What is the difference between SAQ A and SAQ D?
SAQ A is the short PCI DSS questionnaire for card-not-present merchants that fully outsource card data handling to a compliant provider, with 27 requirements since 2025. SAQ D is the full questionnaire for everyone else, around 250 requirements, including merchants whose servers receive card numbers and most service providers.
In detail
SAQ A is the short PCI DSS questionnaire for card-not-present merchants that fully outsource card data handling to a compliant provider, with 27 requirements since 2025. SAQ D is the full questionnaire for everyone else, around 250 requirements, including merchants whose servers receive card numbers and most service providers.
SAQ A vs SAQ A-EP vs SAQ D: which one applies to which integration?
SAQ A is for card-not-present merchants that “completely outsource all account data functions to PCI DSS validated and compliant third parties.” In practice: a full redirect to a hosted payment page, or a provider-hosted iframe. SAQ D applies to “all merchants not included in descriptions for the above SAQ types.” If the merchant’s server receives a card number and forwards it by API, even without storing it, it is SAQ D. In between, SAQ A-EP covers e-commerce merchants whose own page controls how customers, or their account data, are redirected.
Integration choice is a compliance decision
Offering only a redirect or a fully provider-served iframe keeps every merchant in SAQ A. Offering direct API access moves the merchant to SAQ D and the operator into a longer conversation with its acquirer.
More detail in our #PayDecoding episode on PCI DSS SAQ.