PCI Compliance Levels

If your business processes fewer than 20,000 eCommerce transactions annually or up to 1 million transactions across all sales channels, you’ll be in Merchant Level 4. This is the most common merchant level, and most small businesses fall under it. Note that if your business is eCommerce-only or has a significant number of online transactions in addition to traditional retail sales, you might easily find yourself at a higher merchant risk level. You’ll want to coordinate closely with your processor to ensure you’re both in agreement on which merchant level applies to your business.

Merchant Level 4 compliance requirements include:

• Complete and file an annual Self-Assessment Questionnaire (SAQ) issued by the PCI Security Standards Council (PCI SSC). This can often be completed online on your processor’s website.
• Complete and obtain evidence of passing a vulnerability scan with a PCI SSC-approved scanning vendor. Your merchant account provider should accomplish this step for you. Note that this requirement does not apply to all merchant types.
• Complete and file the appropriate Attestation of Compliance in its entirety. This is located within the SAQ.

That’s it! As long as you keep your SAQ updated every year and your provider accomplishes the required security scans, you should have no problem maintaining PCI compliance. You can assure your customers that it’s safe to entrust you with their credit card information, and your risk of sustaining a data breach will be minimized.

For more information on Merchant Level 4 compliance requirements, please see our quick guide to PCI compliance.

If your business processes between 20,000 and 1 million eCommerce credit/debit card transactions per year, you’ll be in the Level 3 category for PCI compliance. This is basically a separate category for larger eCommerce businesses. Retail-only businesses will be in Levels 1, 2, or 4, depending on their annual card transaction volume.

Compliance requirements for Level 3 merchants include:

• Complete and file an annual Self-Assessment Questionnaire (SAQ) issued by the PCI Security Standards Council (PCI SSC).
• Complete and obtain evidence of passing a quarterly vulnerability scan with a PCI SSC-approved scanning vendor. This requirement applies to all merchant types.
• Complete and file the appropriate Attestation of Compliance in its entirety. This is located within the SAQ.

As you can see, the only additional requirement for Level 3 merchants is that the vulnerability scans must be accomplished quarterly rather than annually.

Merchants processing between 1 million and 6 million credit/debit card transactions per year will fall under the Level 2 PCI compliance requirements. This includes transactions from both retail (including mail order/telephone order) and eCommerce sales channels. Compliance requirements are essentially the same as for Level 3 and include:

• Complete and file an annual Self-Assessment Questionnaire (SAQ) issued by the PCI Security Standards Council (PCI SSC).
• Complete and obtain evidence of passing a quarterly vulnerability scan with a PCI SSC-approved scanning vendor.
• Complete and file the appropriate Attestation of Compliance in its entirety.

Level 1 is the highest level of PCI compliance and applies to merchants who process over 6 million credit/debit transactions per year across all sales channels. Global merchants can also be identified as Level 1 by the Security Standards Council, even if their US transactions are less than 6 million per year. It’s also very important to note that any merchant who has suffered an actual data breach that resulted in data compromise can be placed in Level 1 by the SSC.

If you’re in Level 1, you’ll have to meet the following requirements to maintain PCI compliance:

• Complete and file an annual Report on Compliance (ROC) issued by the PCI Security Standards Council (PCI SSC). This requirement must be accomplished by a Qualified Security Assessor (QSA) or an internal auditor if an officer of the company signs the ROC. Completing the ROC requires on-site inspections and is much more time-consuming (and expensive) than merely filling out an online questionnaire.
• Complete and obtain evidence of passing a quarterly vulnerability scan with a PCI SSC-approved scanning vendor.
• Complete and file the appropriate Attestation of Compliance in its entirety.

Most large businesses that fall into Level 1 will have adequate resources to meet these requirements. However, smaller businesses placed in Level 1 following a data breach may find it very challenging to meet the additional compliance requirements. This is yet another reason to take PCI compliance seriously and avoid being placed in the Level 1 “penalty box.”