SAQ B walkthrough: standalone dial-out terminals
By Sam Rivera, Founder, SentinelPanda · June 3, 2026 · 2 min read · PCI DSS
SAQ B is the smallest PCI SAQ. It assumes a very narrow setup — and the moment your terminal touches IP, you switch to SAQ B-IP.
Who SAQ B is for
SAQ B applies to merchants who accept card payments only via standalone, dial-out terminals (connected to the payment processor over a phone line) or imprint machines (mechanical imprint of the embossed card details). The terminal is not connected to any other system, and no cardholder data is stored electronically.
Brick-and-mortar shops with a single Lipman/Verifone-style dial-out terminal, sole-trader tradespeople with a single mobile terminal that uses cellular as a dial-out replacement, very small operations that still use carbon imprint machines. Modern context: rare but not extinct.
The eligibility checklist
- You use only standalone dial-out terminals or imprint machines for card acceptance.
- You do not store cardholder data electronically (paper imprints are managed under physical-security controls).
- You do not have e-commerce, mail-order/telephone-order, or IP-connected terminals.
- You do not have a payment application running on a general-purpose computer.
- You confirm annually that your TPSP and the terminal vendor are PCI compliant.
The requirement subset
SAQ B has about 40 control questions, concentrated in Requirements 3 (storage protection — mostly physical), 4 (transmission — limited because dial-out), 7 (access control), 9 (physical access — biggest block), and 12 (programme management).
Physical security controls dominate: locked storage of receipts, visitor procedures, secure disposal of media. Terminal handling is covered explicitly: periodic inspection for tampering or substitution (Req 9.5.1), inventory of devices with serial numbers, training of staff to recognise tampering.
Common SAQ B pitfalls
- Using an IP-connected terminal and assuming it is still SAQ B because it "looks the same" — IP capability = SAQ B-IP at minimum.
- A terminal with a modem that ALSO has a USB or IP port and is occasionally connected — disqualifies SAQ B even if you mostly dial.
- Skipping the periodic terminal-tampering inspection (Req 9.5.1.2) — small but mandatory.
- Storing copies of imprint receipts past the retention period in an unlocked drawer.
A worked example
A small high-street bakery accepts cards via a single Verifone dial-out terminal in the front of the shop. Staff are trained to look for tampering signs on the terminal each morning; the terminal's serial number is recorded; receipts are stored in a locked cabinet until the end of the retention period and shredded after. The merchant signs the SAQ B once a year, attaches the TPSP statement from the acquirer, and stores the AOC.
Total work: 1-2 weeks the first time (mostly establishing the inspection routine and the receipt-handling SOP), days for revalidation.