SAQ P2PE is for merchants — brick-and-mortar or mail/telephone order — who process every transaction through a validated, PCI-listed Point-to-Point Encryption solution. Card data gets encrypted at the point of entry and the merchant's systems never see it in clear text.
Eligibility criteria — a merchant needs all of these to be true
All payment processing goes through a validated, PCI-listed P2PE solution.
The only systems in the merchant's environment touching account data are the payment terminals that are part of that validated solution.
The merchant doesn't otherwise receive, transmit, or store account data electronically through any other channel.
Any retained data is paper only.
The merchant has implemented every control in the P2PE Instruction Manual (PIM) provided by the solution provider.
Worth double-checking with a merchant: PCI SSC maintains a list of "expired validations" for P2PE solutions — if a solution has expired, it's no longer considered validated, and the merchant should confirm acceptability with their acquirer.
What this looks like in practice
A mail/phone-order merchant who takes a card number over the phone and keys it directly into a P2PE-validated terminal (nothing else touches the data), or a retail merchant using a P2PE-listed terminal at checkout.
Requirement scope
Very light — 3 requirement categories (Requirements 3, 9, 12): protect stored account data, restrict physical access, and an information security policy.
ASV scanning
No — Requirement 11 doesn't apply.
Not a fit?
If the merchant is card-present only and using a phone/tablet-based reader instead of a P2PE-listed terminal, check SAQ SPoC. If any part of the environment falls outside the validated P2PE solution, look at SAQ D.