FAQ #1291 Diff

There is a distinct difference in terms of paymenthow payment data is accepted between Direct Post & iFrames/redirects, which is why there are different SAQs.  In a Direct Post implementation, the merchant website produces some or all of the web page that is used to accept payment data, and then passes it directly to the third-party payment processor. In this implementation, the consumer (cardholder) never leaves the merchant website.  Conversely, with a redirect or iFrame, the third-party payment processor produces the webpage that accepts payment data.  The merchant website is not directly involved in the acceptance of payment data as this is directly accepted by the third-party payment processor. In these implementations, the consumer leaves the merchant website and goes to the payment processor for payment acceptance and processing.  This data flow is a key difference between Direct Post & iFrames/redirects, which is why there arethe different SAQs. In a Direct Post implementation, the merchant website produces the web page that is used to accept payment data, and then passes it directly to the third-party payment processor. In this implementation, the consumer (cardholder) never leaves the merchant website. Conversely, with a redirect or iFrame, the third-party payment processor produces the webpage that accepts payment data. The merchant website is not directly involvedmethods, and is reflected in the acceptance of payment data as this is directly accepted by the third-party payment processor. In these implementations, the consumer leaves the merchant website and goes to the payment processoreligibility criteria for payment acceptance and processing.

This data flow is a key difference between the different methods, and explains why ?acceptance? is included in the SAQ A eligibility criteria and not inand SAQ A-EP,A-EP as follows:

SAQ A: All payment acceptance and processing are entirely outsourcedelements of the payment page(s) delivered to the consumer's browser originate only and directly from a PCI DSS validated third-party service providersprovider(s)
SAQ A-EP: All processingEach element of cardholder data is outsourcedthe payment page(s) delivered to the consumer's browser originates from either the merchant's website or a PCI DSS validated third-party payment processorcompliant service provider(s)