PCI compliance levels: which one are you, and why it matters

PCI compliance levels are how the card brands decide how much proof they want from you. There are four of them, and they sort merchants by the number of card transactions you run in a year. Higher volume means more scrutiny, because a bigger business is a bigger target. The good news for most owners reading this: you are almost certainly Level 4, the lightest tier, and that means your yearly obligation is a questionnaire, not an audit.

What are the PCI compliance levels?

The PCI compliance levels are four bands, numbered 1 through 4, set by annual card transaction volume. Level 1 is the largest merchants and Level 4 is the smallest. The exact thresholds are defined by the card brands and can differ slightly between Visa and Mastercard, but the shape is consistent across all of them. Here is the general picture.

Read those numbers as guidance, not gospel. Each network publishes its own table and updates it, and a security incident can bump any merchant up to Level 1 regardless of size. When in doubt, your processor can tell you the level on file for your account.

Which PCI level are most small businesses?

Most small businesses are Level 4. If you run a shop, a restaurant, a clinic, or a small online store and you are under roughly a million card transactions a year, you are in the smallest tier. That is the vast majority of merchants by count. It also means your validation is the lightest version: a yearly Self-Assessment Questionnaire, and a network scan only if your setup calls for one.

To put a million transactions in perspective, that is around 2,700 card sales every single day of the year. A busy independent business ringing 100 or 200 tickets a day is nowhere near it. So if you have been worried about a formal PCI audit, breathe out. That world belongs to Level 1 chains, not to you.

Your PCI level decides how much you have to prove, not how secure you have to be. A Level 4 corner store and a Level 1 retailer follow the same core rules. The smaller merchant just validates with a questionnaire instead of a full audit.

What validation does each level require?

Validation scales with the level. It is the difference between attesting to your own controls and having an outside expert verify them:

• Level 1 is the heaviest. It generally calls for an annual on-site assessment, often by a Qualified Security Assessor, plus quarterly scans of your network by an approved vendor. This is the enterprise tier.
• Levels 2 and 3 typically self-validate with the Self-Assessment Questionnaire each year, and add quarterly network scans where the setup requires them.
• Level 4, where most small merchants sit, is the annual Self-Assessment Questionnaire and scans only if applicable. The exact questionnaire depends on how you take cards.

The single biggest thing you control here is which questionnaire you answer, and that is driven by how much card data touches your own systems. Keep the raw number off your equipment with a modern terminal or gateway, and you land on a shorter SAQ. That is where encryption and tokenization earn their keep, and we cover exactly how in our guide on locking down transactions.

How does this connect to what you pay?

Your level does not change our pricing, and it does not add fees. We pass interchange through at cost and add one flat dime per transaction. The only charge beyond that is a single PCI compliance fee, billed once a year, disclosed in writing before you sign, and it covers your validation and the portal that walks you through the questionnaire for your level. A bigger business does not pay us a bigger markup rate; if anything, the dime can fall as volume grows.

This is general information about how the levels work, not compliance advice for your specific business. Your exact level and questionnaire depend on your volume and how you accept cards. We confirm both with you and keep your validation current as the card brands update their rules.