PCI Level 1: Requirements for Level 1 Merchants and Service Providers

PCI Level 1, often written PCI DSS Level 1, is the top validation level for merchants that take card payments. Under Visa’s and Mastercard’s rules, you are Level 1 if you process more than 6 million transactions a year with that brand across all channels, or if a brand places you there. Level 1 PCI compliance means validating every year with a Report on Compliance (ROC) and an Attestation of Compliance (AOC), signed by a Qualified Security Assessor (QSA) or, where the brand and your acquirer allow, an internal assessor. The PCI DSS v4.0.1 requirements are the same at every level; what changes at Level 1 is how you prove you meet them.

For every merchant and service provider level side by side, see our guide to PCI compliance levels.

What is PCI Level 1?

PCI Level 1 is the level at which the card brands require a full assessment, documented in a ROC, instead of a self-assessment. The PCI Security Standards Council writes PCI DSS but does not set levels: each card brand defines its own, and your acquirer applies them. These are the Level 1 rules on the brands’ compliance programme pages in October 2026:

Sources: Visa’s Account Information Security programme and Mastercard’s Site Data Protection programme. Your acquirer can set stricter requirements.

American Express runs its own programme, with a Level 1 threshold of 2.5 million American Express transactions a year under its Data Security Operating Policy. If you accept Amex, check its current rules separately.

The different levels of PCI follow one pattern: each card brand sets its own merchant levels from annual transaction counts, with Level 1 at the top and the lower levels usually validating with a Self-Assessment Questionnaire. Our guide to PCI compliance levels compares every merchant and service provider level side by side.

How many transactions is PCI Level 1?

More than 6 million a year with a single brand. The counting rules decide whether you cross it:

• Each brand is counted on its own. 4 million Visa and 3 million Mastercard transactions is not Level 1.
• Visa counts credit, debit and prepaid for the corporate entity’s total volume in one country or with one acquirer. Volume from independently owned franchisees or licensees may be excluded if the corporate entity does not process it.
• Mastercard combines Mastercard and Maestro transactions into one count.
• Mastercard follows Visa. A merchant that meets Visa’s Level 1 criteria is Level 1 for Mastercard too, even with fewer Mastercard transactions.
• You can be placed higher. Brands and acquirers can ask a business below the thresholds to validate at Level 1, for example after a data compromise.

Your acquirer assigns your level, so confirm the result with them in writing.

How does a PCI Level 1 merchant validate?

Each year, a PCI Level 1 merchant produces:

1. A Report on Compliance, recording how every applicable PCI DSS v4.0.1 requirement was tested and the finding for each.
2. An Attestation of Compliance, the signed summary your acquirer relies on.
3. The testing evidence behind it, such as quarterly ASV scans and annual penetration tests (see the calendar below).

Submit them to your acquirer as it directs; it reports your status to the brands where required. Our guide to the PCI ROC explains what the report contains and how the assessment runs.

Does a Level 1 merchant need a QSA?

Not always, under the brands’ published rules. Visa allows a ROC by an internal resource if an officer of the company signs it, and Mastercard accepts a ROC whose AOC is signed by a PCI SSC-certified Internal Security Assessor (ISA) or, unless law or regulation prohibits it, an executive officer of the merchant. An internal route needs suitably trained staff and your acquirer’s agreement. In practice, a QSA is usually involved in these situations:

Our PCI QSA page explains how to verify one, and our buying guide sets out how to choose a PCI QSA in the UK and what to ask before you sign.

What does a Level 1 ROC involve?

A ROC is a full assessment of your cardholder data environment (CDE) against PCI DSS v4.0.1, not a questionnaire. The assessor confirms your scope, examines configurations, reviews documents and records, interviews the people who run each control, observes processes, and samples system components and locations. Fieldwork can be on site, remote or both.

Each requirement is recorded as In Place, Not Applicable, Not Tested or Not in Place, and anything Not in Place must be fixed before the AOC can show you as compliant. Our guide to common PCI audit failures covers the findings assessors raise most often and how to fix them before fieldwork. Compensating controls and customised approach testing are documented in the ROC too.

What must a Level 1 merchant do all year?

A ROC looks back over the year, so recurring controls must have run on time. Each of these PCI DSS v4.0.1 activities leaves evidence the assessor will sample:

Our PCI DSS penetration testing and ASV scanning services cover the testing rows, with ASV scans delivered through our PCI SSC Approved Scanning Vendor partner.

For a first ROC, you do not need four passing quarterly scans before the assessment. PCI DSS allows initial compliance under Requirement 11.3.2 if the most recent scan passed, you have documented procedures requiring scans at least every three months, and vulnerabilities found have been fixed and rescanned. From the second year, passing scans every quarter are expected.

How long does a Level 1 ROC take?

There is no fixed timetable; it depends on your scope and readiness. The phases are predictable:

Renewals are mostly evidence collection and fieldwork. For a first ROC, start the gap analysis well before your acquirer’s validation date; our free PCI compliance check gives you a quick first view of where the gaps are likely to be.

What changes when you become Level 1?

When your acquirer tells you that you are Level 1:

• Get the date in writing. Ask when your first ROC and AOC are due, and whether the acquirer requires a QSA.
• Reduce scope before you assess it. Point-to-point encryption, tokenisation and hosted payment pages can take systems out of the CDE, and a smaller CDE means a smaller ROC.
• Ask about Visa’s Technology Innovation Program. Visa’s compliance page says it removes the requirement to validate (not to comply) for eligible merchants with at least 75% of yearly transactions through EMV chip terminals, a validated P2PE solution or EMVCo-standard tokenisation. Your acquirer confirms whether it is available to you and whether you qualify.

What is a PCI DSS Level 1 service provider?

A PCI DSS Level 1 service provider is a business that handles card data for others at the top service provider level. Service providers have their own levels: under Visa’s and Mastercard’s rules, a service provider that stores, processes or transmits more than 300,000 of the brand’s transactions a year is Level 1, and Mastercard also places Third Party Processors, merchant payment gateways, token service providers and several other provider types at Level 1 whatever their volume. Each needs an annual ROC. Our page on PCI compliance service provider assessments covers their levels and extra requirements.

Why Sovereign Secure

• A PCI SSC-approved assessor. Sovereign Secure Ltd, established in 2012, is a Qualified Security Assessor (QSA), Qualified PIN Assessor (QPA) and Card Production Security Assessor (CPSA) company, and a member of the PCI SSC Global Executive Assessor Roundtable (GEAR) for 2026 to 2028. You can check us on the PCI SSC Qualified Security Assessor list.
• One team for the ROC and the testing. Our PCI compliance audit service delivers Level 1 ROCs and AOCs, alongside penetration and segmentation testing. Readiness advice and the assessment are kept separate, as the PCI SSC expects of a QSA company.
• ISO 27001 certified, with clients shown on our site including Accor, Fiserv, JCPenney and Ticketmaster.

Plan your Level 1 ROC

Send us your last 12 months of transactions by card brand, your payment channels and the validation date your acquirer has given you. We will confirm whether Level 1 applies, outline the route to your ROC and send a fixed quote. Contact our PCI team or call +44 161 523 5276.