---
title: "PCI Compliance Level"
url: "https://mahouse.world/glossary/pci-compliance-level"
type: "glossary term"
topic: "Compliance"
author: "Ihor Vlasov"
reviewed: "2026-09-20"
published: "2026-08-10"
---

# PCI Compliance Level

A PCI compliance level is the tier the card schemes assign to a merchant or service provider by its annual card volume — Level 1 above six million transactions, down to Level 4 — which decides how it must prove PCI DSS compliance: an annual audit by a qualified assessor at Level 1, a self-assessment and quarterly scans below. The level sets the cost, and products are designed to keep card data out of scope.

**Also known as:** PCI DSS merchant level, PCI level, Merchant compliance level

## Key facts

- **Used at:** every merchant accepting cards and every service provider that stores, processes or transmits card data; the acquirer enforces the level on its merchants, the schemes on service providers
- **Binding:** contractually — through the acquirer's merchant agreement and the schemes' rules; non-compliance brings fines passed down by the acquirer and, after a breach, liability for the losses
- **Typical merchant levels (Visa's, which Mastercard broadly mirrors):** Level 1 over 6 million transactions a year or any merchant that has been breached; Level 2 1–6 million; Level 3 20,000–1 million e-commerce; Level 4 fewer than 20,000 e-commerce or up to 1 million of any channel
- **Typical validation:** Level 1 — an annual Report on Compliance by a Qualified Security Assessor and quarterly network scans by an Approved Scanning Vendor; Levels 2–4 — an annual Self-Assessment Questionnaire (the SAQ variant depends on how card data is handled) and quarterly scans; service providers have their own two levels, with Level 1 above 300,000 transactions
- **Parties:** the merchant, its acquirer (which sets and polices the level), the schemes, the assessors and scanning vendors, and the PCI Security Standards Council that writes the standard

## How PCI compliance levels work in practice

A merchant's acquirer tells it which level it is at and what it must submit. A Level 4 online retailer that uses a hosted payment page — the card number is entered on the payment provider's page, never touching the merchant's systems — completes the shortest questionnaire (SAQ A), a few dozen questions, and its quarterly scans are trivial because no card data is in scope. A Level 1 merchant that captures card data on its own site and stores it undergoes a full audit against all twelve requirements and their several hundred controls, at a cost of hundreds of thousands a year in assessor fees and much more in engineering.

The economics push everyone toward scope reduction. Tokenisation replaces stored card numbers with tokens; hosted pages and iframes keep the number off the merchant's servers; point-to-point encryption keeps it off the point-of-sale system. A merchant that never sees a card number has almost nothing in scope, whatever its level, and a payments company's product is often sold on exactly that: "we take you out of PCI scope". Payment facilitators and processors carry the burden instead, as Level 1 service providers with annual audits.

For a buyer of a payments company, the PCI status is a diligence item: the level, the last Report on Compliance, the open findings, and — most telling — whether the company has ever had a breach, which moves any merchant to Level 1 permanently.

## Example

A SaaS platform for restaurants becomes a payment facilitator and moves from a Level 4 merchant with an SAQ A to a Level 1 service provider: its first Report on Compliance takes nine months and €400,000 of assessor fees, engineering and tooling, against 340 controls; it fails twelve on the first pass (logging retention, key management, segmentation testing) and remediates. Its 6,000 sub-merchants stay at Level 4 with SAQ A because the platform's hosted checkout keeps card data off their systems — which the platform's sales deck turns into a feature. Two years later a prospective acquirer's technology diligence reads the ROC and the quarterly scan reports and cuts its planned security assessment from six weeks to two.

## Common mistakes

- A merchant self-assessing at the wrong SAQ because it does not know where card data flows through its systems.
- Treating the level as the risk; a Level 4 merchant that stores card numbers in a spreadsheet is a breach waiting, whatever its questionnaire says.
- Scope reduction on paper — a hosted page with a script on the merchant's site that reads the card number anyway.
- Missing quarterly scans and discovering the acquirer's fine on the next statement.
- Buyers of a payments company reading the PCI certificate and not the findings behind it.

## Related terms

- [PCI DSS](https://mahouse.world/glossary/pci-dss.md)
- [Payment Facilitator](https://mahouse.world/glossary/payment-facilitator.md)
- [Acquirer](https://mahouse.world/glossary/acquirer.md)
- [Tokenization](https://mahouse.world/glossary/tokenization.md)
- [Hosted Payment Page](https://mahouse.world/glossary/hosted-payment-page.md)
- [Point-to-Point Encryption](https://mahouse.world/glossary/point-to-point-encryption.md)

— Ihor Vlasov, M&A FinTech Expert. Last reviewed 2026-09-20. https://mahouse.world/authors/ihor-vlasov