Knowledge center

What is SAQ D?

SAQ D is the broad route for merchants that do not meet a narrower SAQ and the route for service providers eligible for self-assessment. Merchant and service-provider documents are separate.

Why it matters

It is not a penalty and does not itself mean non-compliance.

What to confirm

Merchant or service-provider role
Why a narrower route does not apply
In-scope systems, storage, channels and providers

Official PCI DSS documentation · PCI DSS v4.0.1 · reviewed 2026-07-31

This content is informational and is not legal advice. The applicable route and validation method depend on the operation and requesting party.

Identify your likely route Back to all questions