PCI SAQ D for Merchants: Who Must Complete It and How to Reduce Its Scope

PCI SAQ D is the Self-Assessment Questionnaire for merchants that are allowed to self-assess but do not fit any shorter SAQ. If no other questionnaire’s eligibility criteria fit every transaction in a payment channel, SAQ D is what is left. It covers every PCI DSS v4.0.1 requirement that applies to merchants rather than a subset, and it is the only merchant SAQ that allows card data to be stored electronically.

This guide is for merchants: why you end up in SAQ D, what it asks you to prove, how the Attestation of Compliance (AOC) is signed, and how to move to a shorter questionnaire. If you are still working out which questionnaire applies, start with our guide to which PCI SAQ you need.

What is SAQ D?

PCI DSS SAQ D is the full standard laid out as a questionnaire. For PCI DSS v4.0.1 the PCI SSC publishes two documents, Self-Assessment Questionnaire D for Merchants and Self-Assessment Questionnaire D for Service Providers. Each includes its own Attestation of Compliance, and both are free from the PCI SSC SAQ document library.

For each requirement you record a response, such as In Place, In Place with CCW (a compensating control worksheet), Not Applicable or Not in Place, and explain any Not Applicable answer in the appendix provided. The customised approach introduced in v4.0 cannot be used in an SAQ, so SAQ D merchants follow the defined approach, with compensating controls where there is a legitimate constraint.

Which merchants need PCI SAQ D?

Any merchant that cannot meet every eligibility criterion of another SAQ. In practice, these are the situations that put merchants into SAQ D:

Direct post is often misclassified. On its own, a page where the customer’s browser sends card data straight to the payment provider is SAQ A-EP, not SAQ D. It becomes SAQ D when card data passes through your server on the way.

SAQ A vs SAQ D: what is the difference?

SAQ A covers only a small subset of PCI DSS requirements, while SAQ D for Merchants covers every requirement that applies to merchants across all 12 principal requirements. SAQ A is for card-not-present merchants that have handed every part of card capture to PCI DSS compliant providers; SAQ D is for merchants that fit no shorter SAQ.

Moving from SAQ D to SAQ A is the biggest reduction open to a card-not-present merchant, and the routes are set out below. The eligibility criteria in each questionnaire are the final word, so check them against every transaction before you switch.

How many questions are in SAQ D?

SAQ D for Merchants has no short list. It asks about every PCI DSS v4.0.1 requirement that applies to merchants, across all 12 principal requirements and their sub-requirements, plus Appendix A2 if you still use SSL or early TLS on card-present terminal connections. That makes it many times longer than SAQ A, which covers a small subset for fully outsourced card-not-present payments. A more useful measure is what you must evidence in each area:

Segmentation does not take you out of SAQ D, but it limits how many systems those requirements apply to. Our PCI DSS scoping guide shows how to draw and evidence that boundary.

How do I get out of SAQ D?

By changing how card data reaches you so that a shorter SAQ’s eligibility criteria fit every transaction. There are five main routes, and they are often combined.

Stop storing card numbers. Find and delete stored card data, then replace it with your payment provider’s tokens for repeat billing and refunds. Until stored card data is gone, no other route works. Our guide to PCI tokenisation explains what tokens take out of scope and what stays in.

Fully outsource online and phone payments (SAQ A). If every element of your online payment page comes from a PCI DSS compliant provider through a redirect or iframe, and phone payments are also fully outsourced, SAQ A may apply. Since January 2025, SAQ A also requires you to confirm your site is not susceptible to attacks from scripts that could affect your e-commerce systems. Our guide to PCI SAQ A and SAQ A-EP explains the criteria. Before you switch, our guide to choosing a PCI compliant payment gateway lists what to ask the provider for.

Let the provider capture card data on your page (SAQ A-EP). If you need control of the checkout design, a direct post or provider JavaScript integration keeps card data off your servers. SAQ A-EP still includes website security, payment page script controls and penetration testing, but it is far shorter than SAQ D.

Use PCI-listed P2PE terminals (SAQ P2PE). For card-present payments, a point-to-point encryption solution listed by the PCI SSC means your terminals encrypt card data in a way your systems cannot decrypt. Our guide to point-to-point encryption explains how to check a solution is listed.

Isolate what is left (SAQ B-IP or C-VT). Standalone IP terminals separated from other systems, or a virtual terminal used on an isolated computer, can each fit a shorter SAQ if every criterion is met.

Agree the change with your acquirer before you validate, because the acquirer decides which SAQ it accepts.

Does SAQ D need a QSA or penetration testing?

You do not need a QSA to complete SAQ D, but you do need testing. SAQ D is a self-assessment, although some acquirers and card brand programmes require a QSA or Internal Security Assessor for larger merchants. It includes Requirement 11.4, which our PCI penetration testing is scoped to meet: internal and external penetration tests at least every 12 months and after significant change, by a qualified tester with organisational independence, plus segmentation tests if you use segmentation. It also includes quarterly internal vulnerability scans and quarterly ASV scans by a PCI SSC Approved Scanning Vendor, which we deliver through our PCI SSC Approved Scanning Vendor partner.

How do you complete SAQ D and sign the AOC?

1. Confirm the format with your acquirer: one SAQ D for everything, or one SAQ per channel.
2. Document your scope: data flows, the cardholder data environment and every connected system.
3. Answer each requirement with evidence, completing a compensating control worksheet where needed and explaining every Not Applicable answer.
4. Gather supporting reports, including passing ASV scans and penetration test results.
5. Sign the AOC. An executive officer of the merchant signs the attestation, and the AOC records any QSA or ISA involvement. If any requirement is Not in Place, the status is non-compliant, and the AOC’s action plan section is completed if your acquirer asks for it.
6. Submit to your acquirer before its deadline and keep the evidence for next year. A missing or late validation is the usual reason for a monthly PCI non-compliance fee on your merchant statement.

What about SAQ D for service providers?

Service providers that are allowed to self-assess use SAQ D for Service Providers, the only SAQ available to them. It adds the requirements marked for service providers only, such as extra testing frequencies and customer responsibility statements, and Appendix A1 for multi-tenant providers. Larger service providers validate with a Report on Compliance instead, and some customers ask for one regardless. Our PCI service provider compliance page covers levels, validation and what customers expect.

Why work with Sovereign Secure?

Sovereign Secure is a PCI SSC-approved Qualified Security Assessor (QSA) company, Qualified PIN Assessor (QPA) and Card Production Security Assessor (CPSA), and a member of the PCI SSC Global Executive Assessor Roundtable (GEAR) for 2026 to 2028. We are ISO 27001 certified, have been a UK company since 2012, carry out PCI penetration and segmentation testing, and deliver quarterly external scans through our PCI SSC Approved Scanning Vendor partner.

We can help you reduce scope before you validate, or assess you when your acquirer asks for a QSA. Where we both advise and assess, the two pieces of work are kept separate, as the PCI SSC expects of a QSA company, and consultancy never changes how the assessment is carried out.

Stuck in SAQ D?

Start with our free PCI compliance check to see which SAQ your set-up points to. Then tell us how you take card payments and where card data goes, and our PCI DSS consultancy team will show you whether a shorter SAQ is realistic and what it would take. Contact us or call +44 161 523 5276 for a fixed quote.