What Is P2PE? Point-to-Point Encryption, Validated Solutions & SAQ P2PE

P2PE (point-to-point encryption) is a PCI Security Standards Council standard for payment solutions that encrypt card data inside a secure payment terminal the moment the card is read, and decrypt it only in the solution provider’s secure decryption environment. Merchants using a PCI-listed P2PE solution can take most of their systems out of PCI DSS scope and may qualify for SAQ P2PE, one of the shortest questionnaires.

“P2PE” is used loosely by vendors, but in PCI terms it means a specific standard and a specific validation process. This guide explains what P2PE means, how it works, how it differs from E2EE, how solutions are validated and what merchants still need to do.

Sovereign Secure is a PCI SSC-listed P2PE Assessor for Europe and the USA. If you provide a P2PE solution or component and need it validated, our P2PE assessments page explains how the assessment and listing work.

Key takeaways

• PCI P2PE validates encryption solutions end to end, from payment terminal to decryption environment.
• Only solutions listed on the PCI SSC website allow the use of SAQ P2PE.
• “End-to-end encrypted” (E2EE) is not the same as PCI-listed P2PE.
• Merchants still have obligations, set out in the solution’s P2PE Instruction Manual.
• Encryption that is not PCI-listed can still reduce risk, but a QSA must assess any scope reduction.

What is P2PE and how does it work?

In a P2PE solution:

1. The card is read by a payment terminal approved under the PCI PIN Transaction Security (PTS) programme.
2. The terminal encrypts the card data immediately, using keys injected under controlled conditions.
3. Encrypted data passes through the merchant’s tills, networks and systems, which cannot decrypt it.
4. The solution provider decrypts the data in a secure decryption environment, typically using hardware security modules.

Because the merchant never has clear-text card data or the decryption keys, its own systems are largely removed from the cardholder data environment.

What is the difference between P2PE and E2EE?

E2EE can be perfectly good security. The difference is proof: with a listed P2PE solution, the scope reduction has already been validated. With E2EE, you have to prove it yourself.

What is a PCI-validated P2PE solution?

It is a solution that an assessor qualified by the PCI SSC for the P2PE programme has assessed against the P2PE standard, and that the Council has accepted and listed. Solution providers can also rely on separately listed components, such as key injection facilities and decryption management services.

Listings have expiry dates and must be revalidated. Before relying on a solution, check the PCI SSC’s listings of assessors and solutions to confirm the solution is listed, the listing is current, and the terminal models you will use are included.

What does the PCI P2PE standard cover?

The P2PE standard covers the whole lifecycle of the solution, grouped into five domains:

• Management of encryption devices, from manufacture and key loading to deployment, repair and decommissioning
• Security of any applications on the terminals that can access card data
• Overall solution management, including incident response and the P2PE Instruction Manual
• Security of the decryption environment
• Cryptographic key generation, distribution, loading and management

Much of the key management content follows the same principles as the PCI PIN Security Requirements: split knowledge, dual control, secure key storage and strict device handling. The current version is P2PE v3.2, published in June 2025, and every new submission since 1 January 2026 must use it. The standard itself is in the PCI SSC document library. What a provider’s assessment involves, from scoping to the P2PE Report on Validation, is covered on our P2PE assessments page.

How does P2PE reduce PCI DSS scope?

For a card-present merchant, the benefits are practical:

• Reduced risk. Point-of-sale malware that scrapes card data from memory sees only encrypted data.
• Reduced scope. Tills, back-office systems and store networks that only handle encrypted data can generally be taken out of PCI DSS scope.
• A shorter SAQ. Eligible merchants complete SAQ P2PE instead of SAQ B-IP, C or D.

Less scope means less work every year, which is why P2PE is one of the most effective ways to control PCI compliance cost for retailers and hospitality businesses. Our free PCI compliance check shows which SAQ your current terminals point to.

What is SAQ P2PE and who is eligible?

SAQ P2PE is for merchants that take card payments only through hardware payment terminals included in a PCI-listed P2PE solution. The main eligibility conditions are that:

• All card-present payments go through terminals in the listed solution.
• You do not store card data electronically.
• You follow the solution’s P2PE Instruction Manual.
• Any other payment channels, such as online or phone payments keyed elsewhere, are handled separately with their own validation.

Our guide to which PCI SAQ you need compares SAQ P2PE with the other questionnaires.

What do merchants still need to do?

The P2PE Instruction Manual tells you what you must do. Typically:

• Receive devices only through the provider’s approved chain of custody
• Keep an inventory of terminals and their locations
• Inspect terminals regularly for tampering or substitution
• Train staff to recognise signs of tampering and report them
• Follow the provider’s procedures for returns, repairs and disposal
• Not store card data electronically

What if my encryption solution is not PCI-listed?

You cannot use SAQ P2PE. Any reduction in scope must be assessed by a QSA as part of your PCI DSS assessment, and your acquirer must agree to the approach. The PCI SSC has published guidance for assessors on non-listed encryption solutions. A QSA will look at where encryption happens, who controls the keys, whether you could ever access clear-text data and how devices are managed. That is often more work than adopting a listed solution, so compare the total cost. Our PCI compliance audit service covers this assessment.

How do I choose a P2PE solution?

• Is the solution PCI-listed, and is the listing current?
• Are the terminal models you want included in the listing?
• Is the P2PE Instruction Manual clear enough for store staff to follow?
• How are terminals delivered, replaced and returned, and how quickly?
• Does it cover all your card-present channels, such as counters, tables and unattended kiosks?
• How does it integrate with your till without bringing the till back into scope?
• What happens if a terminal is suspected of tampering?

Where do PCI PIN and key injection fit?

P2PE depends on secure cryptographic keys. If you are a solution provider, acquirer, processor or key injection facility, you are likely to be subject to the PCI PIN Security Requirements as well, assessed by a Qualified PIN Assessor. Our guide to what PCI PIN compliance means explains the requirements, and our PCI PIN security assessments cover the audit itself.

How Sovereign Secure can help

Sovereign Secure is a PCI SSC-listed P2PE Assessor for Europe and the USA, as well as a QSA company and Qualified PIN Assessor. For solution and component providers, including key injection facilities and decryption services, our P2PE assessments validate your solution or component for PCI SSC listing, and our PIN security work covers the key management that P2PE depends on. We assess P2PE solutions and components, not P2PE applications, which need a P2PE Application Assessor.

For merchants, our PCI DSS consultancy can confirm whether your set-up is eligible for SAQ P2PE and plan the move, and we assess scope where you use encryption that is not listed.