FAQ #1291 Diff
Why is SAQ A-EP used for Direct Post while SAQ A is used for iFrame or URL redirect?
Earlier Version
Later Version
Removed
Added
There is a distinct difference in terms of paymenthow payment data is accepted between Direct Post & iFrames/redirects, which is why there are different SAQs. In a Direct Post implementation, the merchant website produces some or all of the web page that is used to accept payment data, and then passes it directly to the third-party payment processor. In this implementation, the consumer (cardholder) never leaves the merchant website. Conversely, with a redirect or iFrame, the third-party payment processor produces the webpage that accepts payment data. The merchant website is not directly involved in the acceptance of payment data as this is directly accepted by the third-party payment processor. In these implementations, the consumer leaves the merchant website and goes to the payment processor for payment acceptance and processing. This data flow is a key difference between Direct Post & iFrames/redirects, which is why there arethe different SAQs. In a Direct Post implementation, the merchantmethods, and is reflected in the eligibility criteria for SAQ A and SAQ A-EP as follows:
SAQ A: All elements of the payment page(s) delivered to the consumer's browser originate only and directly from a PCI DSS validated third-party service provider(s)
SAQ A-EP: Each element of the payment page(s) delivered to the consumer's browser originates from either the merchant's websiteproduces the web page that is used to accept payment data, and then passes it directly to the third-party payment processor. In this implementation, the consumer (cardholder) never leaves the merchant website. Conversely, with a redirect or iFrame, the third-party payment processor produces the webpage that accepts payment data. The merchant website is not directly involved in the acceptance of payment data as this is directly accepted by the third-party payment processor. In these implementations, the consumer leaves the merchant website and goes to the payment processor for payment acceptance and processing.
This data flow is a key difference between the different methods, and explains why ?acceptance? is included in the SAQ A eligibility criteria and not in SAQ A-EP, as follows:
SAQ A: All payment acceptance and processing are entirely outsourced toa PCI DSS validated third-partycompliant service providers
SAQ A-EP: All processing of cardholder data is outsourced to a PCI DSS validated third-party payment processorprovider(s)
SAQ A: All elements of the payment page(s) delivered to the consumer's browser originate only and directly from a PCI DSS validated third-party service provider(s)
SAQ A-EP: Each element of the payment page(s) delivered to the consumer's browser originates from either the merchant's website
This data flow is a key difference between the different methods, and explains why ?acceptance? is included in the SAQ A eligibility criteria and not in SAQ A-EP, as follows:
SAQ A: All payment acceptance and processing are entirely outsourced to
SAQ A-EP: All processing of cardholder data is outsourced to a PCI DSS validated third-party payment processor
Disclaimer: This FAQ has been processed for display on this website and may contain errors. Please check the original FAQ on the PCI SSC website for the authoritative version.