SAQ D Service Provider cost 2026: payment-adjacent SP pricing read

Who qualifies as a service provider for PCI

The PCI service provider definition is broader than many organisations realise. Service providers include any organisation that stores, processes, or transmits cardholder data on behalf of another entity, or any organisation that could impact the security of cardholder data even if it does not directly handle the data. Common SAQ D-SP organisations: payment gateways (Stripe at high volume, Adyen at high volume, smaller regional gateways), payment-page hosting services, fraud screening services that receive raw cardholder data for pattern matching, recurring billing service providers managing card-on-file, marketplace platforms operating sub-merchant funds flow, white-label payment processing platforms, payment terminal management services, and PCI compliance management platforms that handle merchant customer data.

Less obvious SAQ D-SP organisations include hosting providers whose customers run payment applications on the hosted infrastructure (where the hosting provider's security posture directly affects the customer's PCI scope), managed service providers operating customer payment environments, cloud service providers offering PCI-in-scope services (AWS, Azure, GCP all maintain their own AOCs that customers reference for PCI scope inheritance), and software-as-a-service products whose features touch cardholder data handling even tangentially.

The service provider designation is contractual: it is established through the merchant agreement between the SP and the merchant customer. SPs whose contracts explicitly disclaim handling of cardholder data may not require PCI compliance, though the PCI SSC's interpretation has tightened over time and acquirers increasingly require SP compliance evidence from any organisation whose service could plausibly affect cardholder data security. When in doubt, treat the obligation as applicable and complete SAQ D-SP rather than risk acquirer challenge.

SAQ D-SP cost decomposition

The full SAQ D-SP programme typically lands at $50,000 to $120,000 in year one and $35,000 to $80,000 in renewal years. The remediation line item is the most variable and depends heavily on the SP's pre-engagement security maturity.

The customer evidence provision workload

The single operational difference that distinguishes SAQ D-SP from SAQ D-Merchant is the customer evidence provision obligation. Service providers must provide their merchant customers with evidence that the SP's environment is PCI-compliant, in a form the customer can use to support their own attestation. The typical evidence package: a copy of the SP's Attestation of Compliance (AOC), a Responsibility Matrix mapping each in-scope PCI control to either the SP or the customer (so the customer knows which controls they still own), and a Customer Security Brief summarising the SP's security posture, breach history, and incident response capability.

For SPs with hundreds or thousands of merchant customers, the evidence provision workload is non-trivial. Best-practice SPs publish their AOC, Responsibility Matrix, and Security Brief on a customer-facing trust portal where customers can self-serve the documents. SPs without a trust portal end up handling individual customer requests through sales or compliance email channels, often at significant labour cost. The trust portal approach (often built on top of compliance automation platforms like Vanta Trust Center, Drata Trust Center, or Secureframe Trust Hub) is the typical $5,000 to $15,000 per year investment that pays back through reduced manual evidence-request handling.

The Responsibility Matrix in particular is a customer-facing document that captures considerable effort. For complex SP services with significant shared-responsibility surface area (hosting providers, cloud service providers, full-stack payment processing platforms), the Responsibility Matrix can run 50+ pages with detailed control-by-control mapping. Building the matrix once and keeping it current is materially cheaper than reactive responses to individual customer questions.

Three concrete SAQ D-SP scenarios

Scenario one. A B2B SaaS recurring billing platform processing 75,000 transactions per year on behalf of 50 merchant customers, single-region AWS deployment, card data tokenised through Stripe with the SaaS storing only tokens. Year-one total: $35,000 to $55,000. SAQ D-SP completion $12,000 to $18,000, external pen test $12,000, internal pen test $10,000, ASV scanning $2,000, customer evidence package preparation $3,000 to $5,000, year-one remediation $5,000 to $10,000. Renewal years drop to $25,000 to $40,000.

Scenario two. A fraud screening service processing 200,000 transactions per year across 300 merchant customers, multi-region cloud deployment, raw cardholder data received for pattern matching with retention limited to 30 days. Year-one total: $60,000 to $90,000. SAQ D-SP completion $15,000 to $20,000, pen tests $30,000 to $40,000 (multi-region scope), ASV scanning $3,000, customer trust portal $10,000 to $15,000 to manage the 300 customer evidence requests, year-one remediation $10,000 to $20,000.

Scenario three. A marketplace platform with 250,000 transactions per year handling sub-merchant funds flow, complex multi-tenant architecture, approaching the 300,000 transaction per brand threshold. Year-one total: $80,000 to $120,000. Full SAQ D-SP programme with planning workstream for Level 1 SP ROC transition in year 2 or 3. The platform should engage a QSA for SAQ D-SP completion (rather than a non-QSA consultant) so the same firm can carry forward to the Level 1 SP ROC engagement, saving 15 to 25 percent on the year-2 ROC versus a fresh QSA engagement.