What Are the PCI DSS Compliance Levels?

PCI DSS compliance is categorized into different levels, primarily determined by transaction volume. These levels dictate the specific validation requirements an organization must fulfill.

Merchant Compliance Levels

The PCI compliance framework categorizes merchants into different levels based on their annual transaction volume:

Level	Transaction Volume	Validation Requirements
Level 1	Over 6 million transactions annually	Annual on-site assessment (ROC) by QSA, quarterly network scans by ASV, AOC form
Level 2	1-6 million transactions annually	Annual Self-Assessment Questionnaire (SAQ), quarterly network scans by ASV, AOC form
Level 3	20,000-1 million e-commerce transactions annually	Annual SAQ, quarterly network scans by ASV, AOC form
Level 4	Less than 20,000 e-commerce transactions or up to 1 million regular transactions annually	Annual SAQ, quarterly network scans by ASV, AOC form

It's important to note that card brands may define these levels slightly differently, and merchants should confirm their level with their acquiring bank.

Service Provider Levels

Service providers are typically categorized into two levels:

Level	Definition	Validation Requirements
Level 1	All service providers that store, process, or transmit more than 300,000 transactions annually	Annual ROC by QSA, quarterly network scans by ASV, AOC form
Level 2	All service providers that store, process, or transmit fewer than 300,000 transactions annually	Annual SAQ D for Service Providers, quarterly network scans by ASV, AOC form

These validation requirements ensure that organizations maintain appropriate security measures based on their potential risk exposure.