SAQ B covers merchants — brick-and-mortar or mail/telephone order — who process cards only through an imprint machine (the old-school knuckle-buster) and/or standalone terminals that dial out over a phone line. Nothing electronic ever gets stored.
Eligibility criteria — a merchant needs all of these to be true
They use only an imprint machine and/or standalone dial-out terminals connected via phone line to the processor.
Those terminals aren't connected to any other system in the merchant's environment.
The terminals aren't connected to the internet.
No account data is stored in electronic format.
Any retained data is paper only.
What this looks like in practice
A retail counter using a manual imprint machine, or a mail/phone-order merchant with a standalone dial-out terminal plugged into a phone jack — no network, no internet, no POS integration.
Requirement scope
One of the lightest SAQs — 4 requirement categories (Requirements 3, 7, 9, 12): protect stored account data, restrict access by need-to-know, restrict physical access, and an information security policy.
ASV scanning
No — SAQ B doesn't include Requirement 11, since there's no internet-connected, externally-scannable footprint.
Not a fit?
If the terminal connects over IP/ethernet instead of a phone line, that's SAQ B-IP. If there's any e-commerce channel or the terminal touches other systems, look at SAQ C or SAQ D.