How to Fill Out and Submit the NASTF D1 Form

The NASTF D1 form is the authorization document a Vehicle Security Professional files every time they pull restricted anti-theft data from a vehicle manufacturer. You complete it inside the Secure Data Release Model (SDRM) portal run by the National Automotive Service Task Force, and it records that you verified the customer’s identity and ownership before touching security codes or programming a key. There are four versions of the form, and the first thing to get right is picking the one that matches your job.

Which D1 Version to Use

The portal expects you to choose a form type that lines up with how the vehicle came to you. Picking the wrong version means your documentation won’t match what the system is looking for, and the submission gets flagged or rejected.

Customer D1. The everyday version. Use it when the vehicle owner is standing in front of you with a driver’s license and proof of ownership.¹
Contracting D1. For when another shop subcontracts you to do security work on their customer’s vehicle. You still need the owner’s driver’s license and proof of ownership, verified in person.²
Auction/Fleet D1. For auction sites, dealerships, rental fleets, and municipal garages where a company representative authorizes the work rather than an individual owner. In place of a driver’s license, you upload a signed invoice, purchase order, or work order from the hiring company.¹
Repossession/Recovery D1. For vehicles being repossessed. You upload the executed repossession order from the authorizing party and redact only the previous owner’s name and Social Security Number.¹

Every security-related OEM transaction requires a completed D1, no matter which type applies.² There is no exception for a quick job or a repeat customer.

Filling Out a Customer D1

This is the version most technicians touch daily. NASTF policy requires you to verify both the vehicle and the owner before performing any security operation, so gather everything before you open the portal.²

Vehicle Information

You enter the VIN, year, make, model, color, and mileage when available.³ License plate number, country, and state are collected when available. Read the VIN off the plate on the vehicle itself rather than copying it from paperwork. A mismatch between the VIN on the car, the VIN on the registration, and the VIN in the form will stop the request downstream.

Owner Identification

Verify the owner’s identity in person using a valid U.S. or Canadian driver’s license. This is where people trip up: state-issued ID cards, passports, foreign identification, and immigration documents are not accepted.¹ Only a driver’s license. Record the license number in the form and upload an image of the license to the portal.

Proof of Ownership

You also need a document showing the person actually owns the vehicle. NASTF accepts registration, insurance, bill of sale, or title certificate.³ Pick the verification type inside the form and upload the document. The name on the ownership document should match the name on the driver’s license. If a customer brings only a passport and a title, you cannot proceed. The driver’s license requirement does not bend.

Auction, Fleet, and Repossession Variants

Fleet and auction jobs skip individual-owner verification because the vehicle is controlled by a company. Instead, you upload a signed invoice, purchase order, or work order that includes the VIN, year, make, model, the vehicle’s location, and contact information for the person who requested the service.¹ That document stands in for the driver’s license and ownership proof.

Repossession jobs work the same way with different paperwork. Upload the executed repossession order from the lender or authorizing party. Redact the previous owner’s name and Social Security Number, and nothing else.¹ Vehicle details, lender information, and the authorization itself have to stay visible so NASTF can confirm legitimacy. Redacting too much is a common reason these get kicked back.

Submitting Through the SDRM Portal

Log into the SDRM Registry and select D1 Forms from the menu. Choose the form type, complete the ownership verification section with the vehicle and owner details, then upload your supporting documents.⁴ You can save a partially completed form and come back to it, which helps when you are still waiting on a document from the customer.

Finish by filling in the Service Performed section describing the work you did or plan to do. When you submit, the form links automatically to the proper OEM validation request.⁴ The manufacturer’s system then processes the request and returns the security data you asked for, whether that is a mechanical key code, an immobilizer PIN, or programming authorization. For most manufacturers this happens within minutes. If the system detects inconsistent data or a VIN flagged as stolen, the request is denied on the spot.

The Five-Day Completion Deadline

Any time you use your NASTF credentials to purchase a key code or perform immobilizer functions, a D1 has to be completed within five days of that transaction. If an unresolved D1 sits on your dashboard past five days, the system locks your account. You cannot complete any further transactions, for any customer, until the overdue documentation is in.⁵

The practical rule: file the D1 at the time of service whenever you can. If a customer leaves before you have a photo of their license, you have five days to chase them down. Miss that window and your shop stops. Check the “OEM Transactions – No Authorization Documents” area of your dashboard regularly to catch anything that slipped through.

Common Reasons D1 Forms Get Rejected

Most problems come from a short list of avoidable mistakes:

Uploading a passport or state ID card instead of a driver’s license. Only U.S. or Canadian driver’s licenses are accepted.¹
Names that don’t match between the driver’s license and the registration or title. If the customer recently changed their name, they need updated documents before you can proceed.
Using the wrong form type, like a Customer D1 for a fleet vehicle or a repossession. The system expects different documentation for each type.
Incomplete or wrong vehicle data. A single mistyped VIN character will stop the request. Check every character against the plate.
Overdue forms past the five-day window, which locks your entire account.⁵
Lapsed Commercial General Liability insurance or an expired certificate on file, which suspends portal access.

Repeated denials or patterns NASTF considers suspicious, such as an unusual volume of requests on vehicles flagged as stolen, can trigger a formal investigation. Consequences range from temporary suspension to permanent termination of your VSP registration. The D1 is a legal record of your verification, so intentional misrepresentation on one carries potential fraud exposure as well.

Recordkeeping and Audits

NASTF keeps a digital audit trail of every D1 submitted through the portal, and the organization’s Director of Operations randomly audits VSPs to confirm compliance with the Positive ID policy. That policy requires you to physically inspect the photo identification, the registration, and the VIN plate on every vehicle before performing security work, not just review the paperwork remotely. Failing to produce D1 forms during an audit can result in suspension or permanent termination of registry access.

Keep your own copies of every uploaded document for at least two years in a secure location. A D1 contains driver’s license numbers, VINs, and ownership records, so the file itself is the kind of thing someone could use to steal a car. Treat it accordingly.

1
NASTF Support Center. Choosing a D1 Form
2
NASTF Support Center. Contracting D1
3
NASTF Support Center. Customer D1 Form
4
NASTF Support Center. How to Submit a D1 Form
5
NASTF Support Center. D1 Form Overview