A PCI-validated P2PE solution encrypts card data at the terminal, before it ever touches your network, and that changes what your PCI self-assessment looks like. UK merchants using validated P2PE typically drop to SAQ P2PE, a shorter assessment than most alternatives. The immediate next step is checking the PCI SSC validated Solutions list to confirm your terminal model actually appears on it.
TL;DR:
- Using validated P2PE reduces PCI self-assessment from over 300 questions to about 33, provided all hardware and processes strictly adhere to PCI standards.
- Verification requires checking the solution’s listing, reassessment date, specific terminal model, and obtaining documentation like the PIM and chain-of-custody records.
- Maintaining validation involves confirming proper integration, checking tamper seals, logging devices, and training staff to recognize and respond to tampering or suspicious activity.
- An integrated payment and EPOS system simplifies compliance, reduces chain-of-custody risks, and ensures the deployment remains within the validated scope.
- UK merchants should prioritize validated P2PE solutions amid high card-present volumes to lower scope, streamline compliance, and reduce breach-related costs.
Table of Contents
- What is P2PE and how does it protect card data at the terminal?
- What compliance benefits does P2PE bring, and what’s still on you?
- How do you verify a P2PE solution before you buy?
- Deploying P2PE terminals without losing your compliance status
- How Switch-and-save supports secure terminal deployments
- Why UK merchants should prioritise validated P2PE now
- Get P2PE-ready terminals without the guesswork
- Sources
- FAQ
What is P2PE and how does it protect card data at the terminal?
P2PE stands for point-to-point encryption. Card data gets scrambled the instant it hits the terminal’s card reader, stays encrypted all the way to a secure decryption environment, and is never exposed in a form your systems, staff, or a network intruder could read.
That is the crucial difference from unvalidated E2EE (end-to-end encryption). Plenty of terminal vendors market “encrypted terminals” using E2EE, but unless the whole setup has been through PCI SSC’s formal validation process, it does not count as P2PE, and it will not earn you the compliance benefits below. A validated P2PE solution is not just a terminal. It is three things working together:
- PTS POI devices with SRED: the physical terminals, certified under PCI’s PIN Transaction Security standard with Secure Reading and Exchange of Data, so encryption happens inside tamper-resistant hardware.
- A secure decryption environment: typically hardware security modules (HSMs) run by the P2PE provider, assessed annually and never sitting on the merchant’s own network.
- Documented processes: key injection, chain of custody, and instructions bundled into a PIM (P2PE Instruction Manual) that you, the merchant, must actually follow.
Picture a customer tapping their card in a café. The data is encrypted before it leaves the reader, travels encrypted through the payment network, and only gets decrypted inside the provider’s HSM environment, far from the café’s own systems entirely. That is why ACI Worldwide’s guidance is blunt about it: a terminal on its own is not a P2PE solution. The provider’s key injection, seal handling, and custody processes matter just as much as the hardware.
What compliance benefits does P2PE bring, and what’s still on you?
The scope reduction is the headline benefit, and it is a big one. A merchant on the standard SAQ D questionnaire can face over 300 questions. Move to a PCI-validated P2PE solution and you typically qualify for SAQ P2PE instead, which cuts that down to roughly 33.
The compliance shift in numbers: merchants using validated P2PE can move from a 300+ question self-assessment (SAQ D) down to around 33 questions under SAQ P2PE, a reduction that saves real hours every year for whoever handles your compliance paperwork.
Eligibility for SAQ P2PE is not automatic, though. You have to meet all of these:
- Only PCI-listed P2PE hardware handles card data. No mixing in unlisted terminals.
- No customisation of the terminal beyond what the provider’s validation covers.
- No other channel processes card data electronically outside the validated solution (a separate e-commerce security plugins checkout that stores card numbers, for instance, breaks eligibility).
What stays your responsibility regardless: physical security of the terminals, following the PIM to the letter, and managing any third-party service providers (TPSPs) touching your payment flow. Insurers and underwriters tend to look favourably on validated P2PE deployments too, since the reduced scope translates into lower exposure if something does go wrong.
How do you verify a P2PE solution before you buy?
Vendor claims are cheap. Verification is what actually protects you, and it takes about fifteen minutes once you know what to check.
- Find the exact listing name. Search the PCI SSC validated Solutions register for the provider’s solution by name, not just the brand name on the terminal casing.
- Check the reassessment date. Every validated solution has an expiry point. If it is close, ask what happens to your eligibility if reassessment slips.
- Confirm your specific terminal model appears on that listing, along with the transaction types you need, contactless, chip and PIN, and manual key entry if you take phone orders.
- Request the PIM and chain-of-custody documentation directly from the provider before signing anything.
Pro Tip: Ask your acquirer whether they have dealt with this specific P2PE solution before. If your own risk profile is unusual, involving a Qualified P2PE Assessor (QSA) for a second opinion costs far less than discovering an eligibility gap after a breach.
Deploying P2PE terminals without losing your compliance status
Buying a validated terminal is the easy part. Keeping it validated in daily operation is where most merchants slip, usually without realising it.
Before deployment, confirm the exact model and your integration path with your EPOS provider. This matters more than it sounds: bolting on an unsupported POS integration, or letting a technician install an unapproved app on the terminal, is one of the most common causes of SAQ P2PE ineligibility. Once that happens, you are back to the full SAQ D questionnaire, with none of the scope relief you paid for.
When terminals arrive:
- Check tamper-evident seals against the provider’s documentation before anyone touches the device.
- Log every POI device in a register, including serial number and installation date.
- Train front-of-house staff to spot swapped cables, loose casing, or an unfamiliar terminal appearing on the counter.
Pro Tip: Run a five-minute tamper check as part of opening procedures, the same way you’d check a till float. It takes less time than making the first coffee and it is the single cheapest control against skimming devices.
If tampering is suspected, isolate the terminal immediately, stop taking payments on it, and contact your provider’s incident line before touching it further. For hospitality sites running multiple terminals across a floor, and retail chains with several tills, a consistent payment terminal setup makes staff training and device checks far more manageable than a patchwork of models bought over different years.
How Switch-and-save supports secure terminal deployments
An integrated payments bundle can pair PCI-compliant card terminals with cloud EPOS software designed for retail and hospitality, with features such as real-time sales tracking, inventory management, and remote access through a dashboard. That matters for P2PE eligibility specifically: an integration path that has already been tested between terminal and till system means less temptation to bolt on unsupported customisations later, which is exactly what puts SAQ P2PE eligibility at risk.
Fewer moving parts from separate suppliers also means fewer places for chain-of-custody gaps to creep in. If you are researching what a secure card payment terminal setup should look like before committing to a supplier, that is worth reading alongside your provider’s PIM. The provider’s team can provide information about device coverage and reassessment status for bundles under consideration.
Why UK merchants should prioritise validated P2PE now
Validated P2PE genuinely reduces scope and risk, but the compliance win only holds if deployment stays disciplined. One unapproved integration undoes the benefit entirely. Chain retailers and hospitality venues with high card-present volume have the most to gain. Weigh the modest cost premium against what a full SAQ D reassessment, or a breach, would actually cost you.
— Amir
Get P2PE-ready terminals without the guesswork
A single supplier offering both the terminal and the EPOS software reduces the need to coordinate with different companies when verifying compliance against the PIM. That is the practical advantage over piecing together a card machine from one vendor and till software from another: one point of contact, one integration that has already been tested, and no hidden fees buried in the contract.
The Hospitality EPOS Bundle costs £549 one-off, with AI-powered cloud software at £20 a month, built for cafés, restaurants and takeaways running frequent card-present transactions. Retail businesses wanting a combined terminal and EPOS package should look at the Integrated Payments Bundle, with its EPOS software subscription at £30 a month. Before choosing any supplier, ask them directly for their P2PE listing reference, which POI devices are covered, the reassessment date, and evidence of their chain-of-custody process. Request a free demo from Switch-and-save’s UK-based team to see how a P2PE-ready bundle fits your site.
Sources
Check the PCI SSC’s P2PE standards page and the SAQ P2PE document before signing with any provider, and cross-check terminal models against the SSC’s own database rather than a vendor’s word alone.
- Point-to-Point Encryption (P2PE) — PCI Security Standards Council
- Point-to-Point Encryption (P2PE) Guide — ACI Worldwide
FAQ
What is my P2PE solution?
Your P2PE solution is the specific, named combination of terminal, decryption environment, and provider processes that appears on the PCI SSC validated Solutions list, not just the brand of card machine on your counter. Ask your provider for the exact listing name and confirm your terminal model is covered under it.
Is PCI DSS mandatory in the UK?
PCI DSS is not a UK statute, but it is a contractual requirement imposed by card schemes and acquiring banks on every merchant that accepts card payments. Non-compliance can mean higher processing fees, loss of your merchant account, or liability for fraud losses if a breach occurs.
What are the major companies that offer card machine services in the UK?
UK merchants can source card terminals either as a standalone card machine or bundled with EPOS software from a single supplier. Switch-and-save offers both routes, including terminals bundled directly into integrated EPOS packages built for retail and hospitality.
Is a bank account number PCI?
A bank account number on its own is not classed as cardholder data under PCI DSS, which specifically covers primary account numbers (card numbers), expiry dates, cardholder names, and security codes. Bank account details still deserve careful handling, but they fall under different data protection rules rather than PCI DSS scope.
