Every organization that stores, processes or transmits cardholder data has PCI DSS obligations — but not the same ones. The card brands tier merchants and service providers by annual transaction volume, and the tier decides how compliance is validated: a self-assessment questionnaire or a full on-site assessment by a Qualified Security Assessor.
Merchant levels at a glance
- Level 1: over 6 million transactions a year (or any merchant that suffered a breach) — annual Report on Compliance by a QSA plus quarterly ASV scans.
- Level 2: 1–6 million transactions — annual SAQ, quarterly scans; some brands and acquirers still expect QSA involvement.
- Level 3: 20,000–1 million e-commerce transactions — annual SAQ and quarterly scans.
- Level 4: everything smaller — SAQ and scans, at the acquirer's discretion.
Service providers are stricter
Service providers — processors, gateways, hosting providers that touch cardholder data — face a lower threshold: over 300,000 transactions puts you at Level 1 with a mandatory QSA Report on Compliance. Below that, a SAQ D may suffice, but large customers routinely demand the RoC anyway, because their own compliance depends on yours.
The part the levels don't change
Validation differs by level; the security requirements don't. All twelve PCI DSS requirement families apply regardless of size, and version 4.x tightened authentication, encryption and continuous-validation expectations for everyone. The most effective lever at any level is scope reduction: segment the cardholder data environment, tokenize wherever possible, and let the smallest defensible footprint carry the compliance burden.
- Know your exact volume per card brand — your acquirer will confirm your level.
- Pick the right SAQ type; the difference between SAQ A and SAQ D is hundreds of requirements.
- Schedule quarterly ASV scans now; four passing quarters can't be produced retroactively.
