The short answer
P2PE certification is the informal name for P2PE validation: a PCI SSC-listed P2PE Assessor, sometimes called a P2PE QSA, assesses a point-to-point encryption solution or component against the PCI P2PE Standard (now v3.2) and writes a P2PE Report on Validation (P-ROV). The PCI SSC reviews it and, if it accepts it, lists the product.
On this page
- Who needs a P2PE assessment?
- What does a P2PE assessment cover?
- How does P2PE certification work after the assessment?
- How does a P2PE assessment run?
- How does P2PE relate to PCI DSS, PCI PIN and card production?
- What does P2PE compliance change for merchants?
- Why Sovereign Secure for P2PE assessments?
- Talk to a P2PE Assessor
What most providers call P2PE certification is a P2PE assessment: the route by which a point-to-point encryption solution or component becomes PCI-listed. A P2PE Assessor tests it against the PCI Point-to-Point Encryption (P2PE) Standard, records the results in a P2PE Report on Validation (P-ROV), and the PCI Security Standards Council (PCI SSC) reviews that report before listing the product. There is no certificate, but there is a public listing that merchants and acquirers rely on.
Sovereign Secure is listed by the PCI SSC as a P2PE Assessor for Europe and the USA. We are also a Qualified Security Assessor (QSA), Qualified PIN Assessor (QPA), Card Production Security Assessor (CPSA) and 3DS Assessor company, so the PCI DSS, PIN and key management work around a P2PE solution can be planned by one team.
Who needs a P2PE assessment?
Any organisation that wants a point-to-point encryption solution, or part of one, on the PCI SSC’s list of validated P2PE products. Merchants buy from those lists because a listed solution can reduce their PCI DSS scope, so for providers the listing is often what makes the product saleable.
| Who you are | What is assessed | What you get |
|---|---|---|
| P2PE solution provider | The whole solution: encryption devices, solution management, the decryption environment and key management, including any functions you outsource | A solution P-ROV and, once the PCI SSC accepts it, a listing as a Validated P2PE Solution |
| Merchant acting as its own solution provider | The same domains as a solution provider, plus the extra requirements for merchant-managed solutions | A solution P-ROV; PCI DSS validation of your decryption environment is handled with your acquirer as usual |
| P2PE component provider | The P2PE requirements for the service you perform for solution providers | A component P-ROV and a listing as a Validated P2PE Component |
| Third party that does not want its own listing | Your service, reviewed inside each solution provider’s assessment | No listing of your own; each solution provider reports your service in its P-ROV |
| P2PE application vendor | Software on the terminal that can access clear-text account data | Assessed by a P2PE Application Assessor, which Sovereign Secure is not |
Under P2PE v3 the component types include encryption management (deploying and managing the payment devices), decryption management, key injection facilities, certification and registration authorities, POI deployment, POI management, key management and key loading. A component listing lets several solution providers reuse your validated service instead of assessing it again in each of their solutions.
What does a P2PE assessment cover?
It covers the full life of the solution, from the moment a card is read to the moment the data is decrypted. The P2PE Standard groups its requirements into five domains:
| Domain | What the assessor tests |
|---|---|
| 1. Encryption Device and Application Management | Secure management of the PCI-approved POI devices (PTS devices with SRED) and the software on them |
| 2. Application Security | Secure development of applications on the POI device that can access clear-text account data. A P2PE Application Assessor assesses the applications themselves; in a solution assessment we confirm the ones you deploy match their assessment |
| 3. P2PE Solution Management | Overall management of the solution, third-party relationships, incident response and the P2PE Instruction Manual (PIM) |
| 4. Decryption Environment | Secure management of the environment that receives and decrypts the encrypted account data, including every decryption HSM |
| 5. P2PE Cryptographic Key Operations and Device Management | Key generation, distribution, loading and management for the POI devices and decryption HSMs |
A solution provider is assessed against every domain that applies, though functions performed by PCI-listed components can be relied on rather than retested. A component provider is assessed against the requirements for its component type, which for key injection facilities and key management services sit mostly in Domain 5. The hardware rules are strict: every HSM used in the solution must be approved to PCI PTS HSM or to FIPS 140-2 or 140-3 Level 3 or higher.
The current version is P2PE v3.2, which the PCI SSC published in June 2025 as a minor revision covering device testing and sampling, whitelists and non-payment software. All new submissions since 1 January 2026, including reassessments of listed products, must use it. The Council has said a major revision, v4.0, is in development. You can follow both on the PCI SSC P2PE page.
How does P2PE certification work after the assessment?
You receive a P2PE Report on Validation, written in the PCI SSC’s reporting template, that records how each applicable requirement was tested and found. You then submit it to the PCI SSC, together with the programme paperwork the P2PE Program Guide sets out, such as the vendor release agreement.
The Council reviews the P-ROV and, if it accepts it, adds your solution or component to its list of validated P2PE products. The PCI SSC, not the assessor, decides on acceptance and listing. Once listed, the P2PE Program Guide sets an annual renewal for listed solutions, a delta change process for changes between assessments, and a full reassessment cycle.
For solution providers, the P2PE Instruction Manual is part of what we assess. It is the document merchants follow to install, inspect and look after their terminals, so it needs to be accurate and usable by store staff, not just complete.
How does a P2PE assessment run?
Every engagement follows the same five stages, scaled to the size of your solution:
- Scoping. We confirm whether you are being assessed as a solution or a component, which domains apply, which PCI-listed components you rely on, the PTS-approved device models, and the sites involved, such as key injection rooms and decryption data centres.
- Readiness review (optional). A gap assessment against P2PE v3.2 before the formal assessment, so problems with device custody, key ceremonies or the PIM are fixed early. Advisory and assessment work are kept separate.
- Fieldwork. We review documents and records, interview staff, examine configurations and observe processes such as key ceremonies, device receipt and dispatch, and secure room controls. Physical sites are visited where the testing procedures call for observation.
- Reporting. We write the P-ROV, put it through our internal quality review and agree the findings with you before it goes to the PCI SSC.
- Listing and upkeep. We answer the Council’s questions during its review, and after listing we can support annual renewals, delta changes and reassessment.
How long it takes depends on your scope and readiness, so we give you a plan with dates once scoping is done rather than a standard timescale.
How does P2PE relate to PCI DSS, PCI PIN and card production?
P2PE sits next to the other PCI security standards rather than replacing them, and most P2PE providers deal with more than one:
| Standard | Assessor programme | Where it meets P2PE |
|---|---|---|
| PCI DSS | QSA | The decryption environment must be secured according to PCI DSS, and merchants using a listed solution validate with the shorter SAQ P2PE |
| PCI PIN Security Requirements | QPA | Domain 5 key management follows the same principles, such as dual control and split knowledge, and key injection facilities often fall under Annex B as well |
| Card Production and Provisioning | CPSA | A separate standard for card manufacture and personalisation, relevant where a card bureau also runs key injection or key management services |
| PCI PTS | Device approval, not an assessor | Every POI device in a P2PE solution must be PTS-approved with SRED; see our PCI PTS glossary entry |
The PCI SSC has also introduced a Key Management and Operations (KMO) standard and programme, whose initial focus is the cryptographic keys used to secure PIN and P2PE data. We check how it applies to you when we scope.
Because we hold the QSA, QPA and CPSA approvals as well, one team can plan your PCI DSS assessment, your PCI PIN security assessment and your P2PE assessment together, collect shared evidence once and avoid contradictory findings on overlapping controls.
What does P2PE compliance change for merchants?
For merchants, the value of P2PE is scope. If every card-present payment goes through terminals in a PCI-listed solution and the merchant follows the PIM, it may be able to validate with SAQ P2PE, one of the shortest questionnaires. Merchants do not need a P2PE assessment of their own unless they run the solution themselves. Our guide to what P2PE is and how SAQ P2PE works explains the merchant side, and our free PCI compliance check tells you which SAQ you are likely to need.
Why Sovereign Secure for P2PE assessments?
- A listed P2PE Assessor. Sovereign Secure Ltd is on the PCI SSC P2PE Assessor list for Europe and the USA. We checked the listing on 13 October 2026, and you should check it yourself.
- Clear about our limits. We assess P2PE solutions and components. We are not a P2PE Application Assessor, so P2PE applications need a separately listed assessor.
- Five PCI SSC approvals. QSA, QPA, CPSA, P2PE Assessor and 3DS Assessor, and a member of the PCI SSC Global Executive Assessor Roundtable for 2026 to 2028.
- Key management depth. As a Qualified PIN Assessor we already assess key injection facilities, HSMs and key ceremonies, which is where much of a P2PE assessment’s testing sits.
- International reach. Headquarters at 16 Whalley Road, Accrington, Lancashire, with offices in Los Angeles, Singapore, Dubai and Dhaka.
- Fixed quotes. You get a fixed price after a short scoping call, so you know the cost before work starts.
Talk to a P2PE Assessor
Tell us whether you are building a solution, a component or a merchant-managed solution, which devices and sites are involved and when you want to be listed. We will confirm the scope and send a fixed quote. Contact our PCI team or call +44 161 523 5276.
Last reviewed October 2026 by the Sovereign Secure assessment team.
