Free guide · PCI DSS v4.0.1

PCI compliance levels for merchants and service providers

PCI compliance levels are assigned by the individual payment brands — not by the PCI Security Standards Council — and they determine how you must validate, not which requirements apply. Level 1 merchants and Level 1 service providers validate through a QSA-led Report on Compliance; lower levels may be eligible for a Self-Assessment Questionnaire, subject to their acquirer.

Find your SAQ All guides

How levels are assigned

Each payment brand publishes its own thresholds, usually based on annual transaction volume per brand.

Visa and Mastercard place merchants above roughly six million transactions a year at Level 1; other brands and regions differ.

A brand can designate any merchant Level 1 regardless of volume, and a compromise commonly triggers reassignment.

Your acquirer tells you your level — do not infer it from a table alone.

What each level validates

Level 1 merchants: annual Report on Compliance by a QSA (or a qualified ISA where the brand permits), plus quarterly ASV scans.

Levels 2-4 merchants: typically the applicable SAQ and Attestation of Compliance, plus quarterly ASV scans where external systems are in scope.

Level 1 service providers: annual Report on Compliance; SAQ D for Service Providers is limited to Level 2.

Requirements do not shrink with level — validation effort does.

Common misunderstandings

Level is a validation category, not a security rating. A Level 4 merchant with stored card data can carry more risk than a Level 1 with none.

Levels are per brand: you can be a different level for different brands in the same year.

Being eligible to self-assess does not oblige your acquirer to accept a self-assessment.

Turn the reading into an answer

The free SAQ selector walks the official PCI SSC v4.0.1 decision flow, records every answer and re-derives the recommendation server-side with a confidence score.

Run the SAQ selector Talk to a QSA

Written by Haumaru Whānau QSAs. PCI DSS content paraphrased from PCI DSS v4.0.1 and PCI SSC published guidance; payment brand programmes are set by the brands and your acquirer. Independent summary; not endorsed by PCI SSC.