Knowledge center

What is SAQ A-EP?

SAQ A-EP is intended for certain e-commerce merchants that outsource processing but whose website can affect transaction security, without electronically storing, processing or transmitting account data in their systems.

Why it matters

Scripts, redirects, iframes and hosting can change eligibility compared with SAQ A.

What to confirm

Payment-page integration
Control of scripts and redirects
Account-data storage or receipt

Official PCI DSS documentation · PCI DSS v4.0.1 · reviewed 2026-07-31

This content is informational and is not legal advice. The applicable route and validation method depend on the operation and requesting party.

Identify your likely route Back to all questions