SAQ SPoC is new for PCI DSS v4.0. It covers merchants taking card-present payments using a PCI-listed Secure Card Reader-PIN (SCRP) device paired with a commercial off-the-shelf (COTS) phone or tablet — the kind of setup you'd see with a mobile point-of-sale app on a regular smartphone.
Eligibility criteria — a merchant needs all of these to be true
All payment processing happens through a card-present channel only.
All cardholder data entry goes through an SCRP that's part of a validated, PCI SSC-listed SPoC solution.
The only systems in the SPoC environment touching account data are part of that validated solution.
The merchant doesn't otherwise receive, transmit, or store account data electronically.
This payment channel isn't connected to any other system or network in the merchant's environment.
Any retained data is paper only.
The merchant has implemented every control in the SPoC user guide from the solution provider.
Important exclusions
SPoC explicitly does not apply to unattended card-present channels (kiosks, self-checkout), mail/telephone order, or e-commerce. It's attended, in-person transactions only. Merchants using a non-PTS-listed magnetic stripe reader also don't qualify — though a PTS-listed SCRP with magstripe capability is fine. As with P2PE, check for expired SPoC-listed solutions with the acquirer.
What this looks like in practice
A retail employee, delivery driver, or market vendor using a smartphone or tablet with a paired card reader to take chip, contactless, or magstripe payments — mobile pop-up shops are a classic example.
Requirement scope
Very light — 4 requirement categories (Requirements 3, 8, 9, 12): protect stored account data, user authentication, physical access, and security policy.
ASV scanning
No — Requirement 11 doesn't apply.
Not a fit?
MOTO or e-commerce merchants can't use SPoC regardless of their card reader — look at P2PE (works for both card-present and MOTO) or the appropriate e-commerce SAQ instead. Unattended/self-checkout setups need SAQ D.