PCI Compliance Level
A PCI compliance level is the tier the card schemes assign to a merchant or service provider by its annual card volume — Level 1 above six million transactions, down to Level 4 — which decides how it must prove PCI DSS compliance: an annual audit by a qualified assessor at Level 1, a self-assessment and quarterly scans below. The level sets the cost, and products are designed to keep card data out of scope.
- Also known as
- PCI DSS merchant level, PCI level, Merchant compliance level
- Used at
- every merchant accepting cards and every service provider that stores, processes or transmits card data; the acquirer enforces the level on its merchants, the schemes on service providers
- Binding
- contractually — through the acquirer's merchant agreement and the schemes' rules; non-compliance brings fines passed down by the acquirer and, after a breach, liability for the losses
- Typical merchant levels (Visa's, which Mastercard broadly mirrors)
- Level 1 over 6 million transactions a year or any merchant that has been breached; Level 2 1–6 million; Level 3 20,000–1 million e-commerce; Level 4 fewer than 20,000 e-commerce or up to 1 million of any channel
- Typical validation
- Level 1 — an annual Report on Compliance by a Qualified Security Assessor and quarterly network scans by an Approved Scanning Vendor; Levels 2–4 — an annual Self-Assessment Questionnaire (the SAQ variant depends on how card data is handled) and quarterly scans; service providers have their own two levels, with Level 1 above 300,000 transactions
- Parties
- the merchant, its acquirer (which sets and polices the level), the schemes, the assessors and scanning vendors, and the PCI Security Standards Council that writes the standard
How PCI compliance levels work in practice
A merchant's acquirer tells it which level it is at and what it must submit. A Level 4 online retailer that uses a hosted payment page — the card number is entered on the payment provider's page, never touching the merchant's systems — completes the shortest questionnaire (SAQ A), a few dozen questions, and its quarterly scans are trivial because no card data is in scope. A Level 1 merchant that captures card data on its own site and stores it undergoes a full audit against all twelve requirements and their several hundred controls, at a cost of hundreds of thousands a year in assessor fees and much more in engineering.
The economics push everyone toward scope reduction. Tokenisation replaces stored card numbers with tokens; hosted pages and iframes keep the number off the merchant's servers; point-to-point encryption keeps it off the point-of-sale system. A merchant that never sees a card number has almost nothing in scope, whatever its level, and a payments company's product is often sold on exactly that: "we take you out of PCI scope". Payment facilitators and processors carry the burden instead, as Level 1 service providers with annual audits.
For a buyer of a payments company, the PCI status is a diligence item: the level, the last Report on Compliance, the open findings, and — most telling — whether the company has ever had a breach, which moves any merchant to Level 1 permanently.
Example
A SaaS platform for restaurants becomes a payment facilitator and moves from a Level 4 merchant with an SAQ A to a Level 1 service provider: its first Report on Compliance takes nine months and €400,000 of assessor fees, engineering and tooling, against 340 controls; it fails twelve on the first pass (logging retention, key management, segmentation testing) and remediates. Its 6,000 sub-merchants stay at Level 4 with SAQ A because the platform's hosted checkout keeps card data off their systems — which the platform's sales deck turns into a feature. Two years later a prospective acquirer's technology diligence reads the ROC and the quarterly scan reports and cuts its planned security assessment from six weeks to two.
Common mistakes
- A merchant self-assessing at the wrong SAQ because it does not know where card data flows through its systems. - Treating the level as the risk; a Level 4 merchant that stores card numbers in a spreadsheet is a breach waiting, whatever its questionnaire says. - Scope reduction on paper — a hosted page with a script on the merchant's site that reads the card number anyway. - Missing quarterly scans and discovering the acquirer's fine on the next statement. - Buyers of a payments company reading the PCI certificate and not the findings behind it.