Guide
PCI DSS Level 1 and the merchant levels, explained
PCI DSS Level 1 is the top merchant level, usually set by transaction volume. Your level decides whether you can self-assess or need a qualified assessor, so it drives cost more than almost anything else.
- We prepare, a QSA assesses
- Published price ranges
- Written estimate, no call
PCI DSS Level 1 and the other merchant levels
The card brands set levels, and your acquirer confirms yours. The thresholds below follow common Visa definitions; other brands may differ. See Visa merchant compliance guidance.
| Level | Typical threshold | Usual validation |
|---|---|---|
| 1 | Over 6 million transactions a year. | ROC by a QSA, plus quarterly scans. |
| 2 | 1 to 6 million. | SAQ, sometimes with assessor support. |
| 3 | 20,000 to 1 million e-commerce. | SAQ and scans. |
| 4 | Fewer than 20,000 e-commerce, or up to 1 million other. | SAQ, as the acquirer requires. |
What PCI DSS Level 1 merchants must do
Level 1 merchants usually need an annual Report on Compliance from a QSA, or from a qualified internal assessor. Also, they need quarterly ASV scans and an Attestation of Compliance. Therefore Level 1 costs far more than the levels below.
Which level are you?
Tick what applies. It narrows the likely level.
Your result appears here as you tick, so you can see what is still open.
Service provider levels compared with PCI DSS Level 1
Service providers have their own levels. Level 1 usually means over 300,000 transactions a year, and it requires a ROC from a QSA. Level 2 may self-assess, although customers often ask for more.
Why your level moves cost so much
Transaction volume can move the price between two and ten times, because it decides whether a QSA is required at all. So confirm your level with your acquirer in writing before planning.
Levels can also change as you grow. For example, crossing a threshold during the year can change what your next assessment requires.
Our role with PCI DSS Level 1
We prepare merchants at every level, and we coordinate with the QSA for Level 1 assessments. However, we are not a QSA, so the assessment itself is always independent.
PCI DSS Level 1 questions
Can a smaller merchant be treated as PCI DSS Level 1?
Yes. After a breach, or at the acquirer's discretion, a merchant can be moved up.
Who decides whether we are PCI DSS Level 1?
Your acquirer, based on card brand rules.
Does PCI DSS Level 1 always need a QSA?
Usually, although merchants may use a qualified internal assessor.
Do levels differ by card brand?
Thresholds vary slightly, so confirm with your acquirer.
Related guides
Confirm your level and plan the work
Tell us your volume and channels. We reply with a written readiness estimate for your level.
Get my written estimate