SAQ A is for card-not-present merchants (e-commerce or mail/telephone order) who've handed off 100% of payment processing to a compliant third party and never store, process, or transmit account data electronically themselves.
Eligibility criteria — a merchant needs all of these to be true
They only take card-not-present transactions (e-commerce or MOTO) — no face-to-face/card-present.
All account data processing is outsourced to a PCI DSS compliant third-party service provider (TPSP).
Nothing on the merchant's own systems ever electronically stores, processes, or transmits account data — it all lives with the TPSP.
They've reviewed the TPSP's Attestation of Compliance and confirmed it covers the services being used.
Any account data they keep is paper only — never received electronically.
If it's e-commerce: every element of the payment page delivered to the customer's browser comes directly from the compliant TPSP, and the merchant has confirmed the site isn't exposed to script attacks.
The moment any part of the payment page originates from the merchant's own site (not just the TPSP), SAQ A no longer applies — that's SAQ A-EP territory instead.
What this looks like in practice
Typical setups: a merchant with no access to their own webpage because it's entirely hosted by the processor; a webpage that URL-redirects to the processor's checkout; a webpage that embeds the processor's checkout in an iframe; or a MOTO merchant who keys nothing in themselves and outsources all processing.
Requirement scope
SAQ A covers 7 requirement categories (Requirements 2, 3, 6, 8, 9, 11, 12): secure configurations, protecting stored account data, secure systems/software, user authentication, physical access, external vulnerability testing, and an information security policy.
ASV scanning
Yes — SAQ A includes Requirement 11, so quarterly ASV scans are required for the merchant's externally-facing footprint, even if that footprint is just a redirect or iframe page.
Not a fit?
If the merchant's own site creates the payment form or loads a script that touches the payment page, look at SAQ A-EP. If they don't cleanly fit either, SAQ D is the fallback.