SAQ A-EP is for e-commerce merchants who've outsourced the actual payment processing to a compliant third party, but whose own website still plays a role in the transaction — it doesn't receive account data, but it does affect the security or integrity of the payment page.
Eligibility criteria — a merchant needs all of these to be true
They only take e-commerce transactions.
Everything except the payment page itself is outsourced to a PCI DSS compliant TPSP.
The merchant's website doesn't receive account data, but it does control how the customer and their data get redirected to the TPSP.
If a TPSP hosts the merchant's website, that TPSP is compliant with all applicable requirements (including Appendix A if it's a multi-tenant host).
Every element of the payment page delivered to the customer's browser comes from either the merchant's own site or the compliant TPSP — nowhere else.
The merchant doesn't electronically store, process, or transmit account data on its own systems.
They've reviewed the TPSP's Attestation of Compliance.
Any retained account data is paper only.
What this looks like in practice
Common examples: the merchant's website builds the payment form itself and the data goes straight from the customer's browser to the TPSP ("Direct Post"), or the merchant's site loads a script — JavaScript, typically — that runs in the customer's browser and helps create the payment page or transmit the data.
Requirement scope
Much broader than SAQ A — 12 requirement categories (essentially everything except Requirement 10), spanning network security controls, malware protection, and full access control and monitoring. This reflects that the merchant's own site is now part of the security picture, even though it never touches card data directly.
ASV scanning
Yes — Requirement 11 applies, so quarterly ASV scans are required.
Not a fit?
If the merchant's site has zero role in the payment page at all (pure redirect or iframe, nothing homegrown), SAQ A is the better, lighter-weight fit. If they store card data anywhere or take other channels too, look at SAQ D.