requirements for paper records. Confirm the exact paper-record items against the current SAQ text rather than an older summary, since the questionnaire wording governs the answers. The retention policy, the device list and the network description are the three documents an assessor or acquirer is most likely to ask to see.

How to complete SAQ B or SAQ B-IP and sign the AOC

This sequence takes a merchant from confirming that a standalone terminal setup is eligible to a signed Attestation of Compliance that the merchant can submit to its acquirer. Each step produces a record that a reviewer can check.

Confirm eligibility against every criterion
The merchant owner or compliance lead reads the eligibility criteria of the questionnaire that matches the device type, SAQ B for imprint machines and dial-out terminals or SAQ B-IP for IP-connected PTS terminals, and checks each one against how the business actually takes cards. Any single failed criterion moves the merchant to a different SAQ, so the check must cover every item, including whether the terminals connect to other merchant systems, whether account data is stored electronically, and whether any card data arrives through e-commerce or a service provider. The output is a short eligibility memo that records each criterion, the evidence behind the answer and the person who confirmed it.
Inventory terminals and their connections
The operations or store manager lists every payment device at every location, with its make, model, serial number, PTS approval reference, connection type (phone line, Ethernet, Wi-Fi or cellular) and the processor it reaches. The inventory also shows whether any device depends on a computer or phone to reach the processor, and whether any device administration uses another system. Done properly, the inventory matches the physical devices on site, and it becomes the reference for the scope statement and for the network diagram that accompanies the assessment.
Check PTS listings and device status
The merchant checks each device's PTS approval against the PCI SSC listing and records the approval status and date. PCI DSS does not itself require PTS-approved devices, but some payment brands do, including rules that address devices whose approval has expired, so the merchant asks its acquirer how expired devices should be handled before any are kept in service. The output is a checked device list with the approval status of each device and the acquirer's written answer on any device that is no longer approved.
Gather evidence for each applicable requirement
The compliance lead works through the requirements that the chosen questionnaire includes and collects the supporting material for each one. For card-present terminals this typically covers the device list, periodic inspection records, training records for staff who handle devices, storage and disposal rules for paper records and any policies on retention of stored account data. Requirements that do not apply can be marked not applicable, and the reason should be written down. The output is an evidence folder indexed by requirement, so that each answer can be traced to a document or record.
Answer each question with the right response
The compliance lead completes the questionnaire one item at a time, choosing the response option that matches the evidence: in place, not applicable, or not in place. Each answer that depends on a control should cite the evidence in the folder, and any answer that relies on a third party, such as a processor or a device maintenance provider, should identify that party. Where a requirement is not met, the merchant must record a remediation plan rather than mark it as met. The output is a completed questionnaire where every answer has a supporting reference.
Confirm the result with the acquirer
The merchant sends the completed questionnaire, the eligibility memo and the device inventory to its acquirer, and asks the acquirer to confirm that the SAQ type and the reported devices are acceptable under its program. Payment brand rules and acquirer requirements can differ from the standard, and the acquirer is the party that determines what it accepts for the merchant. The output is written acknowledgement from the acquirer, or a list of questions that must be answered before submission.
Sign the Attestation of Compliance for submission
An authorized officer of the merchant signs the Attestation of Compliance that accompanies the SAQ, which states the merchant's validation status based on the completed questionnaire. The signed AOC and the questionnaire are then submitted as the acquirer directs. A certificate or a seal from a vendor or consultant is not accepted as validation under PCI SSC guidance, so the signed AOC is the document that counts. The output is the signed AOC, filed with the evidence folder and the eligibility memo for the next assessment cycle.

What usually moves a merchant out of SAQ B or B-IP

SAQ B and B-IP stay available only while the terminal setup stays simple. Most merchants who lose eligibility did not plan a change, they added a connection, a device or a process without rechecking the criteria. The cards below cover the changes that most often break eligibility and the check that catches each one early.

Terminal gained a network connection

A dial-out terminal or IP terminal can gain a link to another system without anyone deciding to make the change, for example when a vendor enables a feature, a technician connects a cable for updates, or a router is installed next to the terminal. SAQ B requires that the terminal not be connected to other systems or the Internet, and SAQ B-IP requires that the device not connect to other merchant systems. Check the physical and logical setup of each device against its eligibility criteria at least once a year and after every service visit.

POS PC added to the same network

A point-of-sale computer or tablet placed on the terminal's network moves the setup out of SAQ B-IP, because the terminal is then connected to another device type in the same network zone. This often happens during a store refit when a back-office PC shares the router. Ask whether any computer, phone or till shares the network segment with the terminal, and document the network diagram that shows where the terminal sits.

Phone used as a relay

Some terminals reach the processor only through a staff phone, tethered device or hotspot. SAQ B-IP does not allow a device to rely on another device such as a computer or phone to reach the processor, so a relay turns a standalone terminal into a dependent one. Confirm how each terminal connects during installation, and treat any workaround that uses a phone as a reason to reassess the SAQ with your acquirer before going live.

Unlisted paper or electronic records

The v4 SAQs added data retention and stored account data policy expectations for paper records under SAQ B, and data retention and media protection for paper records under SAQ B-IP. A merchant that keeps copies of slips, printed batch reports or electronic files with account data, without a written retention policy that covers them, has a gap the assessor will find. Inventory where paper and electronic records are kept, define how long each is retained, and confirm the policy names each record type.

Expired PTS approval on a device

PCI DSS does not require PTS-approved devices, but some payment brands do, and their rules can cover devices whose PTS approval has expired. A terminal that was approved when purchased may be past its listing date after years in service, and a merchant that does not check can end up with a device the acquirer will not accept. Check each device's PTS listing when it is deployed and again when it is redeployed, and ask the acquirer how it treats expired devices.

Service provider using a different system type

A service provider that administers terminals from a back-office server, rather than from the same type of device, breaks SAQ B-IP eligibility. Non-console administrative access is allowed from a same-type device on the same network, so the remote administration path is the decisive check. Ask the provider which systems it uses to reach each terminal, record the answer in the responsibility matrix, and confirm it with the acquirer before the provider changes its tooling.

Who owns the questionnaire, the terminals and the evidence

The merchant owns the outcome. It decides whether its acceptance method fits SAQ B or SAQ B-IP, confirms every eligibility criterion is still true, operates the controls the questionnaire tests, and signs the Attestation of Compliance (AOC). Eligibility is not a one-time check. A new terminal model, a Wi-Fi or cellular connection, or a change in how a device is administered can remove a merchant from the SAQ it used last year.

Eligibility decision: The merchant records which SAQ it selected and why, and re-checks that choice whenever a terminal, network path or channel changes.
Device control: The merchant maintains the list of point-of-interaction (POI) devices and their locations, and runs the inspections and staff training that Requirement 9.5.1 expects.
Network and administration: The merchant documents how each device reaches the processor and who administers it, since a back-office system used to manage a device can break SAQ B-IP eligibility.
Signed AOC: The merchant, through an authorized officer, attests to its status and retains the questionnaire and supporting evidence.

Confirm with your internal owner of payments that someone on your team can answer for each control in the SAQ.

Questions merchants ask about SAQ B and SAQ B-IP

Does a single card terminal with a phone line qualify for SAQ B?

Yes, if the terminal is a standalone dial-out device or imprint machine connected by phone line to your processor, and it connects to no other system and not to the Internet. SAQ B also requires that you store no electronic account data. The terminal must not be a device that reaches the processor through a computer, phone or network. If any of those conditions fails, the phone line alone does not keep you in SAQ B. Confirm the setup with your acquirer before you choose the questionnaire, because the acquirer and payment brands decide which entities validate and how.

Can a Bluetooth or cellular PTS device qualify for SAQ B-IP?

It can, provided the device is a standalone PCI-listed PTS point-of-interaction device and the merchant meets every SAQ B-IP eligibility criterion. The PCI SSC has confirmed that a PTS-approved device connecting over cellular or wireless can still fit B-IP under those conditions. The device must not connect to other merchant systems and must not depend on a computer or phone to reach the processor. Bluetooth pairing to a phone or tablet that carries the payment connection would take the setup out of B-IP. Ask your acquirer to confirm the connection path in writing.

Can a secure card reader ever use SAQ B-IP?

No. SAQ B-IP explicitly excludes secure card readers, including SCRs and SCRPs. A terminal that relies on a secure card reader that attaches to a computer or tablet falls outside B-IP. Those setups usually point toward SAQ C or another questionnaire, depending on the architecture. Check the device model and how it connects before assuming eligibility, because a card reader that looks like a standalone terminal may still be a secure card reader in the PCI listing.

Does a merchant need a QSA to complete SAQ B or SAQ B-IP?

No. A self-assessment questionnaire is completed by the merchant, and the merchant signs the Attestation of Compliance. A Qualified Security Assessor is not required by the PCI SSC for these SAQs. Some merchants still bring in a QSA or an Internal Security Assessor for help, and the acquirer may have its own reporting expectations. Any outside help should be scoped in writing, and the merchant remains responsible for the answers it submits.

What work must the merchant do itself for SAQ B-IP?

The merchant owns the questionnaire, the answers and the evidence behind them. In practice this includes:

Keeping a current inventory of every POI device, with its PTS listing and location
Confirming that no device is connected to other merchant systems or depends on another device to reach the processor
Protecting devices from tampering and substitution through a device list, periodic inspections and staff training
Confirming the paper record retention and media protection practices that the v4 SAQ B-IP added
Signing the Attestation of Compliance once every eligibility criterion is met

How long does SAQ B or SAQ B-IP take to complete?

The supplied PCI SSC material does not give a duration, so no figure is stated here. Time depends on how many terminals you run, how well the device inventory and network layout are documented, and whether any eligibility question needs confirmation with your acquirer. Ask your acquirer for its expected timeline and documentation requirements, and ask any outside provider for a written scope and schedule before work begins.

What changes when a store that uses SAQ B adds e-commerce?

Adding e-commerce usually takes the business out of SAQ B. SAQ B covers merchants that accept card data only through imprint machines or standalone dial-out terminals, and it is not designed for e-commerce. An online channel that accepts card data, or that redirects or embeds payment pages, creates a separate eligibility question that a different SAQ may answer, such as SAQ A or A-EP, depending on how the payment page is delivered. Each channel needs its own review, and the card-present and online channels must be assessed together if they share systems or data. Confirm the correct SAQ with your acquirer before launching the online channel.

How DeployOpen prepares terminal environments and evidence

DeployOpen prepares the systems, network design and documentation that support a merchant's SAQ B or B-IP self-assessment, inside the merchant's own infrastructure. The merchant completes and signs the Attestation of Compliance, and the acquirer or payment brands determine which validation applies.

How we scope

Confirm the terminal type, connection method and acquirer before choosing between SAQ B and SAQ B-IP
Document every device, its PTS listing status and whether it reaches the processor directly or through another system
Agree the scope in writing as a fixed-scope engagement, with deliverables and timelines set before work starts

How we build

Configure standalone PTS POI devices so they connect only to the processor and do not reach other merchant systems
Verify network segmentation and that no back-office server or phone is used to administer the terminals
Set up device lists, inspection records and staff training that support the tamper and substitution requirement

How we hand over

Deliver the terminal inventory, network diagram, data flow description and device inspection records as evidence
Provide test records for each eligibility criterion so the merchant can perform the Expected Testing itself
Document responsibilities for the merchant, acquirer and terminal provider, so the merchant can sign its own AOC

How we support

Offer ongoing support as a retainer for device changes, new terminal rollouts and annual SAQ updates
Review changes to terminal connectivity, such as moving from dial-out to IP or adding wireless, against SAQ eligibility
Confirm open points with the merchant's QSA, ISA or acquirer when an independent assessor or the brands must decide

PCI DSS SAQ B and B-IP for standalone payment terminals