PCI compliance level is the tier a card brand assigns to a merchant or service provider based on annual card transaction volume, deciding how the business must prove compliance with PCI DSS; the security requirements stay identical across levels. Under Visa's scale, which most acquirers follow, Level 1 covers more than 6 million transactions a year or any breached merchant and requires an annual Report on Compliance by a Qualified Security Assessor, plus quarterly external scans. Levels 2 to 4 usually complete a Self-Assessment Questionnaire. Volume is counted per brand, not in total. Service providers above 300,000 Visa transactions are Level 1. In acquisitions, buyers check the current Attestation of Compliance and whether combined volume crosses the Level 1 threshold.
What are PCI compliance levels for merchants
Visa's merchant levels are the reference most acquirers use, and Mastercard's are broadly aligned:
- Level 1: more than 6 million Visa transactions a year across all channels, or any merchant that has suffered a breach.
- Level 2: 1 million to 6 million transactions a year.
- Level 3: 20,000 to 1 million e-commerce transactions a year.
- Level 4: fewer than 20,000 e-commerce transactions, or up to 1 million transactions in total.
PCI DSS merchant levels explained by validation
A Level 1 merchant needs an annual Report on Compliance (ROC), prepared by a Qualified Security Assessor or by a certified internal auditor and signed by an officer of the company, plus an Attestation of Compliance and quarterly external vulnerability scans by an Approved Scanning Vendor.
Levels 2 to 4 usually complete a Self-Assessment Questionnaire (SAQ). The SAQ type depends on how cards are accepted: SAQ A for fully outsourced e-commerce pages, SAQ B for standalone dial-out terminals, SAQ P2PE for validated encrypted terminals, and SAQ D for anyone storing or processing card data themselves. Some acquirers require Level 2 merchants to use a QSA anyway.
How is PCI compliance level determined
The acquirer assigns the level, counting transactions per card brand, not in total. A retailer with 4 million Visa and 2.5 million Mastercard transactions is Level 2 for each brand, not Level 1 overall. A brand can move any merchant up after a data breach or if it considers the risk higher than volume suggests. Volume is normally counted across all of a legal entity's outlets and channels.
Service provider levels
Processors, gateways, payment facilitators and hosting firms that touch card data are ranked separately. Visa sets the line at 300,000 transactions a year: above it a service provider is Level 1 and needs a QSA-led ROC; below it Level 2 can self-assess with SAQ D for service providers. Many merchants' contracts demand Level 1 providers regardless of size.
Why the level matters in a deal
For a buyer of a PSP or gateway, the level shows who has examined the business. A Level 1 service provider ROC means an external assessor has tested controls within the last year; a self-assessed SAQ D means management attested to them. Buyers ask for the current AOC, its expiry date, and whether the acquisition will push combined volume over the Level 1 threshold, which brings a full audit in the next cycle.