There is a distinct difference in terms of payment acceptance between Direct Post & iFrames/redirects, which is why there are different SAQs. In a Direct Post implementation, the merchant website produces the web page that is used to accept payment data, and then passes it directly to the third-party payment processor. In this implementation, the consumer (cardholder) never leaves the merchant website. Conversely, with a redirect or iFrame, the third-party payment processor produces the webpage that accepts payment data. The merchant website is not directly involved in the acceptance of payment data as this is directly accepted by the third-party payment processor. In these implementations, the consumer leaves the merchant website and goes to the payment processor for payment acceptance and processing.

This data flow is a key difference between the different methods, and explains why ?acceptance? is included in the SAQ A eligibility criteria and not in SAQ A-EP, as follows:

• SAQ A: All payment acceptance and processing are entirely outsourced to PCI DSS validated third-party service providers
• SAQ A-EP: All processing of cardholder data is outsourced to a PCI DSS validated third-party payment processor