A PCI level is a classification that the card brands assign to merchants and service providers according to how many card transactions they handle each year. The level does not change which security requirements apply. Every organisation that handles card data must meet the whole of the PCI DSS. What the level determines is how compliance has to be demonstrated: by an independent audit or by self-assessment, and with what supporting evidence.
The levels are not defined by the PCI Security Standards Council, which writes the standard but leaves compliance programmes to the brands. Each of Visa, Mastercard, American Express, Discover and JCB publishes its own definitions. The Visa and Mastercard versions are closely aligned and are the ones usually meant when people speak of the four merchant levels.
Merchant levels
Under the Visa and Mastercard programmes, the levels are as follows.
| Level | Annual transactions with the brand | Usual validation |
|---|---|---|
| 1 | More than 6 million, across all channels | Annual on-site assessment and Report on Compliance; quarterly network scans |
| 2 | 1 million to 6 million | Annual Self-Assessment Questionnaire; quarterly network scans |
| 3 | 20,000 to 1 million e-commerce transactions | Annual Self-Assessment Questionnaire; quarterly network scans |
| 4 | Fewer than 20,000 e-commerce transactions, or up to 1 million in total | Self-Assessment Questionnaire and scans as required by the acquirer |
The count is made separately for each brand and usually covers all of a merchant's outlets and trading names together. An e-commerce transaction counts toward the lower thresholds of Levels 3 and 4 because online channels carry more risk of data theft. Other brands set different boundaries; American Express and JCB, for example, place merchants in their top level at lower volumes.
What each level must submit
A Level 1 merchant is assessed on site each year by a Qualified Security Assessor, an independent firm approved by the council, or by a trained internal auditor where the brand permits. The assessor tests the controls and writes a detailed Report on Compliance. Merchants at the lower levels complete the Self-Assessment Questionnaire that matches the way they accept cards; Mastercard requires Level 2 merchants that complete certain questionnaire types (A, A-EP or D) to have the assessment carried out by a qualified assessor or certified internal staff, while those using the other types may assess themselves.
At every level the outcome is recorded in an Attestation of Compliance signed by an officer of the business. Where systems face the internet, quarterly vulnerability scans by an Approved Scanning Vendor are also required. The documents go to the merchant's acquirer, which reports the compliance status of its larger merchants to the brands. The wider process is described under PCI compliance.
Service provider levels
Organisations that store, process or transmit card data on behalf of others, such as a payment service provider, gateway, hosting company or call centre, are classified separately, in two levels. Under the Visa and Mastercard programmes a Level 1 service provider handles more than 300,000 transactions a year and must have an annual on-site assessment with a Report on Compliance. A Level 2 service provider, below that volume, may use the service provider version of the self-assessment questionnaire.
The lower threshold reflects the concentration of risk: a breach at a provider can expose the card data of all its clients at once. A payment facilitator is treated as a service provider for its own systems and is also responsible for the compliance of each sub-merchant on its platform, most of which fall into merchant Level 4. Clients commonly insist on a Level 1 attestation from any provider that touches card data, whatever its volume, and the brands publish lists of validated providers.
How a level is assigned and changed
The acquirer determines a merchant's level from the transaction volumes it processes and tells the merchant what must be filed and when. A merchant using several acquirers should be assessed on its combined volume. Levels are reviewed periodically, so a growing business moves up as it crosses a threshold and must be ready for the heavier validation that follows.
Volume is not the only factor. A brand or acquirer may place any merchant in Level 1 at its discretion, and merchants that have suffered a breach resulting in the compromise of card data are normally escalated to Level 1 regardless of size, which brings the cost of an external assessment until the brand agrees to reclassify them.
Common misunderstandings
The numbering is easily misread. Level 1 is the most demanding tier and Level 4 the least, so a higher number does not indicate stronger security. Nor does a low level mean fewer obligations: a small online shop in Level 4 is bound by the same standard as a multinational retailer, and differs only in being allowed to certify itself. Small merchants account for a large share of card data breaches precisely because self-assessment is weaker assurance.
A level also says nothing about how much of the standard applies in practice. That depends on scope. A Level 1 merchant that has removed card data from its systems through tokenization and encrypted terminals may have a narrower assessment than a Level 3 merchant that stores card numbers itself. Level and scope are separate questions, and reducing scope is usually the more effective way to lower the burden. The council's umbrella term for the sector is explained under payment card industry.