PCI Compliance Levels for Merchants and Service Providers

PCI compliance levels decide how you prove you meet PCI DSS, not whether you have to. The card brands set them, not the PCI Security Standards Council (PCI SSC). Visa has three merchant levels and Mastercard four, and both have two service provider levels. Level 1 merchants (more than 6 million card transactions a year) and Level 1 service providers (more than 300,000) need an annual Report on Compliance (ROC), normally from a Qualified Security Assessor (QSA). Most other businesses self-assess with a Self-Assessment Questionnaire (SAQ).

This guide is written by Sovereign Secure, a PCI SSC-approved QSA company, for UK merchants and service providers.

What are the PCI compliance levels for merchants?

PCI merchant levels are set by each card brand, based on how many transactions you process with that brand in a year. The four levels of PCI compliance that most guides describe, Level 1 to Level 4, are Mastercard’s merchant levels, which it still uses. Visa publishes three merchant levels, and acquirers can still use a Level 4 for their smallest merchants. These PCI DSS compliance levels change how you prove compliance, not what PCI DSS requires of you. Levels 1 and 2 use the same volume thresholds; below 1 million transactions the two tables differ:

PCI merchant levels for Visa and Mastercard. Sources: Visa’s PCI DSS compliance programme and Mastercard’s Site Data Protection (SDP) programme. Acquirers can still use a Level 4 for smaller merchants, so confirm your level with your acquirer. Brands and acquirers can also set stricter rules, so treat your acquirer’s instructions as final.

Three details catch businesses out:

• Each brand is counted separately. 4 million Visa and 2.5 million Mastercard transactions make you Level 2 with both brands, not Level 1. Mastercard counts Mastercard and Maestro together.
• Debit and prepaid cards count. Visa Debit and Debit Mastercard payments count towards your level just as credit cards do.
• Mastercard’s Level 3 is about e-commerce only. Phone and mail-order payments count towards the 1 million and 6 million thresholds but not Mastercard’s Level 3 band, so a business that takes most payments by phone can be Mastercard Level 4 despite high volumes. Under Visa’s table, the same business is Level 3. Our guide to taking card payments over the phone covers how to handle that channel safely.

Service provider levels at a glance

Service providers (businesses that store, process or transmit card data for others) have two levels, split at 300,000 transactions a year: Level 1 needs a ROC from a QSA and Level 2 completes SAQ D for Service Providers, both with quarterly ASV scans and an AOC for Service Providers. Some provider types, such as VisaNet processors and Mastercard Third Party Processors and merchant payment gateways, are Level 1 whatever their volume; our guide to PCI DSS service provider levels sets out the thresholds and what each level submits.

How do you validate PCI compliance at each level?

You validate by producing a set of documents each year. Which ones depends on your level:

The brands differ in the detail. Mastercard’s SDP rules, for example, say Level 2 merchants completing SAQ A, SAQ A-EP or SAQ D must also engage a QSA or a PCI SSC-certified Internal Security Assessor (ISA) for compliance validation, and any Level 2 merchant may choose a ROC by a QSA or ISA instead. Check this with your acquirer before you start your SAQ.

Our guide to the PCI DSS Report on Compliance explains what a ROC contains. Where you need scans, we manage quarterly PCI ASV scans delivered through our PCI SSC Approved Scanning Vendor partner.

How do I find my PCI merchant level?

Count 12 months of transactions for each card brand, split by channel, and compare each count with the thresholds above. Then confirm the result with your acquirer, because it assigns your level.

1. Get the numbers. Pull 12 months of transactions by brand from acquirer statements or gateway reports.
2. Split by channel. Separate e-commerce from face-to-face, phone and mail order.
3. Count your whole company. Visa bases your level on the corporate entity’s total Visa volume in one country or with one acquirer, so trading names owned by the same company are added together. Volume from independently owned franchisees or licensees may be excluded if the corporate entity does not process it.
4. Compare brand by brand. Where your levels differ, expect to validate at the highest one.
5. Confirm with your acquirer. It can place you higher than the thresholds suggest.

Some illustrative examples:

Who decides your PCI level?

• Merchants: your acquirer (Barclaycard, Worldpay, Lloyds Cardnet or Elavon, for example), using the brands’ thresholds.
• Service providers: the card brands and, in practice, your customers’ contracts.
• Payment platforms: if you take payments through Stripe, Square, SumUp or similar, the platform tells you what, if anything, to validate.
• Not PCI SSC. The Council maintains PCI DSS but does not assign levels or enforce compliance.

For why PCI DSS is a contractual rather than a legal requirement, see our guide to PCI compliance in the UK.

Level 1 in brief

Level 1 is the top validation level: merchants with more than 6 million transactions a year with one brand, service providers with more than 300,000, and any business a brand moves up after a data compromise. Each needs a ROC and AOC every year, normally from a PCI QSA carrying out a PCI compliance audit, and a first ROC usually starts with readiness work from a PCI DSS consultant. Our guide to PCI Level 1 explains what Level 1 validation involves and how to prepare for it.

Level 1 service providers also give customers an AOC for Service Providers and, like Level 2 providers, meet the requirements that apply only to service providers, such as six-monthly scope confirmation and segmentation testing. Our page on PCI compliance service provider assessments sets these out.

What do Level 2, 3 and 4 merchants need to do?

Self-assessing does not make compliance optional. Levels 2 to 4 must meet every PCI DSS requirement that applies to how they take payments; they prove it with an SAQ instead of a ROC.

• Choose the right SAQ. Your SAQ type depends on how you take payments, not on your level. Our guide to which SAQ applies to you walks through each type.
• Non-compliance fees: many UK acquirers add a monthly PCI non-compliance fee until you validate, and it stops once your acquirer accepts your validation.

PCI Level 2

Level 2 merchants process 1 million to 6 million transactions a year with one brand, across all channels. Expect closer scrutiny than at Levels 3 and 4: acquirers may ask for QSA involvement, and Mastercard requires a QSA or ISA to be engaged if you complete SAQ A, A-EP or D. Mastercard’s rules also let any Level 2 merchant choose a ROC by a QSA or ISA instead of an SAQ.

PCI Level 3

Level 3 is defined by e-commerce volume. Under Mastercard’s rules it covers merchants with more than 20,000 and up to 1 million combined Mastercard and Maestro e-commerce transactions a year; under Visa’s table it covers every merchant below Level 2. Most UK acquirers ask Level 3 merchants to complete the SAQ each year through an online portal and to upload ASV scan results where the SAQ requires them; our guide to Worldpay PCI compliance shows how one acquirer’s portal works.

PCI Level 4

Level 4 covers the smallest merchants: under Mastercard’s rules, those with 20,000 or fewer e-commerce transactions and up to 1 million transactions in total. Your acquirer sets how you validate, usually an annual SAQ through its portal plus ASV scans where your SAQ requires them. Small does not mean exempt: every requirement in your SAQ still applies.

Does your PCI level change which requirements apply?

No. Your level decides how you prove compliance. Your scope decides which requirements you have to meet. Confusing the two wastes effort in both directions.

The levels also sit outside the standard itself. PCI DSS v4.0.1 did not change the thresholds, because the brands set them in their own programme rules. The standard and every SAQ are free to download from the PCI SSC document library.

What happens when your PCI level changes?

Levels are reviewed against your recent transaction history, so they move as your business does.

• Growth. If you cross a threshold, your acquirer will tell you your new level and when you must validate at it. Get that date in writing and start readiness work early.
• Mergers and acquisitions. Combined volumes can push a group up a level, especially where the businesses share card systems. Re-check level and scope before integration, not after.
• A data compromise. Brands can move a merchant to Level 1 after an account data compromise, whatever its volume. Mastercard’s rules say so explicitly.
• Falling volumes. You may drop a level at the next review, but customers and acquirers can still ask for a ROC.

Does your PCI compliance level affect cost?

Yes, but scope matters more. Level 1 costs more because it needs a QSA assessment every year. Within any level, cost is driven by the payment channels, locations and systems in scope, and by how much remediation you need. One published UK cost guide we reviewed in September 2026 puts the range at £500 to over £75,000. Our PCI compliance cost page explains the drivers and how to get a fixed quote.

What about Amex, Discover, JCB and UnionPay?

The level structures above are Visa’s and Mastercard’s. American Express, Discover, JCB and UnionPay run their own compliance programmes, with their own rules on who must validate and how. In the UK, American Express often contracts with merchants directly, so it may ask you to validate separately. If you accept these cards, check each brand’s current rules.

Why Sovereign Secure

• A PCI SSC-approved assessor. Sovereign Secure Ltd (company no. 08334453, est. 2012, Accrington, Lancashire) is a Qualified Security Assessor (QSA), Qualified PIN Assessor (QPA) and Card Production Security Assessor (CPSA) company. You can check us on the PCI SSC Qualified Security Assessor list.
• Part of the assessor community. We are a member of the PCI SSC Global Executive Assessor Roundtable (GEAR) for 2026 to 2028.
• Every level covered. ROCs for Level 1, SAQ and readiness support for Levels 2 to 4, penetration testing, and ASV scans through our PCI SSC Approved Scanning Vendor partner.
• ISO 27001 certified, with clients including Accor, Fiserv, Ticketmaster, Cashplus and Kuwait Finance House.

See our full range of PCI DSS compliance services.

Not sure which level you are?

Send us your last 12 months of transactions by card brand and channel, and tell us how you take payments. We will tell you your likely level and whether an SAQ or a ROC applies, and send a fixed quote for any help you need. Contact our PCI team or call +44 161 523 5276.