Point-to-Point Encryption (P2PE) is a special case of application-level encryption, where encryption is applied selectively within a business application—in this case a retail point-of-sale (POS) terminal. If the point to point encryption process is implemented correctly, with account data being encrypted within an approved, secure cryptographic device (SCD) such as a POS terminal, and not decrypted at all within the merchant environment, there is potential for the merchant to be taken almost completely out of scope for PCI DSS. Strict controls for protection of and access to decryption keys must be in place; in fact, the current guidance from the PCI Security Standards Council requires the use of hardware security modules (HSMs) with an appropriate security rating to protect access to those keys. Acquirers and other players in the payments chain have already begun to market value-added services that exploit P2PE to reduce compliance costs for their merchants. From a PCI DSS perspective, any system that has the capacity to decrypt account data comes into scope immediately, so the ability to insulate merchants by protecting keys within HSMs can have significant benefits for all concerned.


More than: https://www.entrust.com/digital-security/hsm/solutions/use-case/payments/point-to-point-encryption