PCI DSS levels categorize businesses based on transaction volume to determine their compliance requirements for protecting credit card data. The Payment Card Industry Data Security Standard (PCI DSS) establishes four merchant levels and two service provider levels, each with specific validation requirements.
The PCI Security Standards Council assigns levels based on annual transaction volume and transaction method. Lower levels have stricter requirements, requiring more frequent audits and assessments. The council updates these requirements regularly to address evolving security threats.
Merchant levels determine compliance requirements for businesses processing credit card payments. Service provider levels apply to companies that store, process, or transmit cardholder data on behalf of other businesses.
| Level | Annual Visa Transactions | Validation Requirements |
|---|---|---|
| Merchant Level 1 | Over 6 million | Annual Report on Compliance (ROC) by Qualified Security Assessor (QSA) or Internal Auditor, quarterly network scans |
| Merchant Level 2 | 1 million to 6 million | Annual Self-Assessment Questionnaire (SAQ), quarterly network scans |
| Merchant Level 3 | 20,000 to 1 million | Annual SAQ, quarterly network scans |
| Merchant Level 4 | Less than 20,000 | Annual SAQ, quarterly network scans |
| Service Provider Level 1 | Over 300,000 transactions annually | Annual ROC by QSA, quarterly network scans |
| Service Provider Level 2 | Less than 300,000 transactions annually | Annual SAQ, quarterly network scans |
Many businesses confuse PCI DSS levels with service provider levels. Merchant levels apply to businesses processing payments, while service provider levels apply to companies processing data on behalf of others., some believe PCI DSS applies only to online transactions, but it covers all payment channels, including in-store and mail-order transactions.
A mid-sized retail chain processing 1.5 million annual transactions falls under Merchant Level 2. To comply, they complete an annual SAQ and undergo quarterly network scans. They also implement security measures like firewalls, encryption, and access controls to protect cardholder data.
I worked with a client migrating from Level 2 to Level 1 due to increased transaction volume. We helped them transition ROCs and implemented additional security measures to meet the stricter requirements.
Businesses often overlook that PCI DSS levels apply to all payment brands, not just Visa. While the table above shows Visa transaction thresholds, similar requirements exist for Mastercard, American Express, and Discover.
Understanding PCI DSS levels helps businesses determine their compliance requirements and avoid costly penalties. By following the appropriate validation processes and implementing strong security measures, companies can protect cardholder data and maintain customer trust.