Which PCI DSS merchant and service provider level applies to you?
Suppose your acquirer or a large customer has just asked for your PCI DSS level. The payment brands, not the PCI SSC, set merchant and service provider levels by transaction volume, and the level determines how compliance is validated, not which requirements apply. PCI DSS applies to every merchant regardless of size, so a smaller level means a lighter validation path, not a shorter list of obligations. Before you answer the question, confirm which brand's program you are being measured against, because each brand runs its own rules.
The exact level and submission depend on the brand and the acquirer, and they differ by payment channel. For example, under Visa's rules (illustrative of how brands differ, not a template for other brands), a Level 1 merchant processes more than 6 million Visa transactions a year across all channels or is designated Level 1 by Visa, and submits an annual Report on Compliance by a Qualified Security Assessor plus quarterly ASV scans. A Level 4 merchant processes fewer than 20,000 Visa e-commerce transactions a year, and its validation requirements are set by its acquirer. Count transactions per brand and per channel, since card-present and e-commerce volumes can fall into different levels.
Your action is to ask your acquirer in writing which level it assigns you for each brand you accept, which validation document it expects (a ROC, an SAQ type, or an Attestation of Compliance with quarterly scans), and by what date it needs the submission. Ask whether an escalation can occur after a data compromise, since Visa may move a merchant to a higher level in that case. Keep the answer on file, because it defines the evidence set your team and any outside assessor must produce each year.
Visa merchant levels and what each must submit
This table compares Visa merchant Levels 1 to 4 by transaction threshold, the validation document each level submits, and the quarterly scanning and attestation duties that apply. Read each row against your annual Visa transaction count across all channels, and note that Level 4 validation requirements are set by your acquirer.
| Visa merchant level | Transaction threshold | What must be submitted | Notes |
|---|---|---|---|
| Level 1 | Over 6 million Visa transactions a year across all channels, or designated Level 1 by Visa | Annual Report on Compliance by a QSA, quarterly ASV scans, and an Attestation of Compliance | Visa may escalate a merchant after a data compromise, and Level 1 criteria met in any region apply globally |
| Level 2 | 1 million to 6 million Visa transactions a year across all channels | Annual SAQ, quarterly ASV scans, and an Attestation of Compliance | Confirm the correct SAQ type with your acquirer before you start |
| Level 3 | 20,000 to 1 million Visa e-commerce transactions a year | Annual SAQ, quarterly ASV scans, and an Attestation of Compliance | Threshold counts e-commerce transactions only |
| Level 4 | Fewer than 20,000 Visa e-commerce transactions a year, or up to 1 million Visa transactions in other channels | Annual SAQ recommended, with validation requirements set by your acquirer | Ask your acquirer whether scanning and attestation are required for your channel mix |
| Escalation | Applies to any level after a data compromise | Visa may move the merchant to a higher validation level | Ask your acquirer how escalation would change your submission and timing |
| Global Level 1 | Level 1 criteria met in any region | Treated as Level 1 in every region | Relevant to merchants operating across several Visa regions |
How service provider levels 1 and 2 differ
The main difference between Visa service provider levels 1 and 2 is volume and the validation method that follows from it. A Level 1 service provider is a VisaNet processor or a service provider that stores, processes or transmits more than 300,000 Visa transactions a year. Level 1 must submit an annual Report on Compliance (ROC) completed by a Qualified Security Assessor, and Visa lists it on its list of compliant service providers. A Level 2 service provider handles fewer than 300,000 transactions a year and submits an annual SAQ D for Service Providers, quarterly ASV scans and an Attestation of Compliance (AOC). Level 2 providers may also choose to validate as Level 1 if they want to appear on that list.
The threshold counts transactions, but the choice of validation path is also a commercial decision. A provider that sits near 300,000 transactions should count its Visa volume carefully and confirm with Visa how it is measured, because a change in volume can change the required report. A provider that opts into Level 1 validation for the listing takes on the ROC cost and timeline even though its volume would allow the lighter route. Ask your acquirer or Visa contact to confirm which level applies to your specific services before you commit to a QSA or a self-assessment.
Service provider levels are set by each payment brand, so a provider that serves merchants on several networks must confirm the level and listing rules with every brand it works with. Visa's thresholds do not determine what Mastercard or another brand requires. Build a register that records each brand, the level assigned, the validation document due, the submission date and the contact who confirmed the requirement. Customers will ask for this evidence, and the register also shows your own assessor which brand rules apply.
How to confirm your level and validation requirements
This sequence turns a vague sense of "we are probably Level 2" into a written answer from your acquirer that states your assigned level, the required submission and any conditions that could change it. The result is a dated record you can hand to a QSA or internal assessor as evidence of how your validation path was set.
Gather annual transaction counts by brand and channel
Your finance or payments team pulls twelve months of transaction data and splits it by card brand, by channel (e-commerce, card-present, mail or telephone order, and other channels) and by region. Keep Visa separate from other brands, because the thresholds are brand-specific. The output is a signed spreadsheet showing the annual totals used for each brand, with the report source and date recorded.
Check the current level criteria for each brand
Compare your counts against the level thresholds each payment brand publishes for merchants and service providers. For Visa, the current criteria are on Visa's compliance validation page, which lists Levels 1 to 4 for merchants and Levels 1 and 2 for service providers. Note the criteria version and the date you checked it, since the brands can update their programs. The output is a one-page comparison that shows which level each brand's counts appear to fall into.
Confirm whether any brand designation applies
Review whether any brand has designated you at a specific level regardless of volume, and whether a data compromise or a Level 1 status in another region could raise your level. Visa treats a merchant that meets Level 1 criteria in any region as a global Level 1 and may escalate a merchant after a data compromise. Ask your team and your legal or incident contacts to confirm whether any such event has occurred. The output is a short written statement listing any designations or escalations, or confirming there are none.
Request your assigned level and submission in writing
Send a written request to your acquirer asking for your assigned level for each card brand, the validation documents required (ROC, SAQ type or AOC), the scanning requirements, and the due date and submission portal. Ask whether any brand you accept requires a different level than your acquirer applies. Your acquirer, not the PCI SSC, sets this for your account, and the brand's program governs. The output is the acquirer's written reply, which should name each brand and the required submission.
Check the requirements for outsourced or service provider roles
If you use a payment service provider, gateway or processor, confirm whether the provider's level affects what you must submit, and whether you need their current Attestation of Compliance for your responsibility matrix. If you act as a service provider to others, confirm the service provider level criteria separately, since Visa uses processing volume and whether you are a VisaNet processor. The output is a note listing each third party relied on and the document you hold from them.
Reconcile the answers and resolve conflicts
Compare the acquirer's written answer against your calculated level and against each brand's criteria. Where they differ, go back to the acquirer in writing and ask which figure they used and why. Do not rely on a verbal answer or a prior year's level without rechecking the criteria. The output is a reconciled record showing the agreed level for each brand and any open questions with dates.
File the confirmation as assessor evidence
Store the transaction counts, the criteria check, the acquirer's letter and the reconciliation together in your compliance repository, with an owner and a review date. Give a copy to the QSA or internal assessor before fieldwork starts so the validation path is agreed early. Repeat the sequence whenever your volumes, channels, acquirers or payment flows change, and at each annual cycle. The output is a versioned evidence file that records the level and validation requirements as confirmed on a stated date.
What a merchant and a service provider each need to decide
A merchant's first decision is which validation path applies to it, and that answer comes from its acquirer or the payment brand, not from the merchant's own preference or from the PCI SSC. Visa's levels use annual transaction volume to set the path: Level 1 merchants submit a ROC by a Qualified Security Assessor (QSA), while Level 2 and Level 3 merchants submit an SAQ, and Level 4 validation requirements are set by the acquirer. Within a given path, the merchant still decides who prepares the evidence and who reviews it, so ask the acquirer which SAQ type and whether an internal or QSA review is expected.
- Owner of the decision: the acquirer or payment brand sets the level and the required validation, so confirm in writing before work starts.
- Evidence preparation: the merchant's own team, a consultant or an implementation partner can prepare systems and records, but the merchant owns its controls.
- Who signs: a Level 1 merchant's ROC and Attestation of Compliance (AOC) come from a QSA, while an SAQ and its AOC are signed by the merchant itself.
- Internal or QSA review: where the acquirer accepts an SAQ without QSA involvement, the merchant may still choose a QSA to review it, which adds cost.
- Escalation risk: Visa may escalate a merchant that suffers a data compromise to a higher validation level, so the initial choice affects the next cycle.
Before committing, check your current transaction count, your acquirer's written requirement and which SAQ type your payment flow qualifies for.
A service provider that stores, processes or transmits card data for others is classified by annual transaction volume and by its role in the VisaNet flow. Visa's Level 1 service provider category covers VisaNet processors and service providers that handle more than 300,000 transactions a year, and these providers submit an annual ROC completed by a QSA. Level 1 status also places the provider on Visa's list of compliant service providers, which customers and acquirers use to check validation.
- Owner of the decision: the service provider owns its validation strategy, but the payment brand defines the level criteria and listing rules.
- Evidence preparation: the provider's security, operations and engineering teams gather evidence for multi-tenant controls, responsibility matrices and service-provider-only requirements.
- Who signs: a QSA issues the ROC, and the provider signs the AOC that accompanies it.
- Listing: Level 1 providers are included on Visa's list, which is the practical reason many providers validate at this level.
- Cost driver: a ROC requires QSA time across the full scope, so the scope of shared platforms and customer-facing services affects the effort.
Confirm your annual transaction count against the brand's current criteria and ask your QSA which requirements apply to your service offering.
A service provider below the Level 1 threshold, which Visa sets at fewer than 300,000 transactions a year, submits an annual SAQ D for Service Providers, quarterly ASV scans and an AOC. The SAQ D is a self-assessment, so the provider's own authorized officer signs the AOC after the provider has tested each applicable requirement. Level 2 providers have a choice: they may validate as Level 1 in order to be listed on Visa's compliant service provider list, which changes the report they submit and who signs it.
- Owner of the decision: the provider decides whether to stay at Level 2 or upgrade to Level 1 for listing, and the brand's rules define what each choice requires.
- Evidence preparation: the provider's internal team or an outside consultant prepares the SAQ D answers, network diagrams and ASV scan records.
- Who signs: the provider signs the SAQ D and AOC, since no QSA is required at this level unless the provider chooses a ROC.
- Customer expectations: customers may still ask for a ROC or listing, so review contracts for validation commitments.
- Quarterly activity: ASV scans must be run by an Approved Scanning Vendor every quarter, and those records form part of the evidence.
Before choosing, ask customers and acquirers whether a listing is required, since that requirement often decides the path.
What changes a level or how it is validated
A merchant or service provider does not pick its level. The card brands assign it from transaction counts, channel mix, past incidents and regional designations, and the acquirer often sets the validation steps. The five drivers below are the factors most likely to move an entity between levels, and each one has a specific place where you can confirm it.
Channel mix across e-commerce and card-present
Visa counts transactions differently by channel. Level 3 and Level 4 thresholds look only at e-commerce volume, while Level 1 and Level 2 count all channels together. A retailer with a modest online business but heavy card-present sales can therefore land in a higher level than its e-commerce count suggests. Pull twelve months of transaction data split by channel, then confirm the split with your acquirer before you assume a level.
Transaction counts per brand
Each brand counts its own card transactions, so a merchant that accepts cards from several networks may sit at different levels with each one. The count that matters is the number of transactions processed for that brand in a year. Confirm the annual count for each brand you accept, and ask your acquirer which brand's figure governs your validation when the levels differ.
Data compromise and escalation
Visa may move a merchant that suffers a data compromise to a higher validation level, regardless of its transaction count. Escalation changes the required report from an SAQ to a ROC and can add quarterly scanning obligations. Ask your acquirer what incident response obligations apply and how a suspected compromise would be reported, since the decision is the brand's, not yours.
Regional Level 1 designation carrying globally
A merchant that meets Level 1 criteria in any region is treated as a global Level 1 by Visa. An entity with a small domestic operation but a large regional volume in another country can therefore face Level 1 obligations everywhere it accepts Visa. Total your Visa volume across all regions and countries, not only the market where your main contract sits, before you confirm the level.
Acquirer-set requirements for Level 4
For Visa Level 4 merchants, the annual SAQ is recommended, and the acquirer sets the actual validation requirements. Two merchants with identical volumes can therefore receive different instructions and deadlines. Request the acquirer's written validation requirements, including the report type, scanning obligations and submission date, and keep them with your compliance records so the requirement is traceable at your next review.
Why the level does not change which PCI DSS requirements apply
The level changes how you prove compliance, not what you must protect. PCI DSS applies to any entity that stores, processes or transmits cardholder data or sensitive authentication data, and to entities that could affect the security of that data. The PCI Security Standards Council states that PCI DSS applies to all merchants regardless of size or transaction volume. A merchant assigned Level 4 by its acquirer still needs firewall controls, access restrictions, logging, malware protection and the other requirements that apply to its environment. The level decides whether the merchant submits an SAQ or a ROC, whether it needs quarterly ASV scans, and whether the acquirer asks for an Attestation of Compliance. It does not remove any requirement that applies to the systems in scope.
The same logic applies to service providers. A Level 2 service provider that handles fewer transactions than a Level 1 provider still must protect the cardholder data environment it operates, support its customers' own PCI DSS assessments and meet the requirements for service providers. Validating as Level 1 changes the submission and listing, not the controls. Because the payment brands set the levels and validation rules, a lower level can look like a lighter obligation, but the technical work stays the same. Organizations should avoid building a controls program only to the level of paperwork they expect to submit.
Two practical checks follow. First, confirm your level and validation method in writing with your acquirer or the relevant payment brand, since each brand runs its own program. Second, confirm the scope that drives your requirements, because a smaller validation path only helps if the systems in scope are correctly defined and segmented. Scoping and the SAQ choice are covered in their own sections, but a wrong scope decision can leave a Level 4 merchant with unmet requirements that its SAQ then attests to. Ask your acquirer to confirm which SAQ type applies to your payment channel before you budget for controls.
Common questions about PCI DSS levels
Who sets my PCI DSS merchant level?
The payment brands set it, not the PCI Security Standards Council. Each brand, such as Visa, decides which merchants must validate compliance, how they validate, and how often. Your level is based mainly on the number of transactions you process through that brand in a year, and the brand can also designate you to a higher level. Because each brand runs its own compliance program, confirm your level and validation requirements with your acquirer, which passes the brand rules to you. If you accept more than one card brand, check each brand's rules separately, since your level can differ between them.
Does PCI DSS still apply if I am a Level 4 merchant?
Yes. PCI DSS applies to all merchants regardless of size or transaction volume. The level changes how compliance is validated, not which requirements apply. A Level 4 merchant still has to protect cardholder data under the same twelve principal requirements as a Level 1 merchant. In practice, Level 4 merchants usually complete a Self-Assessment Questionnaire, and the acquirer sets the exact validation requirements, which can include an annual questionnaire, quarterly external scans, or both. Ask your acquirer what it requires before you assume a lighter standard applies.
Do I need a QSA for a Level 1 merchant assessment?
Yes, for Visa Level 1 merchants. Visa requires an annual Report on Compliance completed by a Qualified Security Assessor, plus quarterly scans by an Approved Scanning Vendor and an Attestation of Compliance. The QSA must be independent of the work it assesses. A Level 1 merchant can use its own internal team for some activities, but the Report on Compliance itself has to come from a QSA. Other brands set their own Level 1 rules, so confirm the requirement with your acquirer before you select an assessor.
Can a consultant complete the SAQ for us?
A consultant can help you prepare the SAQ, but the merchant owns the answers and signs the Attestation of Compliance. The consultant can explain each question, gather evidence, map your systems and close gaps. The merchant's authorized officer must then confirm that every answer is accurate. A consultant who also performs the assessment for the same merchant may face independence limits, so check the rules before you engage one. Ask the acquirer whether it accepts an SAQ prepared with outside help, and confirm which person in your organization must sign.
What drives the effort of meeting my level?
Effort depends on the validation path your level requires, the size of your cardholder data environment, and how much of your payment flow you control. Key drivers include whether you need a full Report on Compliance or a shorter questionnaire, how many systems and connected networks are in scope, how many payment channels you run, and whether your payment pages are hosted by a third party. The recurring work includes quarterly external scans, annual testing and evidence collection. Ask any provider for a quote built from your written scope, and ask the acquirer which activities it expects every year. No public cost figure exists, so compare quotes against the same scope.
How long does it take to move to a different level?
The timing depends on the brand and your acquirer, so there is no fixed period to quote. Levels are usually set from the transaction volume reported for a year, so a change typically follows the next reporting cycle. Visa can also escalate a merchant to a higher level after a data compromise, which can happen with little notice. Ask your acquirer how it determines levels, when the change takes effect, and what evidence you must provide for the new level. If you expect your volume to grow, plan your validation path early so the new requirements are in place before the change.
How DeployOpen prepares systems and evidence for your level
DeployOpen works on the systems and evidence behind your validation path, whether that is a ROC or an SAQ. We plan, implement and document self-hosted open-source platforms inside your own infrastructure, and we prepare the evidence your QSA or acquirer will ask for. We do not issue reports, attestations or certificates; independent assessors do.
How we scope
- Confirm your level and validation path with your acquirer or payment brand before work starts.
- Agree in writing which systems, connections and third parties fall inside the cardholder data environment.
- Receive a fixed-scope proposal listing deliverables, timelines and the evidence each system will produce.
How we build
- Implement and harden self-hosted platforms in your cloud accounts, data centers or air-gapped networks.
- Configure logging, access control and network restrictions so each requirement has a verifiable technical control.
- Run the vulnerability scans and penetration tests your validation level requires, through independent testers where needed.
How we hand over
- Deliver configuration records, network and data-flow diagrams, and documented procedures mapped to each requirement.
- Provide evidence packs showing quarterly and annual activities so your assessor can sample them directly.
- Walk your team through the handover so your staff can operate and explain the controls to assessors.
How we support
- Offer ongoing support, upgrades and continuous testing as a retainer after the initial engagement ends.
- Keep evidence current as systems change, so each annual validation starts from an accurate baseline.
- Support your team when your level changes or your acquirer requests a different validation method.
