The level shapes what validation and evidence you may owe your acquirer. It never removes your duty to protect cardholder data.
This guide covers the four merchant levels, how transaction volume and payment setup affect them, and how to confirm your level with your acquiring bank or processor.
Key Takeaways
- Levels follow annual card transaction counts, but each card brand and your acquirer set the final rules.
- Level 1 demands the most rigorous validation; lower levels typically use an SAQ.
- Payment channels and hosted services change your scope and SAQ.
- Don't assume you're Level 4, or that outsourcing ends your responsibilities.
- Recheck your level whenever volume, channels, locations, or POS systems change.
What Is PCI Compliance and Why Do Levels Matter?
What PCI compliance means
PCI compliance means meeting the applicable Payment Card Industry Data Security Standard (PCI DSS) requirements for the systems, processes, people, and providers that store, process, or transmit card data. It also covers anything that could affect that data's security. The current version is v4.0.1, published in June 2024, per the PCI SSC announcement.
PCI compliance is an ongoing responsibility rather than a one-time certificate. Controls include restricted access, secure configurations, vulnerability management, monitoring, and protection of stored data.
Why PCI compliance levels matter
Levels mainly decide how you prove compliance. The paperwork can include:
- A Self-Assessment Questionnaire (SAQ)
- An Attestation of Compliance (AOC)
- A Report on Compliance (ROC)
- Approved Scanning Vendor (ASV) scan results
A lower level does not mean lower security expectations. Your requirements still depend on your payment environment and scope.
Card brands and acquirers decide validation and reporting methods, not the PCI SSC. Their rules can be stricter than any general description, so verify them with whoever manages your merchant account.
Types of PCI Compliance Levels
The four levels are broad bands based mainly on annual card transaction counts (not sales dollars). Thresholds differ by brand, channel, and acquirer agreement. Never treat one brand's numbers as universal.
| Brand | Level 1 | Level 2 | Level 3 | Level 4 |
|---|---|---|---|---|
| Visa (U.S. page) | Over 6M transactions | 1M to 6M | Under 1M e-commerce, as published | Not listed |
| Mastercard | Over 6M | 1M to 6M | 20,000 to 1M e-commerce | All others |
| American Express | 2.5M or more | 50,000 to under 2.5M | 10,000 to under 50,000 | Under 10,000 |
| Discover | 6M or more | 1M to 6M | All other merchants | Not published |
JCB skips numbered levels: merchants at 1M or more transactions need an annual on-site review, and smaller ones self-assess.
Level 1
Level 1 is the highest-volume tier: over 6M transactions for Visa and Mastercard. Amex starts at 2.5M. Common validation includes:
- Annual assessment by a Qualified Security Assessor (QSA)
- Report on Compliance (ROC) and Attestation of Compliance (AOC)
- Recurring external scans when your acquirer requires them
Level 2
Level 2 sits below Level 1, roughly 1M to 6M transactions for Visa, Mastercard, and Discover. Expect:
- An annual Self-Assessment Questionnaire (SAQ) and an AOC
- Quarterly Approved Scanning Vendor (ASV) scans where applicable
- Extra QSA or Internal Security Assessor (ISA) validation for Mastercard if the SAQ is A, A-EP, or D
Your acquirer may also ask for a ROC.
Level 3
Level 3 is tied to e-commerce volume. Mastercard sets it at 20,000 to 1M e-commerce transactions. That fits a specialty retailer with a growing online store or several digital channels.
Expect an annual SAQ and AOC, plus ASV scans. Your SAQ depends on your payment flow: fully outsourced, embedded payment fields, or direct card handling.
Level 4
Level 4 covers smaller, lower-volume merchants. Definitions vary: Mastercard calls it "all other merchants," Amex uses under 10,000 transactions, and Visa's U.S. page doesn't list it.
Many Level 4 merchants complete an SAQ, and some need an AOC or scans. Mastercard does not require Level 4 validation reported to it, but you still must comply. Obligations aren't identical across acquirers.
Merchant levels versus service-provider levels
Processors, gateways, and hosting providers have their own levels. Visa's Level 1 provider tier starts above 300,000 transactions, a different scale from merchant thresholds. A provider's Level 1 status doesn't set your level.
Confirm your role and your contract with the brand or acquirer before choosing a validation path.
How to Determine Which PCI Compliance Level Applies to You
Estimating annual sales isn't enough. Review volume, card brands, channels, systems, and processor instructions together.
Identify annual card transaction volume by channel
Pull the last 12 months of totals from your processor statements. Count each brand separately. Split in-person, e-commerce, mobile, and mail or phone orders where the brand requires it.
Use your acquirer's current definitions. Record the period you used so the classification can be reproduced during validation.
Map how payment data moves through the business
Trace where card data is entered, transmitted, processed, or stored:
- Registers and card terminals
- E-commerce platforms
- Mobile devices at markets or events
- Phone-order tools
- Back-office systems and third-party integrations
This review sets your scope and SAQ, even if low volume puts you in a lower level.
Review outsourced and hosted payment arrangements
Hosted checkout, tokenization, and point-to-point encryption can shrink your scope. They don't erase your duties. Per PCI SSC guidance, you still need to confirm each provider's compliance, keep written acknowledgments, monitor status annually, and understand who owns which controls.
Pick only the SAQ that matches your real payment flow. SAQ A fits fully outsourced card-not-present sales. SAQ P2PE and SPoC require validated, listed solutions.
Confirm the classification with the acquirer or processor
Ask in writing for your merchant level, required SAQ, AOC or ROC obligations, scan requirements, and brand-specific rules. Do this especially if you take several card brands, run multiple locations, mix online and in-store sales, or recently switched processors.
Apply the process to a specialty retail POS environment
Consider a garden center. The register takes cards all year, the online store sells seasonal plants, and staff run mobile checkout at weekend events. Three payment flows can mean three scopes. A farm market or feed and seed store often has the same mix of counter, mobile, and online sales.
AMS Retail Solutions offers NCR Voyix Counterpoint as a single-source POS for one store or many, with support for card payments and selling from anywhere. Evaluate it alongside your processor and payment integrations. Choosing or installing a POS doesn't make you PCI compliant.
Plan for ongoing validation and business growth
Keep your evidence organized:
- The current SAQ and AOC
- ASV scan results
- Security policies
- Network and payment-flow diagrams
- Remediation records
Reassess after e-commerce growth, new locations, new payment channels, processor changes, system integrations, or changes in how card data is handled. PCI DSS requires scope confirmation at least every 12 months and after significant changes, and external scans at least every three months, per the SAQ D for Merchants.
What to Check Before Finalizing a PCI Compliance Level
- Don't pick a level from revenue, headcount, or the assumption that small means Level 4.
- Don't assume a processor, hosted checkout, tokenization, or integrated POS removes every obligation. Verify what stays with you.
- Confirm your SAQ matches your actual payment environment, and that AOC, ROC, scan, and penetration-testing requirements are covered.
- Revisit your classification after material changes to volume, stores, e-commerce, terminals, vendors, or card-data flows.
Conclusion
Levels determine how you validate PCI DSS responsibilities. They don't replace real security controls.
Your correct level depends on current volume, channels, cardholder data scope, brand rules, and acquirer requirements. Specialty retailers should:
- Document their payment flows
- Confirm requirements with their processor
- Reassess as the business and POS environment change
Frequently Asked Questions
What are PCI compliance levels based on?
Mainly annual card transaction counts. Card-brand rules, channels, your role, and acquirer requirements decide the final classification.
How do I know which PCI compliance level applies to my business?
Review your annual transaction totals, map your payment channels and cardholder data environment, then confirm your level and required documents with your processor or acquirer.
Does every small business fall under PCI Level 4?
No. Most small merchants are Level 4, but transaction volume and processor rules decide your level, not business size. Confirm thresholds with your card brands and processor.
Do I need PCI compliance if I outsource payment processing?
Yes. Outsourcing may reduce your scope, but you must still validate your own processes, manage provider relationships, and meet acquirer requirements.
What validation documents does each PCI compliance level require?
Depending on level, you may need an SAQ, AOC, ROC, QSA assessment, or ASV scans. The mix depends on your level, environment, card brand, and acquirer.
Can my PCI compliance level change as my business grows?
Yes. Changes in volume, e-commerce activity, locations, channels, systems, or processors can change your level or validation duties.
